@enfuce/nextgen-sdk 0.0.7 → 0.0.8

package/README.md

@@ -16,19 +16,22 @@ Each API is exposed under its own namespace, and every module ships a fluent `<M
 instance to the module's configuration and exposes each API:
 
 ```typescript
-import { oauth, card } from '@enfuce/nextgen-sdk';
+import { oauth, card, config } from '@enfuce/nextgen-sdk';
+
+// Identify the host by tenant + environment; the config helper derives every URL from it.
+const te = { tenant: '<tenant>', environment: 'eu.live.prod' };
 
 // One token manager (cached client-credentials grant) — reuse it across every module.
-const tokens = oauth.clientCredentials({
-  tokenUrl: 'https://auth.<tenant>.enfuce.com/oauth2/token',
+const clientCredentialsManager = oauth.clientCredentials({
+  tokenUrl: config.tokenUrl(te),
   clientId: '<client-id>',
   clientSecret: '<client-secret>',
   scopes: ['issuer/admin.read'],
 });
 
 const client = card.CardClient.builder()
-  .baseUrl('https://api.<tenant>.eu.live.prod.mycore.enfuce.com/issuer')
-  .oauth(tokens)                                    // token on every request + reactive 401 retry
+  .baseUrl(config.issuerBaseUrl(te))
+  .oauth(clientCredentialsManager)                                    // token on every request + reactive 401 retry
   .configure((http) => { http.defaults.timeout = 10_000; })  // optional: timeout, proxy, headers …
   .build();
 
@@ -41,9 +44,19 @@ is available for every module, including ones whose spec declares no security sc
 (e.g. `exchangeRate.ExchangeRateClient`).
 
 Prefer the lower level? Build your own axios and pass it through:
-`oauth.createOAuthAxios(tokens, axios.create({ timeout: 10_000 }))`, then
+`oauth.createOAuthAxios(clientCredentialsManager, axios.create({ timeout: 10_000 }))`, then
 `new card.GetCardApi(new card.Configuration({ basePath }), undefined, http)`.
 
+Keeping the token URL separate from the client identity? Pass a `ClientCredentials` — e.g. with the
+`config` helper deriving the URL:
+```typescript
+const clientCredentialsManager = oauth.clientCredentials(config.tokenUrl(te), {
+  clientId: '<client-id>',
+  clientSecret: '<client-secret>',
+  scopes: ['issuer/admin.read'],
+});
+```
+
 ## Available APIs
 
 - `oauth` — OAuth2 `client_credentials` token-management helper

package/dist/authorisation-control/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { AuthorisationRequestAPIApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class AuthorisationControlClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/card/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CreateCardApi, CreatePINControlAccessTokenApi, GetCardApi, GetCardPaymentInfoApi, GetPlasticManufacturingHistoryApi, UpdateCardApi } from './api';
 /**
@@ -46,7 +46,7 @@ export declare class CardClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/cardholder/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CreateCardholderApi, GetCardholderApi, GetCardsByCardholderIdApi, UpdateCardholderApi } from './api';
 /**
@@ -42,7 +42,7 @@ export declare class CardholderClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/cards/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CardsApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class CardsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/authorisation-control/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { AuthorisationRequestAPIApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class AuthorisationControlClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/card/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CreateCardApi, CreatePINControlAccessTokenApi, GetCardApi, GetCardPaymentInfoApi, GetPlasticManufacturingHistoryApi, UpdateCardApi } from './api';
 /**
@@ -46,7 +46,7 @@ export declare class CardClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/cardholder/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CreateCardholderApi, GetCardholderApi, GetCardsByCardholderIdApi, UpdateCardholderApi } from './api';
 /**
@@ -42,7 +42,7 @@ export declare class CardholderClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/cards/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { CardsApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class CardsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/exchange-rate/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { GetECBExchangeRateApi, GetECBSupportedCurrenciesApi, GetFXExchangeRatesApi } from './api';
 /**
@@ -40,7 +40,7 @@ export declare class ExchangeRateClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/issuer-events/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { IssuerEventWebhooksApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class IssuerEventsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/oauth/axios.d.ts

@@ -1,10 +1,10 @@
 import { AxiosInstance } from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.
@@ -17,4 +17,4 @@ import { TokenManager } from './tokenManager';
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
-export declare function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance;
+export declare function createOAuthAxios(manager: OAuthClientCredentialsManager, instance?: AxiosInstance): AxiosInstance;

package/dist/esm/oauth/axios.js

@@ -25,7 +25,7 @@ function stripBearer(header) {
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.

