@enfuce/nextgen-sdk 0.0.7 → 0.0.8

package/dist/oauth/tokenManager.js

@@ -16,20 +16,20 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenManager = void 0;
+exports.OAuthClientCredentialsManager = void 0;
 /**
  * Caches an access token and refreshes it before expiry. Plug it into a generated
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-class TokenManager {
+class OAuthClientCredentialsManager {
     constructor(fetcher, skewSeconds = 60, now = Date.now) {
         this.fetcher = fetcher;
         this.skewSeconds = skewSeconds;
@@ -78,4 +78,4 @@ class TokenManager {
         return this.inflight;
     }
 }
-exports.TokenManager = TokenManager;
+exports.OAuthClientCredentialsManager = OAuthClientCredentialsManager;

package/dist/pin/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { PINOperationsUsingPKIApi, PINOperationsWithPreSharedKeyApi } from './api';
 /**
@@ -38,7 +38,7 @@ export declare class PinClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/threeds/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { ThreeDSApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class ThreedsClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/threeds-oob/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { OOBAuthenticationChallengeWebhookNotificationApi } from './api';
 /**
@@ -36,7 +36,7 @@ export declare class ThreedsOobClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/dist/wallet/client.d.ts

@@ -1,5 +1,5 @@
 import { type AxiosInstance } from 'axios';
-import { type TokenManager } from '../oauth';
+import { type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import { ActivateTokenApi, DeactivateTokenApi, EligibleTokenRequestorsApi, GetTokensApi, PushCardsApi, PushProvisionApi, SuspendTokenApi, UnsuspendTokenApi } from './api';
 /**
@@ -50,7 +50,7 @@ export declare class WalletClientBuilder {
     /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
     baseUrl(baseUrl: string): this;
     /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-    oauth(tokens: TokenManager): this;
+    oauth(tokens: OAuthClientCredentialsManager): this;
     /**
      * Customize the underlying axios instance — set a timeout (`http.defaults.timeout = ...`), a proxy,
      * default headers, extra interceptors, etc. Runs after OAuth is installed. Composable: multiple

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enfuce/nextgen-sdk",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "description": "Enfuce nextgen client SDK (TypeScript). One namespaced export per API.",
   "publishConfig": {
     "access": "public"

package/src/authorisation-control/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   AuthorisationRequestAPIApi,
@@ -50,7 +50,7 @@ export class AuthorisationControlClient {
 export class AuthorisationControlClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class AuthorisationControlClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/card/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   CreateCardApi,
@@ -80,7 +80,7 @@ export class CardClient {
 export class CardClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -90,7 +90,7 @@ export class CardClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/cardholder/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   CreateCardholderApi,
@@ -68,7 +68,7 @@ export class CardholderClient {
 export class CardholderClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -78,7 +78,7 @@ export class CardholderClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/cards/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   CardsApi,
@@ -50,7 +50,7 @@ export class CardsClient {
 export class CardsClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class CardsClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/exchange-rate/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   GetECBExchangeRateApi,
@@ -62,7 +62,7 @@ export class ExchangeRateClient {
 export class ExchangeRateClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -72,7 +72,7 @@ export class ExchangeRateClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/issuer-events/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   IssuerEventWebhooksApi,
@@ -50,7 +50,7 @@ export class IssuerEventsClient {
 export class IssuerEventsClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class IssuerEventsClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/oauth/axios.ts

@@ -6,7 +6,7 @@
  * OpenAPI Generator to (re)produce it.
  */
 import axios, { AxiosError, AxiosInstance, InternalAxiosRequestConfig } from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 
 const BEARER_PREFIX = 'Bearer ';
 
@@ -22,7 +22,7 @@ function stripBearer(header: string): string {
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.
@@ -35,7 +35,7 @@ function stripBearer(header: string): string {
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
-export function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance {
+export function createOAuthAxios(manager: OAuthClientCredentialsManager, instance?: AxiosInstance): AxiosInstance {
     const http = instance ?? axios.create();
 
     // Proactive: attach a fresh bearer token to every outgoing request.

package/src/oauth/clientCredentials.ts

@@ -6,7 +6,7 @@
  * OpenAPI Generator to (re)produce it.
  */
 import axios, { AxiosInstance, AxiosRequestConfig } from 'axios';
-import { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
+import { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
 
 /** Configuration for the OAuth2 `client_credentials` grant. */
 export interface OAuthConfig {
@@ -23,6 +23,19 @@ export interface OAuthConfig {
     axiosInstance?: AxiosInstance;
 }
 
