@enfuce/nextgen-sdk 0.0.7 → 0.0.9

package/dist/esm/issuer-events/api.js

@@ -11,21 +11,6 @@
  * https://openapi-generator.tech
  * Do not edit the class manually.
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import globalAxios from 'axios';
-// Some imports not used depending on template conditions
-// @ts-ignore
-import { DUMMY_BASE_URL, assertParamExists, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction } from './common';
-// @ts-ignore
-import { BASE_PATH, BaseAPI, operationServerMap } from './base';
 /**
  * The wallets common name for authorization decision.
  */
@@ -1178,229 +1163,3 @@ export const TokenStatus = {
     Inactive: 'INACTIVE',
     Suspended: 'SUSPENDED',
 };
-/**
- * IssuerEventWebhooksApi - axios parameter creator
- */
-export const IssuerEventWebhooksApiAxiosParamCreator = function (configuration) {
-    return {
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon card creation, update or closure.
-         * @summary Outgoing card event webhook endpoint
-         * @param {CardEvent} cardEvent Card event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardEvent: (cardEvent_1, ...args_1) => __awaiter(this, [cardEvent_1, ...args_1], void 0, function* (cardEvent, options = {}) {
-            // verify required parameter 'cardEvent' is not null or undefined
-            assertParamExists('cardEvent', 'cardEvent', cardEvent);
-            const localVarPath = `/card`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'POST' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            localVarRequestOptions.data = serializeDataIfNeeded(cardEvent, localVarRequestOptions, configuration);
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon cardholder creation or update.
-         * @summary Outgoing cardholder event webhook endpoint
-         * @param {CardholderEvent} cardholderEvent Cardholder event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardholderEvent: (cardholderEvent_1, ...args_1) => __awaiter(this, [cardholderEvent_1, ...args_1], void 0, function* (cardholderEvent, options = {}) {
-            // verify required parameter 'cardholderEvent' is not null or undefined
-            assertParamExists('cardholderEvent', 'cardholderEvent', cardholderEvent);
-            const localVarPath = `/cardholder`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'POST' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            localVarRequestOptions.data = serializeDataIfNeeded(cardholderEvent, localVarRequestOptions, configuration);
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon token creation or update.
-         * @summary Outgoing token event webhook endpoint
-         * @param {TokenEvent} tokenEvent Token event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        tokenEvent: (tokenEvent_1, ...args_1) => __awaiter(this, [tokenEvent_1, ...args_1], void 0, function* (tokenEvent, options = {}) {
-            // verify required parameter 'tokenEvent' is not null or undefined
-            assertParamExists('tokenEvent', 'tokenEvent', tokenEvent);
-            const localVarPath = `/token`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'POST' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            localVarRequestOptions.data = serializeDataIfNeeded(tokenEvent, localVarRequestOptions, configuration);
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-    };
-};
-/**
- * IssuerEventWebhooksApi - functional programming interface
- */
-export const IssuerEventWebhooksApiFp = function (configuration) {
-    const localVarAxiosParamCreator = IssuerEventWebhooksApiAxiosParamCreator(configuration);
-    return {
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon card creation, update or closure.
-         * @summary Outgoing card event webhook endpoint
-         * @param {CardEvent} cardEvent Card event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardEvent(cardEvent, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.cardEvent(cardEvent, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = operationServerMap['IssuerEventWebhooksApi.cardEvent']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon cardholder creation or update.
-         * @summary Outgoing cardholder event webhook endpoint
-         * @param {CardholderEvent} cardholderEvent Cardholder event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardholderEvent(cardholderEvent, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.cardholderEvent(cardholderEvent, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = operationServerMap['IssuerEventWebhooksApi.cardholderEvent']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon token creation or update.
-         * @summary Outgoing token event webhook endpoint
-         * @param {TokenEvent} tokenEvent Token event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        tokenEvent(tokenEvent, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.tokenEvent(tokenEvent, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = operationServerMap['IssuerEventWebhooksApi.tokenEvent']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
-    };
-};
-/**
- * IssuerEventWebhooksApi - factory interface
- */
-export const IssuerEventWebhooksApiFactory = function (configuration, basePath, axios) {
-    const localVarFp = IssuerEventWebhooksApiFp(configuration);
-    return {
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon card creation, update or closure.
-         * @summary Outgoing card event webhook endpoint
-         * @param {CardEvent} cardEvent Card event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardEvent(cardEvent, options) {
-            return localVarFp.cardEvent(cardEvent, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon cardholder creation or update.
-         * @summary Outgoing cardholder event webhook endpoint
-         * @param {CardholderEvent} cardholderEvent Cardholder event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardholderEvent(cardholderEvent, options) {
-            return localVarFp.cardholderEvent(cardholderEvent, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon token creation or update.
-         * @summary Outgoing token event webhook endpoint
-         * @param {TokenEvent} tokenEvent Token event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        tokenEvent(tokenEvent, options) {
-            return localVarFp.tokenEvent(tokenEvent, options).then((request) => request(axios, basePath));
-        },
-    };
-};
-/**
- * IssuerEventWebhooksApi - object-oriented interface
- */
-export class IssuerEventWebhooksApi extends BaseAPI {
-    /**
-     * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon card creation, update or closure.
-     * @summary Outgoing card event webhook endpoint
-     * @param {CardEvent} cardEvent Card event
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    cardEvent(cardEvent, options) {
-        return IssuerEventWebhooksApiFp(this.configuration).cardEvent(cardEvent, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon cardholder creation or update.
-     * @summary Outgoing cardholder event webhook endpoint
-     * @param {CardholderEvent} cardholderEvent Cardholder event
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    cardholderEvent(cardholderEvent, options) {
-        return IssuerEventWebhooksApiFp(this.configuration).cardholderEvent(cardholderEvent, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon token creation or update.
-     * @summary Outgoing token event webhook endpoint
-     * @param {TokenEvent} tokenEvent Token event
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    tokenEvent(tokenEvent, options) {
-        return IssuerEventWebhooksApiFp(this.configuration).tokenEvent(tokenEvent, options).then((request) => request(this.axios, this.basePath));
-    }
-}