package/dist/esm/oauth/clientCredentials.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from 'axios';
-import { TokenFetcher, TokenManager } from './tokenManager';
+import { TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
 /** Configuration for the OAuth2 `client_credentials` grant. */
 export interface OAuthConfig {
     tokenUrl: string;
@@ -14,11 +14,25 @@ export interface OAuthConfig {
     /** Axios instance used for the token request. Defaults to a fresh instance. */
     axiosInstance?: AxiosInstance;
 }
+/**
+ * The OAuth2 client-credentials identity — the client id/secret and requested scopes. It carries
+ * no URL: pair it with a token URL (e.g. derived from a `TenantEnvironment`) via the
+ * `clientCredentials(tokenUrl, credentials)` overload below.
+ */
+export interface ClientCredentials {
+    clientId: string;
+    /** May be omitted for a public client. */
+    clientSecret?: string;
+    /** Requested scopes; space-joined into a `scope` parameter. */
+    scopes?: string[];
+}
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
  * `expires_in`. Server-side only — never ship a client secret to a browser.
  */
 export declare function clientCredentialsFetcher(config: OAuthConfig): TokenFetcher;
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): TokenManager;
+/** Convenience: a caching {@link OAuthClientCredentialsManager} backed by the client-credentials grant. */
+export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): OAuthClientCredentialsManager;
+/** Convenience overload pairing a token URL with a {@link ClientCredentials} identity. */
+export declare function clientCredentials(tokenUrl: string, credentials: ClientCredentials, skewSeconds?: number): OAuthClientCredentialsManager;

package/dist/esm/oauth/clientCredentials.js

@@ -15,7 +15,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
  * OpenAPI Generator to (re)produce it.
  */
 import axios from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
@@ -53,7 +53,23 @@ export function clientCredentialsFetcher(config) {
         return { accessToken: data.access_token, expiresInSeconds: (_b = data.expires_in) !== null && _b !== void 0 ? _b : 0 };
     });
 }
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export function clientCredentials(config, skewSeconds = 60) {
-    return new TokenManager(clientCredentialsFetcher(config), skewSeconds);
+export function clientCredentials(configOrUrl, credsOrSkew, skewSeconds = 60) {
+    var _a;
+    let config;
+    let skew;
+    if (typeof configOrUrl === 'string') {
+        const creds = credsOrSkew;
+        config = {
+            tokenUrl: configOrUrl,
+            clientId: creds.clientId,
+            clientSecret: (_a = creds.clientSecret) !== null && _a !== void 0 ? _a : '',
+            scopes: creds.scopes,
+        };
+        skew = skewSeconds;
+    }
+    else {
+        config = configOrUrl;
+        skew = typeof credsOrSkew === 'number' ? credsOrSkew : 60;
+    }
+    return new OAuthClientCredentialsManager(clientCredentialsFetcher(config), skew);
 }

package/dist/esm/oauth/index.d.ts

@@ -1,3 +1,3 @@
-export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
-export { OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
+export { ClientCredentials, OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/esm/oauth/index.js

@@ -22,6 +22,6 @@
  *
  * Server-side only — a client secret must never ship to a browser.
  */
-export { TokenManager } from './tokenManager';
+export { OAuthClientCredentialsManager } from './tokenManager';
 export { clientCredentials, clientCredentialsFetcher } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/esm/oauth/tokenManager.d.ts

@@ -11,14 +11,14 @@ export type TokenFetcher = () => Promise<AccessToken>;
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export declare class TokenManager {
+export declare class OAuthClientCredentialsManager {
     private readonly fetcher;
     private readonly skewSeconds;
     private readonly now;

package/dist/esm/oauth/tokenManager.js

@@ -19,14 +19,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export class TokenManager {
+export class OAuthClientCredentialsManager {
     constructor(fetcher, skewSeconds = 60, now = Date.now) {
         this.fetcher = fetcher;
         this.skewSeconds = skewSeconds;

package/dist/esm/pin/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { PINOperationsUsingPKIApi, PINOperationsWithPreSharedKeyApi } from './api';
 /**
@@ -38,7 +38,7 @@ export declare class PinClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/threeds/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { ThreeDSApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class ThreedsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/threeds-oob/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { OOBAuthenticationChallengeWebhookNotificationApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class ThreedsOobClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/esm/wallet/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { ActivateTokenApi, DeactivateTokenApi, EligibleTokenRequestorsApi, GetTokensApi, PushCardsApi, PushProvisionApi, SuspendTokenApi, UnsuspendTokenApi } from './api';
 /**
@@ -50,7 +50,7 @@ export declare class WalletClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/exchange-rate/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { GetECBExchangeRateApi, GetECBSupportedCurrenciesApi, GetFXExchangeRatesApi } from './api';
 /**
@@ -40,7 +40,7 @@ export declare class ExchangeRateClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/issuer-events/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { IssuerEventWebhooksApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class IssuerEventsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/oauth/axios.d.ts

@@ -1,10 +1,10 @@
 import { AxiosInstance } from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.
