@enfuce/nextgen-sdk 0.0.6 → 0.0.8

package/dist/exchange-rate/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { GetECBExchangeRateApi, GetECBSupportedCurrenciesApi, GetFXExchangeRatesApi } from './api';
 /**
@@ -40,7 +40,7 @@ export declare class ExchangeRateClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * as oauth from './oauth';
+export * as config from './config';
 export * as card from './card';
 export * as wallet from './wallet';
 export * as cardholder from './cardholder';

package/dist/index.js

@@ -2,8 +2,9 @@
 /* AUTO-GENERATED by scripts/generate.sh - do not edit. */
 /* One namespaced export per API. Usage: import { card } from '@enfuce/nextgen-sdk'; */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.exchangeRate = exports.transactionEvent = exports.clearingFileCopy = exports.threedsOob = exports.threeds = exports.cards = exports.authorisationControl = exports.issuerEvents = exports.pin = exports.cardholder = exports.wallet = exports.card = exports.oauth = void 0;
+exports.exchangeRate = exports.transactionEvent = exports.clearingFileCopy = exports.threedsOob = exports.threeds = exports.cards = exports.authorisationControl = exports.issuerEvents = exports.pin = exports.cardholder = exports.wallet = exports.card = exports.config = exports.oauth = void 0;
 exports.oauth = require("./oauth");
+exports.config = require("./config");
 exports.card = require("./card");
 exports.wallet = require("./wallet");
 exports.cardholder = require("./cardholder");

package/dist/issuer-events/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { IssuerEventWebhooksApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class IssuerEventsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/oauth/axios.d.ts

@@ -1,10 +1,10 @@
 import { AxiosInstance } from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.
@@ -17,4 +17,4 @@ import { TokenManager } from './tokenManager';
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
-export declare function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance;
+export declare function createOAuthAxios(manager: OAuthClientCredentialsManager, instance?: AxiosInstance): AxiosInstance;

package/dist/oauth/axios.js

@@ -28,7 +28,7 @@ function stripBearer(header) {
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.

package/dist/oauth/clientCredentials.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from 'axios';
-import { TokenFetcher, TokenManager } from './tokenManager';
+import { TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
 /** Configuration for the OAuth2 `client_credentials` grant. */
 export interface OAuthConfig {
     tokenUrl: string;
@@ -14,11 +14,25 @@ export interface OAuthConfig {
     /** Axios instance used for the token request. Defaults to a fresh instance. */
     axiosInstance?: AxiosInstance;
 }
+/**
+ * The OAuth2 client-credentials identity — the client id/secret and requested scopes. It carries
+ * no URL: pair it with a token URL (e.g. derived from a `TenantEnvironment`) via the
+ * `clientCredentials(tokenUrl, credentials)` overload below.
+ */
+export interface ClientCredentials {
+    clientId: string;
+    /** May be omitted for a public client. */
+    clientSecret?: string;
+    /** Requested scopes; space-joined into a `scope` parameter. */
+    scopes?: string[];
+}
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
  * `expires_in`. Server-side only — never ship a client secret to a browser.
  */
 export declare function clientCredentialsFetcher(config: OAuthConfig): TokenFetcher;
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): TokenManager;
+/** Convenience: a caching {@link OAuthClientCredentialsManager} backed by the client-credentials grant. */
+export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): OAuthClientCredentialsManager;
+/** Convenience overload pairing a token URL with a {@link ClientCredentials} identity. */
+export declare function clientCredentials(tokenUrl: string, credentials: ClientCredentials, skewSeconds?: number): OAuthClientCredentialsManager;