package/dist/esm/issuer-events/index.d.ts

@@ -11,4 +11,3 @@
  */
 export * from "./api";
 export * from "./configuration";
-export * from './client';

package/dist/esm/issuer-events/index.js

@@ -13,4 +13,3 @@
  */
 export * from "./api";
 export * from "./configuration";
-export * from './client';

package/dist/esm/oauth/axios.d.ts

@@ -1,10 +1,10 @@
 import { AxiosInstance } from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.
@@ -17,4 +17,4 @@ import { TokenManager } from './tokenManager';
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
-export declare function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance;
+export declare function createOAuthAxios(manager: OAuthClientCredentialsManager, instance?: AxiosInstance): AxiosInstance;

package/dist/esm/oauth/axios.js

@@ -25,7 +25,7 @@ function stripBearer(header) {
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.

package/dist/esm/oauth/clientCredentials.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from 'axios';
-import { TokenFetcher, TokenManager } from './tokenManager';
+import { TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
 /** Configuration for the OAuth2 `client_credentials` grant. */
 export interface OAuthConfig {
     tokenUrl: string;
@@ -14,11 +14,39 @@ export interface OAuthConfig {
     /** Axios instance used for the token request. Defaults to a fresh instance. */
     axiosInstance?: AxiosInstance;
 }
+/**
+ * The OAuth2 client-credentials identity — the client id/secret and requested scopes. It carries
+ * no URL: pair it with a token URL (e.g. derived from a `TenantEnvironment`) via the
+ * `clientCredentials(tokenUrl, credentials)` overload below.
+ */
+export interface ClientCredentials {
+    clientId: string;
+    /** May be omitted for a public client. */
+    clientSecret?: string;
+    /** Requested scopes; space-joined into a `scope` parameter. */
+    scopes?: string[];
+}
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
  * `expires_in`. Server-side only — never ship a client secret to a browser.
  */
 export declare function clientCredentialsFetcher(config: OAuthConfig): TokenFetcher;
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): TokenManager;
+/** Convenience: a caching {@link OAuthClientCredentialsManager} backed by the client-credentials grant. */
+export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): OAuthClientCredentialsManager;
+/** Convenience overload pairing a token URL with a {@link ClientCredentials} identity. */
+export declare function clientCredentials(tokenUrl: string, credentials: ClientCredentials, skewSeconds?: number): OAuthClientCredentialsManager;
+/**
+ * Decodes the granted scopes from a JWT access token's `scope` (space-delimited) or `scp` (array)
+ * claim, sorted and de-duplicated. Returns an empty array for an empty, opaque (non-JWT), or
+ * undecodable token — never throws. Server-side only (uses Node's `Buffer`).
+ */
+export declare function scopesOf(accessToken: string): string[];
+/**
+ * Discovers the scopes the client is entitled to. Requests a `client_credentials` token with NO
+ * `scope` narrowing (any scopes on the config/credentials are ignored) — most authorization servers
+ * then grant the client's full default scope set — and returns the granted scopes decoded from the
+ * access token, sorted and de-duplicated. Performs a live token request; does not cache.
+ */
+export declare function availableScopes(config: OAuthConfig): Promise<string[]>;
+export declare function availableScopes(tokenUrl: string, credentials: ClientCredentials): Promise<string[]>;

