allow multipart forms. add package api handler

oauth3.core.js

@@ -900,13 +900,30 @@
           };
           xhr.open(preq.method || 'GET', preq.url, true);
           var headers = preq.headers || {};
+          var multipart;
+
           if (preq.data) {
             headers['Content-Type'] = 'application/json'; // TODO XXX TODO utf8
           }
           Object.keys(headers).forEach(function (key) {
             xhr.setRequestHeader(key, headers[key]);
           });
+          if (preq.multipart && !(preq.multipart instanceof window.FormData)) {
+            multipart = new window.FormData();
+            Object.keys(preq.multipart).forEach(function (key) {
+              multipart.append(key, preq.multipart[key]);
+            });
+          }
+          else {
+            multipart = preq.multipart;
+          }
+
+          if (multipart) {
+            xhr.send(multipart);
+          }
+          else {
             xhr.send(JSON.stringify(preq.data));
+          }
         });
       }
     , frameRequest: function (url, state, opts) {
@@ -1060,6 +1077,18 @@
 
       return OAUTH3.api[opts.api](providerUri, opts);
     }
+  , _pkgs: {}
+  , pkg: function (providerUri, pkgname, method, opts) {
+      if (!OAUTH3._pkgs[pkgname]) {
+        return OAUTH3.PromiseA.reject(new Error("No Package for '" + pkgname + "'"));
+      }
+
+      if (!OAUTH3._pkgs[pkgname][method]) {
+        return OAUTH3.PromiseA.reject(new Error("No method '" + method + "' in package '" + pkgname + "'"));
+      }
+      // opts = { audience: providerUri }
+      return OAUTH3._pkgs[pkgname][method](opts);
+    }
   };
   OAUTH3.login = OAUTH3.implicitGrant;
 
@@ -1239,6 +1268,28 @@
 
         return OAUTH3.api(this._resourceProviderDirectives.api, opts);
       }
+    , pkg: function (pkgname) {
+        var me = this;
+        var pkg;
+        var result = {};
+
+        // TODO dynamically load package? https://publisher.com/.well-known/packages.js@oauth3.org/pkg@publisher.com.json
+        if (!OAUTH3._pkgs[pkgname]) {
+          return OAUTH3.PromiseA.reject(new Error("No Package for '" + pkgname + "'"));
+        }
+
+        pkg = OAUTH3._pkgs[pkgname];
+        Object.keys(pkg).forEach(function (key) {
+          result[key] = function (opts) {
+            opts = opts || {};
+            opts.session = OAUTH3.hooks.session._getCached(me._identityProviderUri);
+            opts.audience = me._resourceProviderDirectives.api;
+            return pkg[key](opts);
+          };
+        });
+
+        return result;
+      }
     };
     result.setIssuer = result.setIdentityProvider;
     result.setAudience = result.setResourceProvider;