@enfuce/nextgen-sdk 0.0.6 → 0.0.8

package/README.md

@@ -16,19 +16,22 @@ Each API is exposed under its own namespace, and every module ships a fluent `<M
 instance to the module's configuration and exposes each API:
 
 ```typescript
-import { oauth, card } from '@enfuce/nextgen-sdk';
+import { oauth, card, config } from '@enfuce/nextgen-sdk';
+
+// Identify the host by tenant + environment; the config helper derives every URL from it.
+const te = { tenant: '<tenant>', environment: 'eu.live.prod' };
 
 // One token manager (cached client-credentials grant) — reuse it across every module.
-const tokens = oauth.clientCredentials({
-  tokenUrl: 'https://auth.<tenant>.enfuce.com/oauth2/token',
+const clientCredentialsManager = oauth.clientCredentials({
+  tokenUrl: config.tokenUrl(te),
   clientId: '<client-id>',
   clientSecret: '<client-secret>',
   scopes: ['issuer/admin.read'],
 });
 
 const client = card.CardClient.builder()
-  .baseUrl('https://api.<tenant>.eu.live.prod.mycore.enfuce.com/issuer')
-  .oauth(tokens)                                    // token on every request + reactive 401 retry
+  .baseUrl(config.issuerBaseUrl(te))
+  .oauth(clientCredentialsManager)                                    // token on every request + reactive 401 retry
   .configure((http) => { http.defaults.timeout = 10_000; })  // optional: timeout, proxy, headers …
   .build();
 
@@ -41,9 +44,19 @@ is available for every module, including ones whose spec declares no security sc
 (e.g. `exchangeRate.ExchangeRateClient`).
 
 Prefer the lower level? Build your own axios and pass it through:
-`oauth.createOAuthAxios(tokens, axios.create({ timeout: 10_000 }))`, then
+`oauth.createOAuthAxios(clientCredentialsManager, axios.create({ timeout: 10_000 }))`, then
 `new card.GetCardApi(new card.Configuration({ basePath }), undefined, http)`.
 
+Keeping the token URL separate from the client identity? Pass a `ClientCredentials` — e.g. with the
+`config` helper deriving the URL:
+```typescript
+const clientCredentialsManager = oauth.clientCredentials(config.tokenUrl(te), {
+  clientId: '<client-id>',
+  clientSecret: '<client-secret>',
+  scopes: ['issuer/admin.read'],
+});
+```
+
 ## Available APIs
 
 - `oauth` — OAuth2 `client_credentials` token-management helper

package/dist/authorisation-control/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { AuthorisationRequestAPIApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class AuthorisationControlClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/card/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CreateCardApi, CreatePINControlAccessTokenApi, GetCardApi, GetCardPaymentInfoApi, GetPlasticManufacturingHistoryApi, UpdateCardApi } from './api';
 /**
@@ -46,7 +46,7 @@ export declare class CardClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/cardholder/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CreateCardholderApi, GetCardholderApi, GetCardsByCardholderIdApi, UpdateCardholderApi } from './api';
 /**
@@ -42,7 +42,7 @@ export declare class CardholderClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/cards/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CardsApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class CardsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/config/enfuceUrls.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Identifies a single Enfuce deployment by its `tenant` and `environment` — the two variable
+ * segments of every Enfuce host, e.g. `api.<tenant>.<environment>.mycore.enfuce.com`.
+ */
+export interface TenantEnvironment {
+    /** Tenant segment, e.g. `swile`, `shine`, `cad`. */
+    tenant: string;
+    /** Environment segment, e.g. `ext-uat1-sandbox`, `eu.live.prod`. */
+    environment: string;
+}
+/** `https://api.<tenant>.<environment>.mycore.enfuce.com` — the API root, no path. */
+export declare function apiBaseUrl(te: TenantEnvironment): string;
+/** `.../issuer` — issuer domain (cardholder, card, wallet, pin). */
+export declare function issuerBaseUrl(te: TenantEnvironment): string;
+/** `.../processor` — processor domain (transactions, 3DS). */
+export declare function processorBaseUrl(te: TenantEnvironment): string;
+/** `.../exchange-rates-api` — exchange-rate domain. */
+export declare function exchangeRateBaseUrl(te: TenantEnvironment): string;
+/** `https://auth.<tenant>.<environment>.mycore.enfuce.com/oauth2/token` — OAuth2 token endpoint. */
+export declare function tokenUrl(te: TenantEnvironment): string;

package/dist/config/enfuceUrls.js

@@ -0,0 +1,47 @@
+"use strict";
+/*
+ * Enfuce nextgen SDK — tenant/environment addressing helper.