package/dist/oauth/clientCredentials.js

@@ -57,7 +57,23 @@ function clientCredentialsFetcher(config) {
         return { accessToken: data.access_token, expiresInSeconds: (_b = data.expires_in) !== null && _b !== void 0 ? _b : 0 };
     });
 }
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-function clientCredentials(config, skewSeconds = 60) {
-    return new tokenManager_1.TokenManager(clientCredentialsFetcher(config), skewSeconds);
+function clientCredentials(configOrUrl, credsOrSkew, skewSeconds = 60) {
+    var _a;
+    let config;
+    let skew;
+    if (typeof configOrUrl === 'string') {
+        const creds = credsOrSkew;
+        config = {
+            tokenUrl: configOrUrl,
+            clientId: creds.clientId,
+            clientSecret: (_a = creds.clientSecret) !== null && _a !== void 0 ? _a : '',
+            scopes: creds.scopes,
+        };
+        skew = skewSeconds;
+    }
+    else {
+        config = configOrUrl;
+        skew = typeof credsOrSkew === 'number' ? credsOrSkew : 60;
+    }
+    return new tokenManager_1.OAuthClientCredentialsManager(clientCredentialsFetcher(config), skew);
 }

package/dist/oauth/index.d.ts

@@ -1,3 +1,3 @@
-export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
-export { OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
+export { ClientCredentials, OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/oauth/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCredentials = exports.TokenManager = void 0;
+exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCredentials = exports.OAuthClientCredentialsManager = void 0;
 /*
  * Enfuce nextgen SDK — OAuth token-management helper.
  *
@@ -26,7 +26,7 @@ exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCred
  * Server-side only — a client secret must never ship to a browser.
  */
 var tokenManager_1 = require("./tokenManager");
-Object.defineProperty(exports, "TokenManager", { enumerable: true, get: function () { return tokenManager_1.TokenManager; } });
+Object.defineProperty(exports, "OAuthClientCredentialsManager", { enumerable: true, get: function () { return tokenManager_1.OAuthClientCredentialsManager; } });
 var clientCredentials_1 = require("./clientCredentials");
 Object.defineProperty(exports, "clientCredentials", { enumerable: true, get: function () { return clientCredentials_1.clientCredentials; } });
 Object.defineProperty(exports, "clientCredentialsFetcher", { enumerable: true, get: function () { return clientCredentials_1.clientCredentialsFetcher; } });

package/dist/oauth/tokenManager.d.ts

@@ -11,14 +11,14 @@ export type TokenFetcher = () => Promise<AccessToken>;
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export declare class TokenManager {
+export declare class OAuthClientCredentialsManager {
     private readonly fetcher;
     private readonly skewSeconds;
     private readonly now;

package/dist/oauth/tokenManager.js

@@ -16,20 +16,20 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenManager = void 0;
+exports.OAuthClientCredentialsManager = void 0;
 /**
  * Caches an access token and refreshes it before expiry. Plug it into a generated
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-class TokenManager {
+class OAuthClientCredentialsManager {
     constructor(fetcher, skewSeconds = 60, now = Date.now) {
         this.fetcher = fetcher;
         this.skewSeconds = skewSeconds;
@@ -78,4 +78,4 @@ class TokenManager {
         return this.inflight;
     }
 }
-exports.TokenManager = TokenManager;
+exports.OAuthClientCredentialsManager = OAuthClientCredentialsManager;

package/dist/pin/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { PINOperationsUsingPKIApi, PINOperationsWithPreSharedKeyApi } from './api';
 /**
@@ -38,7 +38,7 @@ export declare class PinClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/threeds/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { ThreeDSApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class ThreedsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/threeds-oob/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { OOBAuthenticationChallengeWebhookNotificationApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class ThreedsOobClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/wallet/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { ActivateTokenApi, DeactivateTokenApi, EligibleTokenRequestorsApi, GetTokensApi, PushCardsApi, PushProvisionApi, SuspendTokenApi, UnsuspendTokenApi } from './api';
 /**
@@ -50,7 +50,7 @@ export declare class WalletClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enfuce/nextgen-sdk",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Enfuce nextgen client SDK (TypeScript). One namespaced export per API.",
   "publishConfig": {
     "access": "public"

package/src/authorisation-control/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   AuthorisationRequestAPIApi,
@@ -50,7 +50,7 @@ export class AuthorisationControlClient {
 export class AuthorisationControlClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class AuthorisationControlClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/card/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   CreateCardApi,
@@ -80,7 +80,7 @@ export class CardClient {
 export class CardClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -90,7 +90,7 @@ export class CardClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/cardholder/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   CreateCardholderApi,
@@ -68,7 +68,7 @@ export class CardholderClient {
 export class CardholderClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -78,7 +78,7 @@ export class CardholderClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/cards/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   CardsApi,
@@ -50,7 +50,7 @@ export class CardsClient {
 export class CardsClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class CardsClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/config/enfuceUrls.ts