package/dist/esm/oauth/clientCredentials.js

@@ -15,7 +15,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
  * OpenAPI Generator to (re)produce it.
  */
 import axios from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
@@ -53,7 +53,62 @@ export function clientCredentialsFetcher(config) {
         return { accessToken: data.access_token, expiresInSeconds: (_b = data.expires_in) !== null && _b !== void 0 ? _b : 0 };
     });
 }
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export function clientCredentials(config, skewSeconds = 60) {
-    return new TokenManager(clientCredentialsFetcher(config), skewSeconds);
+export function clientCredentials(configOrUrl, credsOrSkew, skewSeconds = 60) {
+    var _a;
+    let config;
+    let skew;
+    if (typeof configOrUrl === 'string') {
+        const creds = credsOrSkew;
+        config = {
+            tokenUrl: configOrUrl,
+            clientId: creds.clientId,
+            clientSecret: (_a = creds.clientSecret) !== null && _a !== void 0 ? _a : '',
+            scopes: creds.scopes,
+        };
+        skew = skewSeconds;
+    }
+    else {
+        config = configOrUrl;
+        skew = typeof credsOrSkew === 'number' ? credsOrSkew : 60;
+    }
+    return new OAuthClientCredentialsManager(clientCredentialsFetcher(config), skew);
+}
+/**
+ * Decodes the granted scopes from a JWT access token's `scope` (space-delimited) or `scp` (array)
+ * claim, sorted and de-duplicated. Returns an empty array for an empty, opaque (non-JWT), or
+ * undecodable token — never throws. Server-side only (uses Node's `Buffer`).
+ */
+export function scopesOf(accessToken) {
+    const parts = accessToken ? accessToken.split('.') : [];
+    if (parts.length < 2)
+        return [];
+    try {
+        const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/'); // base64url -> base64 ('base64' tolerates missing padding)
+        const payload = JSON.parse(Buffer.from(b64, 'base64').toString('utf8'));
+        const scopes = new Set();
+        if (typeof payload.scope === 'string') {
+            for (const s of payload.scope.trim().split(/\s+/))
+                if (s)
+                    scopes.add(s);
+        }
+        if (Array.isArray(payload.scp)) {
+            for (const s of payload.scp)
+                if (typeof s === 'string')
+                    scopes.add(s);
+        }
+        return [...scopes].sort();
+    }
+    catch (_a) {
+        return [];
+    }
+}
+export function availableScopes(configOrUrl, credentials) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const config = typeof configOrUrl === 'string'
+            ? { tokenUrl: configOrUrl, clientId: credentials.clientId, clientSecret: (_a = credentials.clientSecret) !== null && _a !== void 0 ? _a : '' }
+            : configOrUrl;
+        const token = yield clientCredentialsFetcher(Object.assign(Object.assign({}, config), { scopes: [] }))();
+        return scopesOf(token.accessToken);
+    });
 }

package/dist/esm/oauth/index.d.ts

@@ -1,3 +1,3 @@
-export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
-export { OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
+export { ClientCredentials, OAuthConfig, clientCredentials, clientCredentialsFetcher, availableScopes, scopesOf, } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/esm/oauth/index.js

@@ -22,6 +22,6 @@
  *
  * Server-side only — a client secret must never ship to a browser.
  */
-export { TokenManager } from './tokenManager';
-export { clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { OAuthClientCredentialsManager } from './tokenManager';
+export { clientCredentials, clientCredentialsFetcher, availableScopes, scopesOf, } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/esm/oauth/tokenManager.d.ts

@@ -11,14 +11,14 @@ export type TokenFetcher = () => Promise<AccessToken>;
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export declare class TokenManager {
+export declare class OAuthClientCredentialsManager {
     private readonly fetcher;
     private readonly skewSeconds;
     private readonly now;

package/dist/esm/oauth/tokenManager.js

@@ -19,14 +19,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export class TokenManager {
+export class OAuthClientCredentialsManager {
     constructor(fetcher, skewSeconds = 60, now = Date.now) {
         this.fetcher = fetcher;
         this.skewSeconds = skewSeconds;