+ *
+ * HAND-WRITTEN, NOT GENERATED. This module (src/config) is authored by hand and
+ * preserved across SDK regeneration (see scripts/generate.sh). Do not expect
+ * OpenAPI Generator to (re)produce it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiBaseUrl = apiBaseUrl;
+exports.issuerBaseUrl = issuerBaseUrl;
+exports.processorBaseUrl = processorBaseUrl;
+exports.exchangeRateBaseUrl = exchangeRateBaseUrl;
+exports.tokenUrl = tokenUrl;
+const DOMAIN_SUFFIX = 'mycore.enfuce.com';
+function hostSuffix(te) {
+    var _a, _b;
+    const tenant = (_a = te === null || te === void 0 ? void 0 : te.tenant) === null || _a === void 0 ? void 0 : _a.trim();
+    const environment = (_b = te === null || te === void 0 ? void 0 : te.environment) === null || _b === void 0 ? void 0 : _b.trim();
+    if (!tenant) {
+        throw new Error('tenant must not be empty');
+    }
+    if (!environment) {
+        throw new Error('environment must not be empty');
+    }
+    return `${tenant}.${environment}.${DOMAIN_SUFFIX}`;
+}
+/** `https://api.<tenant>.<environment>.mycore.enfuce.com` — the API root, no path. */
+function apiBaseUrl(te) {
+    return `https://api.${hostSuffix(te)}`;
+}
+/** `.../issuer` — issuer domain (cardholder, card, wallet, pin). */
+function issuerBaseUrl(te) {
+    return `${apiBaseUrl(te)}/issuer`;
+}
+/** `.../processor` — processor domain (transactions, 3DS). */
+function processorBaseUrl(te) {
+    return `${apiBaseUrl(te)}/processor`;
+}
+/** `.../exchange-rates-api` — exchange-rate domain. */
+function exchangeRateBaseUrl(te) {
+    return `${apiBaseUrl(te)}/exchange-rates-api`;
+}
+/** `https://auth.<tenant>.<environment>.mycore.enfuce.com/oauth2/token` — OAuth2 token endpoint. */
+function tokenUrl(te) {
+    return `https://auth.${hostSuffix(te)}/oauth2/token`;
+}

package/dist/config/index.d.ts

@@ -0,0 +1 @@
+export { TenantEnvironment, apiBaseUrl, issuerBaseUrl, processorBaseUrl, exchangeRateBaseUrl, tokenUrl, } from './enfuceUrls';

package/dist/config/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenUrl = exports.exchangeRateBaseUrl = exports.processorBaseUrl = exports.issuerBaseUrl = exports.apiBaseUrl = void 0;
+/*
+ * Enfuce nextgen SDK — tenant/environment addressing helper.