@@ -0,0 +1,57 @@
+/*
+ * Enfuce nextgen SDK — tenant/environment addressing helper.
+ *
+ * HAND-WRITTEN, NOT GENERATED. This module (src/config) is authored by hand and
+ * preserved across SDK regeneration (see scripts/generate.sh). Do not expect
+ * OpenAPI Generator to (re)produce it.
+ */
+
+/**
+ * Identifies a single Enfuce deployment by its `tenant` and `environment` — the two variable
+ * segments of every Enfuce host, e.g. `api.<tenant>.<environment>.mycore.enfuce.com`.
+ */
+export interface TenantEnvironment {
+    /** Tenant segment, e.g. `swile`, `shine`, `cad`. */
+    tenant: string;
+    /** Environment segment, e.g. `ext-uat1-sandbox`, `eu.live.prod`. */
+    environment: string;
+}
+
+const DOMAIN_SUFFIX = 'mycore.enfuce.com';
+
+function hostSuffix(te: TenantEnvironment): string {
+    const tenant = te?.tenant?.trim();
+    const environment = te?.environment?.trim();
+    if (!tenant) {
+        throw new Error('tenant must not be empty');
+    }
+    if (!environment) {
+        throw new Error('environment must not be empty');
+    }
+    return `${tenant}.${environment}.${DOMAIN_SUFFIX}`;
+}
+
+/** `https://api.<tenant>.<environment>.mycore.enfuce.com` — the API root, no path. */
+export function apiBaseUrl(te: TenantEnvironment): string {
+    return `https://api.${hostSuffix(te)}`;
+}
+
+/** `.../issuer` — issuer domain (cardholder, card, wallet, pin). */
+export function issuerBaseUrl(te: TenantEnvironment): string {
+    return `${apiBaseUrl(te)}/issuer`;
+}
+
+/** `.../processor` — processor domain (transactions, 3DS). */
+export function processorBaseUrl(te: TenantEnvironment): string {
+    return `${apiBaseUrl(te)}/processor`;
+}
+
+/** `.../exchange-rates-api` — exchange-rate domain. */
+export function exchangeRateBaseUrl(te: TenantEnvironment): string {
+    return `${apiBaseUrl(te)}/exchange-rates-api`;
+}
+
+/** `https://auth.<tenant>.<environment>.mycore.enfuce.com/oauth2/token` — OAuth2 token endpoint. */
+export function tokenUrl(te: TenantEnvironment): string {
+    return `https://auth.${hostSuffix(te)}/oauth2/token`;
+}

package/src/config/index.ts

@@ -0,0 +1,21 @@
+/*
+ * Enfuce nextgen SDK — tenant/environment addressing helper.
+ *
+ * HAND-WRITTEN, NOT GENERATED. This module (src/config) is authored by hand and
+ * preserved across SDK regeneration (see scripts/generate.sh). It is re-exported
+ * from the package barrel as `config`:
+ *
+ *   import { config, cardholder, oauth } from '@enfuce/nextgen-sdk';
+ *
+ *   const te = { tenant: 'swile', environment: 'ext-uat1-sandbox' };
+ *   const conf = new cardholder.Configuration({ basePath: config.issuerBaseUrl(te) });
+ *   const tokens = oauth.clientCredentials({ tokenUrl: config.tokenUrl(te), clientId, clientSecret });
+ */
+export {
+    TenantEnvironment,
+    apiBaseUrl,
+    issuerBaseUrl,
+    processorBaseUrl,
+    exchangeRateBaseUrl,
+    tokenUrl,
+} from './enfuceUrls';

package/src/exchange-rate/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   GetECBExchangeRateApi,
@@ -62,7 +62,7 @@ export class ExchangeRateClient {
 export class ExchangeRateClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -72,7 +72,7 @@ export class ExchangeRateClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/index.ts