package/dist/esm/pin/api.d.ts

@@ -75,6 +75,22 @@ export interface SetPinRequestBody {
      */
     'zpkIndex'?: number;
 }
+export interface SetPinTzpkRequestBody {
+    /**
+     * Control ID that was returned in the [Request PIN Control Access Token Endpoint](https://nextgen-docs.enfuce.com/api/cards/post-card/create-pin-control-access-token).
+     */
+    'pinControlId': string;
+    /**
+     * RSA 2048 public key in PEM format (X.509 SubjectPublicKeyInfo). The key may contain:   - new lines,   - the PEM headers (\"-----BEGIN PUBLIC KEY-----\" and \"-----END PUBLIC KEY-----\") The key must not contain any spaces.
+     */
+    'pubKey': string;
+}
+export interface SetTzpkResponseBody {
+    /**
+     * Base64 encoded encrypted Terminal Zone PIN Key (TZPK), encrypted with the pubKey passed as input.
+     */
+    'tzpk': string;
+}
 export interface ViewPinRequestBody {
     /**
      * Control ID that was returned in the [Request PIN Control Access Token Endpoint](https://nextgen-docs.enfuce.com/api/cards/post-card/create-pin-control-access-token).
@@ -99,6 +115,15 @@ export interface ViewPinResponseBody {
  * PINOperationsUsingPKIApi - axios parameter creator
  */
 export declare const PINOperationsUsingPKIApiAxiosParamCreator: (configuration?: Configuration) => {
+    /**
+     * Send a request to this endpoint to generate a temporary Terminal Zone PIN Key (TZPK) for Set PIN or Change PIN flows. The TZPK is encrypted with the provided ephemeral RSA 2048 bit public key and returned as a base64 encoded value.
+     * @summary Generate Set/Change PIN TZPK
+     * @param {SetPinTzpkRequestBody} setPinTzpkRequestBody Request payload for generating a temporary PIN encryption key.
+     * @param {string} [xAuditUser] Optional audit user header
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setPinTzpk: (setPinTzpkRequestBody: SetPinTzpkRequestBody, xAuditUser?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption.
      * @summary Retrieve Encrypted PIN
@@ -113,6 +138,15 @@ export declare const PINOperationsUsingPKIApiAxiosParamCreator: (configuration?:
  * PINOperationsUsingPKIApi - functional programming interface
  */
 export declare const PINOperationsUsingPKIApiFp: (configuration?: Configuration) => {
+    /**
+     * Send a request to this endpoint to generate a temporary Terminal Zone PIN Key (TZPK) for Set PIN or Change PIN flows. The TZPK is encrypted with the provided ephemeral RSA 2048 bit public key and returned as a base64 encoded value.
+     * @summary Generate Set/Change PIN TZPK
+     * @param {SetPinTzpkRequestBody} setPinTzpkRequestBody Request payload for generating a temporary PIN encryption key.
+     * @param {string} [xAuditUser] Optional audit user header
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setPinTzpk(setPinTzpkRequestBody: SetPinTzpkRequestBody, xAuditUser?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<SetTzpkResponseBody>>;
     /**
      * Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption.
      * @summary Retrieve Encrypted PIN
@@ -127,6 +161,15 @@ export declare const PINOperationsUsingPKIApiFp: (configuration?: Configuration)
  * PINOperationsUsingPKIApi - factory interface
  */
 export declare const PINOperationsUsingPKIApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
+    /**
+     * Send a request to this endpoint to generate a temporary Terminal Zone PIN Key (TZPK) for Set PIN or Change PIN flows. The TZPK is encrypted with the provided ephemeral RSA 2048 bit public key and returned as a base64 encoded value.
+     * @summary Generate Set/Change PIN TZPK
+     * @param {SetPinTzpkRequestBody} setPinTzpkRequestBody Request payload for generating a temporary PIN encryption key.
+     * @param {string} [xAuditUser] Optional audit user header
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setPinTzpk(setPinTzpkRequestBody: SetPinTzpkRequestBody, xAuditUser?: string, options?: RawAxiosRequestConfig): AxiosPromise<SetTzpkResponseBody>;
     /**
      * Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption.
      * @summary Retrieve Encrypted PIN
@@ -141,6 +184,15 @@ export declare const PINOperationsUsingPKIApiFactory: (configuration?: Configura
  * PINOperationsUsingPKIApi - object-oriented interface
  */
 export declare class PINOperationsUsingPKIApi extends BaseAPI {
+    /**
+     * Send a request to this endpoint to generate a temporary Terminal Zone PIN Key (TZPK) for Set PIN or Change PIN flows. The TZPK is encrypted with the provided ephemeral RSA 2048 bit public key and returned as a base64 encoded value.
+     * @summary Generate Set/Change PIN TZPK
+     * @param {SetPinTzpkRequestBody} setPinTzpkRequestBody Request payload for generating a temporary PIN encryption key.
+     * @param {string} [xAuditUser] Optional audit user header
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setPinTzpk(setPinTzpkRequestBody: SetPinTzpkRequestBody, xAuditUser?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<SetTzpkResponseBody, any, {}>>;
     /**
      * Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption.
      * @summary Retrieve Encrypted PIN