+ *
+ * HAND-WRITTEN, NOT GENERATED. This module (src/config) is authored by hand and
+ * preserved across SDK regeneration (see scripts/generate.sh). It is re-exported
+ * from the package barrel as `config`:
+ *
+ *   import { config, cardholder, oauth } from '@enfuce/nextgen-sdk';
+ *
+ *   const te = { tenant: 'swile', environment: 'ext-uat1-sandbox' };
+ *   const conf = new cardholder.Configuration({ basePath: config.issuerBaseUrl(te) });
+ *   const tokens = oauth.clientCredentials({ tokenUrl: config.tokenUrl(te), clientId, clientSecret });
+ */
+var enfuceUrls_1 = require("./enfuceUrls");
+Object.defineProperty(exports, "apiBaseUrl", { enumerable: true, get: function () { return enfuceUrls_1.apiBaseUrl; } });
+Object.defineProperty(exports, "issuerBaseUrl", { enumerable: true, get: function () { return enfuceUrls_1.issuerBaseUrl; } });
+Object.defineProperty(exports, "processorBaseUrl", { enumerable: true, get: function () { return enfuceUrls_1.processorBaseUrl; } });
+Object.defineProperty(exports, "exchangeRateBaseUrl", { enumerable: true, get: function () { return enfuceUrls_1.exchangeRateBaseUrl; } });
+Object.defineProperty(exports, "tokenUrl", { enumerable: true, get: function () { return enfuceUrls_1.tokenUrl; } });

package/dist/esm/authorisation-control/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { AuthorisationRequestAPIApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class AuthorisationControlClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/card/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CreateCardApi, CreatePINControlAccessTokenApi, GetCardApi, GetCardPaymentInfoApi, GetPlasticManufacturingHistoryApi, UpdateCardApi } from './api';
 /**
@@ -46,7 +46,7 @@ export declare class CardClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/cardholder/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CreateCardholderApi, GetCardholderApi, GetCardsByCardholderIdApi, UpdateCardholderApi } from './api';
 /**
@@ -42,7 +42,7 @@ export declare class CardholderClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/cards/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CardsApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class CardsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/config/enfuceUrls.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Identifies a single Enfuce deployment by its `tenant` and `environment` — the two variable
+ * segments of every Enfuce host, e.g. `api.<tenant>.<environment>.mycore.enfuce.com`.
+ */
+export interface TenantEnvironment {
+    /** Tenant segment, e.g. `swile`, `shine`, `cad`. */
+    tenant: string;
+    /** Environment segment, e.g. `ext-uat1-sandbox`, `eu.live.prod`. */
+    environment: string;
+}
+/** `https://api.<tenant>.<environment>.mycore.enfuce.com` — the API root, no path. */
+export declare function apiBaseUrl(te: TenantEnvironment): string;
+/** `.../issuer` — issuer domain (cardholder, card, wallet, pin). */
+export declare function issuerBaseUrl(te: TenantEnvironment): string;
+/** `.../processor` — processor domain (transactions, 3DS). */
+export declare function processorBaseUrl(te: TenantEnvironment): string;
+/** `.../exchange-rates-api` — exchange-rate domain. */
+export declare function exchangeRateBaseUrl(te: TenantEnvironment): string;
+/** `https://auth.<tenant>.<environment>.mycore.enfuce.com/oauth2/token` — OAuth2 token endpoint. */
+export declare function tokenUrl(te: TenantEnvironment): string;

package/dist/esm/config/enfuceUrls.js

@@ -0,0 +1,40 @@
+/*
+ * Enfuce nextgen SDK — tenant/environment addressing helper.
+ *
+ * HAND-WRITTEN, NOT GENERATED. This module (src/config) is authored by hand and
+ * preserved across SDK regeneration (see scripts/generate.sh). Do not expect
+ * OpenAPI Generator to (re)produce it.