@@ -2,6 +2,7 @@
 /* One namespaced export per API. Usage: import { card } from '@enfuce/nextgen-sdk'; */
 
 export * as oauth from './oauth';
+export * as config from './config';
 
 export * as card from './card';
 export * as wallet from './wallet';

package/src/issuer-events/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   IssuerEventWebhooksApi,
@@ -50,7 +50,7 @@ export class IssuerEventsClient {
 export class IssuerEventsClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class IssuerEventsClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/oauth/axios.ts

@@ -6,7 +6,7 @@
  * OpenAPI Generator to (re)produce it.
  */
 import axios, { AxiosError, AxiosInstance, InternalAxiosRequestConfig } from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 
 const BEARER_PREFIX = 'Bearer ';
 
@@ -22,7 +22,7 @@ function stripBearer(header: string): string {
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.
@@ -35,7 +35,7 @@ function stripBearer(header: string): string {
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
-export function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance {
+export function createOAuthAxios(manager: OAuthClientCredentialsManager, instance?: AxiosInstance): AxiosInstance {
     const http = instance ?? axios.create();
 
     // Proactive: attach a fresh bearer token to every outgoing request.

package/src/oauth/clientCredentials.ts

@@ -6,7 +6,7 @@
  * OpenAPI Generator to (re)produce it.
  */
 import axios, { AxiosInstance, AxiosRequestConfig } from 'axios';
-import { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
+import { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
 
 /** Configuration for the OAuth2 `client_credentials` grant. */
 export interface OAuthConfig {
@@ -23,6 +23,19 @@ export interface OAuthConfig {
     axiosInstance?: AxiosInstance;
 }
 
+/**
+ * The OAuth2 client-credentials identity — the client id/secret and requested scopes. It carries
+ * no URL: pair it with a token URL (e.g. derived from a `TenantEnvironment`) via the
+ * `clientCredentials(tokenUrl, credentials)` overload below.
+ */
+export interface ClientCredentials {
+    clientId: string;
+    /** May be omitted for a public client. */
+    clientSecret?: string;
+    /** Requested scopes; space-joined into a `scope` parameter. */
+    scopes?: string[];
+}
+
 interface TokenResponse {
     access_token?: string;
     expires_in?: number;
@@ -66,7 +79,33 @@ export function clientCredentialsFetcher(config: OAuthConfig): TokenFetcher {
     };
 }
 
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export function clientCredentials(config: OAuthConfig, skewSeconds: number = 60): TokenManager {
-    return new TokenManager(clientCredentialsFetcher(config), skewSeconds);
+/** Convenience: a caching {@link OAuthClientCredentialsManager} backed by the client-credentials grant. */
+export function clientCredentials(config: OAuthConfig, skewSeconds?: number): OAuthClientCredentialsManager;
+/** Convenience overload pairing a token URL with a {@link ClientCredentials} identity. */
+export function clientCredentials(
+    tokenUrl: string,
+    credentials: ClientCredentials,
+    skewSeconds?: number,
+): OAuthClientCredentialsManager;
+export function clientCredentials(
+    configOrUrl: OAuthConfig | string,
+    credsOrSkew?: ClientCredentials | number,
+    skewSeconds = 60,
+): OAuthClientCredentialsManager {
+    let config: OAuthConfig;
+    let skew: number;
+    if (typeof configOrUrl === 'string') {
+        const creds = credsOrSkew as ClientCredentials;
+        config = {
+            tokenUrl: configOrUrl,
+            clientId: creds.clientId,
+            clientSecret: creds.clientSecret ?? '',
+            scopes: creds.scopes,
+        };
+        skew = skewSeconds;
+    } else {
+        config = configOrUrl;
+        skew = typeof credsOrSkew === 'number' ? credsOrSkew : 60;
+    }
+    return new OAuthClientCredentialsManager(clientCredentialsFetcher(config), skew);
 }