+/**
+ * The OAuth2 client-credentials identity — the client id/secret and requested scopes. It carries
+ * no URL: pair it with a token URL (e.g. derived from a `TenantEnvironment`) via the
+ * `clientCredentials(tokenUrl, credentials)` overload below.
+ */
+export interface ClientCredentials {
+    clientId: string;
+    /** May be omitted for a public client. */
+    clientSecret?: string;
+    /** Requested scopes; space-joined into a `scope` parameter. */
+    scopes?: string[];
+}
+
 interface TokenResponse {
     access_token?: string;
     expires_in?: number;
@@ -66,7 +79,33 @@ export function clientCredentialsFetcher(config: OAuthConfig): TokenFetcher {
     };
 }
 
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export function clientCredentials(config: OAuthConfig, skewSeconds: number = 60): TokenManager {
-    return new TokenManager(clientCredentialsFetcher(config), skewSeconds);
+/** Convenience: a caching {@link OAuthClientCredentialsManager} backed by the client-credentials grant. */
+export function clientCredentials(config: OAuthConfig, skewSeconds?: number): OAuthClientCredentialsManager;
+/** Convenience overload pairing a token URL with a {@link ClientCredentials} identity. */
+export function clientCredentials(
+    tokenUrl: string,
+    credentials: ClientCredentials,
+    skewSeconds?: number,
+): OAuthClientCredentialsManager;
+export function clientCredentials(
+    configOrUrl: OAuthConfig | string,
+    credsOrSkew?: ClientCredentials | number,
+    skewSeconds = 60,
+): OAuthClientCredentialsManager {
+    let config: OAuthConfig;
+    let skew: number;
+    if (typeof configOrUrl === 'string') {
+        const creds = credsOrSkew as ClientCredentials;
+        config = {
+            tokenUrl: configOrUrl,
+            clientId: creds.clientId,
+            clientSecret: creds.clientSecret ?? '',
+            scopes: creds.scopes,
+        };
+        skew = skewSeconds;
+    } else {
+        config = configOrUrl;
+        skew = typeof credsOrSkew === 'number' ? credsOrSkew : 60;
+    }
+    return new OAuthClientCredentialsManager(clientCredentialsFetcher(config), skew);
 }

package/src/oauth/index.ts

@@ -22,6 +22,6 @@
  *
  * Server-side only — a client secret must never ship to a browser.
  */
-export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
-export { OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
+export { ClientCredentials, OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/src/oauth/tokenManager.ts

@@ -21,14 +21,14 @@ export type TokenFetcher = () => Promise<AccessToken>;
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export class TokenManager {
+export class OAuthClientCredentialsManager {
     private token?: string;
     private expiresAtMs?: number;
     private inflight?: Promise<string>;

package/src/pin/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   PINOperationsUsingPKIApi,
@@ -56,7 +56,7 @@ export class PinClient {
 export class PinClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -66,7 +66,7 @@ export class PinClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/threeds/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   ThreeDSApi,
@@ -50,7 +50,7 @@ export class ThreedsClient {
 export class ThreedsClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class ThreedsClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/threeds-oob/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   OOBAuthenticationChallengeWebhookNotificationApi,
@@ -50,7 +50,7 @@ export class ThreedsOobClient {
 export class ThreedsOobClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class ThreedsOobClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/wallet/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   ActivateTokenApi,
@@ -92,7 +92,7 @@ export class WalletClient {
 export class WalletClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -102,7 +102,7 @@ export class WalletClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/test/clientCredentials.test.ts

@@ -0,0 +1,20 @@
+/** Tests for the ClientCredentials identity object and the clientCredentials overloads. */
+import { describe, expect, it } from 'vitest';
+import { oauth } from '../src';
+
+describe('ClientCredentials pairing', () => {
+  it('clientCredentials(tokenUrl, credentials) builds an OAuthClientCredentialsManager', () => {
+    const creds: oauth.ClientCredentials = { clientId: 'id', clientSecret: 'secret', scopes: ['s.read'] };
+    const mgr = oauth.clientCredentials('https://auth.example.com/oauth2/token', creds);
+    expect(mgr).toBeInstanceOf(oauth.OAuthClientCredentialsManager);
+  });
+
+  it('still accepts a full OAuthConfig', () => {
+    const mgr = oauth.clientCredentials({
+      tokenUrl: 'https://auth.example.com/oauth2/token',
+      clientId: 'id',
+      clientSecret: 'secret',
+    });
+    expect(mgr).toBeInstanceOf(oauth.OAuthClientCredentialsManager);
+  });
+});