+ */
+const DOMAIN_SUFFIX = 'mycore.enfuce.com';
+function hostSuffix(te) {
+    var _a, _b;
+    const tenant = (_a = te === null || te === void 0 ? void 0 : te.tenant) === null || _a === void 0 ? void 0 : _a.trim();
+    const environment = (_b = te === null || te === void 0 ? void 0 : te.environment) === null || _b === void 0 ? void 0 : _b.trim();
+    if (!tenant) {
+        throw new Error('tenant must not be empty');
+    }
+    if (!environment) {
+        throw new Error('environment must not be empty');
+    }
+    return `${tenant}.${environment}.${DOMAIN_SUFFIX}`;
+}
+/** `https://api.<tenant>.<environment>.mycore.enfuce.com` — the API root, no path. */
+export function apiBaseUrl(te) {
+    return `https://api.${hostSuffix(te)}`;
+}
+/** `.../issuer` — issuer domain (cardholder, card, wallet, pin). */
+export function issuerBaseUrl(te) {
+    return `${apiBaseUrl(te)}/issuer`;
+}
+/** `.../processor` — processor domain (transactions, 3DS). */
+export function processorBaseUrl(te) {
+    return `${apiBaseUrl(te)}/processor`;
+}
+/** `.../exchange-rates-api` — exchange-rate domain. */
+export function exchangeRateBaseUrl(te) {
+    return `${apiBaseUrl(te)}/exchange-rates-api`;
+}
+/** `https://auth.<tenant>.<environment>.mycore.enfuce.com/oauth2/token` — OAuth2 token endpoint. */
+export function tokenUrl(te) {
+    return `https://auth.${hostSuffix(te)}/oauth2/token`;
+}

package/dist/esm/config/index.d.ts

@@ -0,0 +1 @@
+export { TenantEnvironment, apiBaseUrl, issuerBaseUrl, processorBaseUrl, exchangeRateBaseUrl, tokenUrl, } from './enfuceUrls';

package/dist/esm/config/index.js

@@ -0,0 +1,14 @@
+/*
+ * Enfuce nextgen SDK — tenant/environment addressing helper.
+ *
+ * HAND-WRITTEN, NOT GENERATED. This module (src/config) is authored by hand and
+ * preserved across SDK regeneration (see scripts/generate.sh). It is re-exported
+ * from the package barrel as `config`:
+ *
+ *   import { config, cardholder, oauth } from '@enfuce/nextgen-sdk';
+ *
+ *   const te = { tenant: 'swile', environment: 'ext-uat1-sandbox' };
+ *   const conf = new cardholder.Configuration({ basePath: config.issuerBaseUrl(te) });
+ *   const tokens = oauth.clientCredentials({ tokenUrl: config.tokenUrl(te), clientId, clientSecret });
+ */
+export { apiBaseUrl, issuerBaseUrl, processorBaseUrl, exchangeRateBaseUrl, tokenUrl, } from './enfuceUrls';

package/dist/esm/exchange-rate/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { GetECBExchangeRateApi, GetECBSupportedCurrenciesApi, GetFXExchangeRatesApi } from './api';
 /**
@@ -40,7 +40,7 @@ export declare class ExchangeRateClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/index.d.ts

@@ -1,4 +1,5 @@
 export * as oauth from './oauth';
+export * as config from './config';
 export * as card from './card';
 export * as wallet from './wallet';
 export * as cardholder from './cardholder';

package/dist/esm/index.js

@@ -1,6 +1,7 @@
 /* AUTO-GENERATED by scripts/generate.sh - do not edit. */
 /* One namespaced export per API. Usage: import { card } from '@enfuce/nextgen-sdk'; */
 export * as oauth from './oauth';
+export * as config from './config';
 export * as card from './card';
 export * as wallet from './wallet';
 export * as cardholder from './cardholder';

package/dist/esm/issuer-events/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { IssuerEventWebhooksApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class IssuerEventsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/oauth/axios.d.ts

@@ -1,10 +1,10 @@
 import { AxiosInstance } from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.
@@ -17,4 +17,4 @@ import { TokenManager } from './tokenManager';
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
-export declare function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance;
+export declare function createOAuthAxios(manager: OAuthClientCredentialsManager, instance?: AxiosInstance): AxiosInstance;

package/dist/esm/oauth/axios.js

@@ -25,7 +25,7 @@ function stripBearer(header) {
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.

package/dist/esm/oauth/clientCredentials.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from 'axios';
-import { TokenFetcher, TokenManager } from './tokenManager';
+import { TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
 /** Configuration for the OAuth2 `client_credentials` grant. */
 export interface OAuthConfig {
     tokenUrl: string;
@@ -14,11 +14,25 @@ export interface OAuthConfig {
     /** Axios instance used for the token request. Defaults to a fresh instance. */
     axiosInstance?: AxiosInstance;
 }
+/**
+ * The OAuth2 client-credentials identity — the client id/secret and requested scopes. It carries
+ * no URL: pair it with a token URL (e.g. derived from a `TenantEnvironment`) via the
+ * `clientCredentials(tokenUrl, credentials)` overload below.