@@ -17,4 +17,4 @@ import { TokenManager } from './tokenManager';
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
-export declare function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance;
+export declare function createOAuthAxios(manager: OAuthClientCredentialsManager, instance?: AxiosInstance): AxiosInstance;

package/dist/oauth/axios.js

@@ -28,7 +28,7 @@ function stripBearer(header) {
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.

package/dist/oauth/clientCredentials.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from 'axios';
-import { TokenFetcher, TokenManager } from './tokenManager';
+import { TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
 /** Configuration for the OAuth2 `client_credentials` grant. */
 export interface OAuthConfig {
     tokenUrl: string;
@@ -14,11 +14,25 @@ export interface OAuthConfig {
     /** Axios instance used for the token request. Defaults to a fresh instance. */
     axiosInstance?: AxiosInstance;
 }
+/**
+ * The OAuth2 client-credentials identity — the client id/secret and requested scopes. It carries
+ * no URL: pair it with a token URL (e.g. derived from a `TenantEnvironment`) via the
+ * `clientCredentials(tokenUrl, credentials)` overload below.
+ */
+export interface ClientCredentials {
+    clientId: string;
+    /** May be omitted for a public client. */
+    clientSecret?: string;
+    /** Requested scopes; space-joined into a `scope` parameter. */
+    scopes?: string[];
+}
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
  * `expires_in`. Server-side only — never ship a client secret to a browser.
  */
 export declare function clientCredentialsFetcher(config: OAuthConfig): TokenFetcher;
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): TokenManager;
+/** Convenience: a caching {@link OAuthClientCredentialsManager} backed by the client-credentials grant. */
+export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): OAuthClientCredentialsManager;
+/** Convenience overload pairing a token URL with a {@link ClientCredentials} identity. */
+export declare function clientCredentials(tokenUrl: string, credentials: ClientCredentials, skewSeconds?: number): OAuthClientCredentialsManager;

package/dist/oauth/clientCredentials.js

@@ -57,7 +57,23 @@ function clientCredentialsFetcher(config) {
         return { accessToken: data.access_token, expiresInSeconds: (_b = data.expires_in) !== null && _b !== void 0 ? _b : 0 };
     });
 }
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-function clientCredentials(config, skewSeconds = 60) {
-    return new tokenManager_1.TokenManager(clientCredentialsFetcher(config), skewSeconds);
+function clientCredentials(configOrUrl, credsOrSkew, skewSeconds = 60) {
+    var _a;
+    let config;
+    let skew;
+    if (typeof configOrUrl === 'string') {
+        const creds = credsOrSkew;
+        config = {
+            tokenUrl: configOrUrl,
+            clientId: creds.clientId,
+            clientSecret: (_a = creds.clientSecret) !== null && _a !== void 0 ? _a : '',
+            scopes: creds.scopes,
+        };
+        skew = skewSeconds;
+    }
+    else {
+        config = configOrUrl;
+        skew = typeof credsOrSkew === 'number' ? credsOrSkew : 60;
+    }
+    return new tokenManager_1.OAuthClientCredentialsManager(clientCredentialsFetcher(config), skew);
 }

package/dist/oauth/index.d.ts

@@ -1,3 +1,3 @@
-export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
-export { OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
+export { ClientCredentials, OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/oauth/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCredentials = exports.TokenManager = void 0;
+exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCredentials = exports.OAuthClientCredentialsManager = void 0;
 /*
  * Enfuce nextgen SDK — OAuth token-management helper.
  *
@@ -26,7 +26,7 @@ exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCred
  * Server-side only — a client secret must never ship to a browser.
  */
 var tokenManager_1 = require("./tokenManager");
-Object.defineProperty(exports, "TokenManager", { enumerable: true, get: function () { return tokenManager_1.TokenManager; } });
+Object.defineProperty(exports, "OAuthClientCredentialsManager", { enumerable: true, get: function () { return tokenManager_1.OAuthClientCredentialsManager; } });
 var clientCredentials_1 = require("./clientCredentials");
 Object.defineProperty(exports, "clientCredentials", { enumerable: true, get: function () { return clientCredentials_1.clientCredentials; } });
 Object.defineProperty(exports, "clientCredentialsFetcher", { enumerable: true, get: function () { return clientCredentials_1.clientCredentialsFetcher; } });

package/dist/oauth/tokenManager.d.ts

@@ -11,14 +11,14 @@ export type TokenFetcher = () => Promise<AccessToken>;
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export declare class TokenManager {
+export declare class OAuthClientCredentialsManager {
     private readonly fetcher;
     private readonly skewSeconds;
     private readonly now;