package/test/oauth.test.ts

@@ -1,7 +1,7 @@
 /**
  * Tests for the hand-written OAuth token-management helper (src/oauth).
  *
- * Covers the TokenManager cache/refresh/single-flight logic, the client-credentials
+ * Covers the OAuthClientCredentialsManager cache/refresh/single-flight logic, the client-credentials
  * fetcher and the reactive 401-retry axios instance, using capturing axios adapters
  * so nothing hits the network.
  */
@@ -9,7 +9,7 @@ import axios, { type AxiosAdapter, type InternalAxiosRequestConfig } from 'axios
 import { describe, expect, it } from 'vitest';
 import { oauth } from '../src';
 
-const { TokenManager, clientCredentialsFetcher, clientCredentials, createOAuthAxios } = oauth;
+const { OAuthClientCredentialsManager, clientCredentialsFetcher, clientCredentials, createOAuthAxios } = oauth;
 
 function makeClock(start = 1000) {
   const state = { t: start };
@@ -25,11 +25,11 @@ function countingFetcher(expiresInSeconds = 300) {
   return { fetch, calls };
 }
 
-describe('TokenManager', () => {
+describe('OAuthClientCredentialsManager', () => {
   it('caches the token within its validity window', async () => {
     const { fetch, calls } = countingFetcher();
     const clock = makeClock();
-    const mgr = new TokenManager(fetch, 60, clock.now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, clock.now);
 
     expect(await mgr.getToken()).toBe('token-1');
     expect(await mgr.getToken()).toBe('token-1');
@@ -39,7 +39,7 @@ describe('TokenManager', () => {
   it('refreshes once past expiry minus skew', async () => {
     const { fetch, calls } = countingFetcher(300);
     const clock = makeClock();
-    const mgr = new TokenManager(fetch, 60, clock.now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, clock.now);
 
     expect(await mgr.getToken()).toBe('token-1');
     clock.advance(239_000);
@@ -53,7 +53,7 @@ describe('TokenManager', () => {
 
   it('refetches every call when lifetime is unknown', async () => {
     const { fetch, calls } = countingFetcher(0);
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
     await mgr.getToken();
     await mgr.getToken();
     expect(calls.n).toBe(2);
@@ -61,7 +61,7 @@ describe('TokenManager', () => {
 
   it('shares a single in-flight fetch across concurrent callers', async () => {
     const { fetch, calls } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
 
     const results = await Promise.all([mgr.getToken(), mgr.getToken(), mgr.getToken()]);
 
@@ -71,7 +71,7 @@ describe('TokenManager', () => {
 
   it('forceRefresh is a no-op when the cached token already moved on', async () => {
     const { fetch, calls } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
 
     expect(await mgr.getToken()).toBe('token-1');
     expect(await mgr.forceRefresh('an-older-token')).toBe('token-1');
@@ -129,7 +129,7 @@ describe('clientCredentialsFetcher', () => {
     expect(captured.config?.auth).toBeUndefined();
   });
 
-  it('clientCredentials returns a caching TokenManager', async () => {
+  it('clientCredentials returns a caching OAuthClientCredentialsManager', async () => {
     const { instance } = capturingAxios({ access_token: 'abc', expires_in: 120 });
     const mgr = clientCredentials(
       { tokenUrl: 'https://auth.example.com/oauth/token', clientId: 'id', clientSecret: 's', axiosInstance: instance },
@@ -141,7 +141,7 @@ describe('clientCredentialsFetcher', () => {
 describe('createOAuthAxios', () => {
   it('proactively attaches a bearer token to a request that has no Authorization header', async () => {
     const { fetch, calls } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
 
     const seenAuth: (string | undefined)[] = [];
     const adapter: AxiosAdapter = async (config) => {
@@ -160,7 +160,7 @@ describe('createOAuthAxios', () => {
 
   it('retries the request with a refreshed token when the first call rejects with 401', async () => {
     const { fetch } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
     await mgr.getToken(); // seed token-1
 
     const seenAuth: (string | undefined)[] = [];
@@ -196,7 +196,7 @@ describe('createOAuthAxios', () => {
 
   it('surfaces the error after a single retry (no infinite loop)', async () => {
     const { fetch } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
     await mgr.getToken();
 
     let calls = 0;