+ */
+export interface ClientCredentials {
+    clientId: string;
+    /** May be omitted for a public client. */
+    clientSecret?: string;
+    /** Requested scopes; space-joined into a `scope` parameter. */
+    scopes?: string[];
+}
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
  * `expires_in`. Server-side only — never ship a client secret to a browser.
  */
 export declare function clientCredentialsFetcher(config: OAuthConfig): TokenFetcher;
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): TokenManager;
+/** Convenience: a caching {@link OAuthClientCredentialsManager} backed by the client-credentials grant. */
+export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): OAuthClientCredentialsManager;
+/** Convenience overload pairing a token URL with a {@link ClientCredentials} identity. */
+export declare function clientCredentials(tokenUrl: string, credentials: ClientCredentials, skewSeconds?: number): OAuthClientCredentialsManager;

package/dist/esm/oauth/clientCredentials.js

@@ -15,7 +15,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
  * OpenAPI Generator to (re)produce it.
  */
 import axios from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
@@ -53,7 +53,23 @@ export function clientCredentialsFetcher(config) {
         return { accessToken: data.access_token, expiresInSeconds: (_b = data.expires_in) !== null && _b !== void 0 ? _b : 0 };
     });
 }
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export function clientCredentials(config, skewSeconds = 60) {
-    return new TokenManager(clientCredentialsFetcher(config), skewSeconds);
+export function clientCredentials(configOrUrl, credsOrSkew, skewSeconds = 60) {
+    var _a;
+    let config;
+    let skew;
+    if (typeof configOrUrl === 'string') {
+        const creds = credsOrSkew;
+        config = {
+            tokenUrl: configOrUrl,
+            clientId: creds.clientId,
+            clientSecret: (_a = creds.clientSecret) !== null && _a !== void 0 ? _a : '',
+            scopes: creds.scopes,
+        };
+        skew = skewSeconds;
+    }
+    else {
+        config = configOrUrl;
+        skew = typeof credsOrSkew === 'number' ? credsOrSkew : 60;
+    }
+    return new OAuthClientCredentialsManager(clientCredentialsFetcher(config), skew);
 }

package/dist/esm/oauth/index.d.ts

@@ -1,3 +1,3 @@
-export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
-export { OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
+export { ClientCredentials, OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/esm/oauth/index.js

@@ -22,6 +22,6 @@
  *
  * Server-side only — a client secret must never ship to a browser.
  */
-export { TokenManager } from './tokenManager';
+export { OAuthClientCredentialsManager } from './tokenManager';
 export { clientCredentials, clientCredentialsFetcher } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/esm/oauth/tokenManager.d.ts

@@ -11,14 +11,14 @@ export type TokenFetcher = () => Promise<AccessToken>;
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export declare class TokenManager {
+export declare class OAuthClientCredentialsManager {
     private readonly fetcher;
     private readonly skewSeconds;
     private readonly now;

package/dist/esm/oauth/tokenManager.js

@@ -19,14 +19,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export class TokenManager {
+export class OAuthClientCredentialsManager {
     constructor(fetcher, skewSeconds = 60, now = Date.now) {
         this.fetcher = fetcher;
         this.skewSeconds = skewSeconds;

package/dist/esm/pin/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { PINOperationsUsingPKIApi, PINOperationsWithPreSharedKeyApi } from './api';
 /**
@@ -38,7 +38,7 @@ export declare class PinClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/threeds/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { ThreeDSApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class ThreedsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/threeds-oob/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { OOBAuthenticationChallengeWebhookNotificationApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class ThreedsOobClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/wallet/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { ActivateTokenApi, DeactivateTokenApi, EligibleTokenRequestorsApi, GetTokensApi, PushCardsApi, PushProvisionApi, SuspendTokenApi, UnsuspendTokenApi } from './api';
 /**
@@ -50,7 +50,7 @@ export declare class WalletClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple