@enfuce/nextgen-sdk 0.0.7 → 0.0.9

package/dist/issuer-events/api.js

@@ -12,23 +12,8 @@
  * https://openapi-generator.tech
  * Do not edit the class manually.
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IssuerEventWebhooksApi = exports.IssuerEventWebhooksApiFactory = exports.IssuerEventWebhooksApiFp = exports.IssuerEventWebhooksApiAxiosParamCreator = exports.TokenStatus = exports.TokenRequestor = exports.RiskScore = exports.PinStatus = exports.PinDeliveryType = exports.Locale = exports.CountryCodesAlpha3 = exports.CardholderResponseNationalityEnum = exports.CardholderEventNationalityEnum = exports.CardVersionStatus = exports.CardStatus = exports.CardScheme = exports.CardRole = exports.CardDeliveryType = exports.CardConfigurationType = exports.AuthorizationDecisionColor = void 0;
-const axios_1 = require("axios");
-// Some imports not used depending on template conditions
-// @ts-ignore
-const common_1 = require("./common");
-// @ts-ignore
-const base_1 = require("./base");
+exports.TokenStatus = exports.TokenRequestor = exports.RiskScore = exports.PinStatus = exports.PinDeliveryType = exports.Locale = exports.CountryCodesAlpha3 = exports.CardholderResponseNationalityEnum = exports.CardholderEventNationalityEnum = exports.CardVersionStatus = exports.CardStatus = exports.CardScheme = exports.CardRole = exports.CardDeliveryType = exports.CardConfigurationType = exports.AuthorizationDecisionColor = void 0;
 /**
  * The wallets common name for authorization decision.
  */
@@ -1181,233 +1166,3 @@ exports.TokenStatus = {
     Inactive: 'INACTIVE',
     Suspended: 'SUSPENDED',
 };
-/**
- * IssuerEventWebhooksApi - axios parameter creator
- */
-const IssuerEventWebhooksApiAxiosParamCreator = function (configuration) {
-    return {
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon card creation, update or closure.
-         * @summary Outgoing card event webhook endpoint
-         * @param {CardEvent} cardEvent Card event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardEvent: (cardEvent_1, ...args_1) => __awaiter(this, [cardEvent_1, ...args_1], void 0, function* (cardEvent, options = {}) {
-            // verify required parameter 'cardEvent' is not null or undefined
-            (0, common_1.assertParamExists)('cardEvent', 'cardEvent', cardEvent);
-            const localVarPath = `/card`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'POST' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(cardEvent, localVarRequestOptions, configuration);
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon cardholder creation or update.
-         * @summary Outgoing cardholder event webhook endpoint
-         * @param {CardholderEvent} cardholderEvent Cardholder event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardholderEvent: (cardholderEvent_1, ...args_1) => __awaiter(this, [cardholderEvent_1, ...args_1], void 0, function* (cardholderEvent, options = {}) {
-            // verify required parameter 'cardholderEvent' is not null or undefined
-            (0, common_1.assertParamExists)('cardholderEvent', 'cardholderEvent', cardholderEvent);
-            const localVarPath = `/cardholder`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'POST' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(cardholderEvent, localVarRequestOptions, configuration);
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon token creation or update.
-         * @summary Outgoing token event webhook endpoint
-         * @param {TokenEvent} tokenEvent Token event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        tokenEvent: (tokenEvent_1, ...args_1) => __awaiter(this, [tokenEvent_1, ...args_1], void 0, function* (tokenEvent, options = {}) {
-            // verify required parameter 'tokenEvent' is not null or undefined
-            (0, common_1.assertParamExists)('tokenEvent', 'tokenEvent', tokenEvent);
-            const localVarPath = `/token`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'POST' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(tokenEvent, localVarRequestOptions, configuration);
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-    };
-};
-exports.IssuerEventWebhooksApiAxiosParamCreator = IssuerEventWebhooksApiAxiosParamCreator;
-/**
- * IssuerEventWebhooksApi - functional programming interface
- */
-const IssuerEventWebhooksApiFp = function (configuration) {
-    const localVarAxiosParamCreator = (0, exports.IssuerEventWebhooksApiAxiosParamCreator)(configuration);
-    return {
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon card creation, update or closure.
-         * @summary Outgoing card event webhook endpoint
-         * @param {CardEvent} cardEvent Card event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardEvent(cardEvent, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.cardEvent(cardEvent, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['IssuerEventWebhooksApi.cardEvent']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon cardholder creation or update.
-         * @summary Outgoing cardholder event webhook endpoint
-         * @param {CardholderEvent} cardholderEvent Cardholder event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardholderEvent(cardholderEvent, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.cardholderEvent(cardholderEvent, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['IssuerEventWebhooksApi.cardholderEvent']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon token creation or update.
-         * @summary Outgoing token event webhook endpoint
-         * @param {TokenEvent} tokenEvent Token event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        tokenEvent(tokenEvent, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.tokenEvent(tokenEvent, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['IssuerEventWebhooksApi.tokenEvent']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
-    };
-};
-exports.IssuerEventWebhooksApiFp = IssuerEventWebhooksApiFp;
-/**
- * IssuerEventWebhooksApi - factory interface
- */
-const IssuerEventWebhooksApiFactory = function (configuration, basePath, axios) {
-    const localVarFp = (0, exports.IssuerEventWebhooksApiFp)(configuration);
-    return {
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon card creation, update or closure.
-         * @summary Outgoing card event webhook endpoint
-         * @param {CardEvent} cardEvent Card event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardEvent(cardEvent, options) {
-            return localVarFp.cardEvent(cardEvent, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon cardholder creation or update.
-         * @summary Outgoing cardholder event webhook endpoint
-         * @param {CardholderEvent} cardholderEvent Cardholder event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        cardholderEvent(cardholderEvent, options) {
-            return localVarFp.cardholderEvent(cardholderEvent, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon token creation or update.
-         * @summary Outgoing token event webhook endpoint
-         * @param {TokenEvent} tokenEvent Token event
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        tokenEvent(tokenEvent, options) {
-            return localVarFp.tokenEvent(tokenEvent, options).then((request) => request(axios, basePath));
-        },
-    };
-};
-exports.IssuerEventWebhooksApiFactory = IssuerEventWebhooksApiFactory;
-/**
- * IssuerEventWebhooksApi - object-oriented interface
- */
-class IssuerEventWebhooksApi extends base_1.BaseAPI {
-    /**
-     * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon card creation, update or closure.
-     * @summary Outgoing card event webhook endpoint
-     * @param {CardEvent} cardEvent Card event
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    cardEvent(cardEvent, options) {
-        return (0, exports.IssuerEventWebhooksApiFp)(this.configuration).cardEvent(cardEvent, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon cardholder creation or update.
-     * @summary Outgoing cardholder event webhook endpoint
-     * @param {CardholderEvent} cardholderEvent Cardholder event
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    cardholderEvent(cardholderEvent, options) {
-        return (0, exports.IssuerEventWebhooksApiFp)(this.configuration).cardholderEvent(cardholderEvent, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * This is not an endpoint. This is the description of a request that is sent to subscribed webhooks upon token creation or update.
-     * @summary Outgoing token event webhook endpoint
-     * @param {TokenEvent} tokenEvent Token event
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    tokenEvent(tokenEvent, options) {
-        return (0, exports.IssuerEventWebhooksApiFp)(this.configuration).tokenEvent(tokenEvent, options).then((request) => request(this.axios, this.basePath));
-    }
-}
-exports.IssuerEventWebhooksApi = IssuerEventWebhooksApi;

package/dist/issuer-events/index.d.ts

@@ -11,4 +11,3 @@
  */
 export * from "./api";
 export * from "./configuration";
-export * from './client';

package/dist/issuer-events/index.js

@@ -29,4 +29,3 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./api"), exports);
 __exportStar(require("./configuration"), exports);
-__exportStar(require("./client"), exports);

package/dist/oauth/axios.d.ts

@@ -1,10 +1,10 @@
 import { AxiosInstance } from 'axios';
-import { TokenManager } from './tokenManager';
+import { OAuthClientCredentialsManager } from './tokenManager';
 /**
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.
@@ -17,4 +17,4 @@ import { TokenManager } from './tokenManager';
  * const api = new card.CardApi(config, undefined, http);
  * ```
  */
-export declare function createOAuthAxios(manager: TokenManager, instance?: AxiosInstance): AxiosInstance;
+export declare function createOAuthAxios(manager: OAuthClientCredentialsManager, instance?: AxiosInstance): AxiosInstance;

package/dist/oauth/axios.js

@@ -28,7 +28,7 @@ function stripBearer(header) {
  * Returns an {@link AxiosInstance} with OAuth bearer-token handling built in:
  *
  * - **Proactive:** a request interceptor attaches a fresh bearer token (from the
- *   {@link TokenManager}) to *every* request. This authenticates API modules whose spec declares no
+ *   {@link OAuthClientCredentialsManager}) to *every* request. This authenticates API modules whose spec declares no
  *   security scheme (e.g. exchange-rate), so no `accessToken` on the `Configuration` is required.
  * - **Reactive:** a response interceptor, on a `401`, forces a token refresh and retries the request
  *   exactly once with the new bearer token.

package/dist/oauth/clientCredentials.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from 'axios';
-import { TokenFetcher, TokenManager } from './tokenManager';
+import { TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
 /** Configuration for the OAuth2 `client_credentials` grant. */
 export interface OAuthConfig {
     tokenUrl: string;
@@ -14,11 +14,39 @@ export interface OAuthConfig {
     /** Axios instance used for the token request. Defaults to a fresh instance. */
     axiosInstance?: AxiosInstance;
 }
+/**
+ * The OAuth2 client-credentials identity — the client id/secret and requested scopes. It carries
+ * no URL: pair it with a token URL (e.g. derived from a `TenantEnvironment`) via the
+ * `clientCredentials(tokenUrl, credentials)` overload below.
+ */
+export interface ClientCredentials {
+    clientId: string;
+    /** May be omitted for a public client. */
+    clientSecret?: string;
+    /** Requested scopes; space-joined into a `scope` parameter. */
+    scopes?: string[];
+}
 /**
  * Builds a {@link TokenFetcher} that performs the OAuth2 `client_credentials`
  * grant: a form-encoded POST to `config.tokenUrl`, parsing `access_token` and
  * `expires_in`. Server-side only — never ship a client secret to a browser.
  */
 export declare function clientCredentialsFetcher(config: OAuthConfig): TokenFetcher;
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): TokenManager;
+/** Convenience: a caching {@link OAuthClientCredentialsManager} backed by the client-credentials grant. */
+export declare function clientCredentials(config: OAuthConfig, skewSeconds?: number): OAuthClientCredentialsManager;
+/** Convenience overload pairing a token URL with a {@link ClientCredentials} identity. */
+export declare function clientCredentials(tokenUrl: string, credentials: ClientCredentials, skewSeconds?: number): OAuthClientCredentialsManager;
+/**
+ * Decodes the granted scopes from a JWT access token's `scope` (space-delimited) or `scp` (array)
+ * claim, sorted and de-duplicated. Returns an empty array for an empty, opaque (non-JWT), or
+ * undecodable token — never throws. Server-side only (uses Node's `Buffer`).
+ */
+export declare function scopesOf(accessToken: string): string[];
+/**
+ * Discovers the scopes the client is entitled to. Requests a `client_credentials` token with NO
+ * `scope` narrowing (any scopes on the config/credentials are ignored) — most authorization servers
+ * then grant the client's full default scope set — and returns the granted scopes decoded from the
+ * access token, sorted and de-duplicated. Performs a live token request; does not cache.
+ */
+export declare function availableScopes(config: OAuthConfig): Promise<string[]>;
+export declare function availableScopes(tokenUrl: string, credentials: ClientCredentials): Promise<string[]>;

package/dist/oauth/clientCredentials.js

@@ -11,6 +11,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.clientCredentialsFetcher = clientCredentialsFetcher;
 exports.clientCredentials = clientCredentials;
+exports.scopesOf = scopesOf;
+exports.availableScopes = availableScopes;
 /*
  * Enfuce nextgen SDK — OAuth token-management helper.
  *
@@ -57,7 +59,62 @@ function clientCredentialsFetcher(config) {
         return { accessToken: data.access_token, expiresInSeconds: (_b = data.expires_in) !== null && _b !== void 0 ? _b : 0 };
     });
 }
-/** Convenience: a caching {@link TokenManager} backed by the client-credentials grant. */
-function clientCredentials(config, skewSeconds = 60) {
-    return new tokenManager_1.TokenManager(clientCredentialsFetcher(config), skewSeconds);
+function clientCredentials(configOrUrl, credsOrSkew, skewSeconds = 60) {
+    var _a;
+    let config;
+    let skew;
+    if (typeof configOrUrl === 'string') {
+        const creds = credsOrSkew;
+        config = {
+            tokenUrl: configOrUrl,
+            clientId: creds.clientId,
+            clientSecret: (_a = creds.clientSecret) !== null && _a !== void 0 ? _a : '',
+            scopes: creds.scopes,
+        };
+        skew = skewSeconds;
+    }
+    else {
+        config = configOrUrl;
+        skew = typeof credsOrSkew === 'number' ? credsOrSkew : 60;
+    }
+    return new tokenManager_1.OAuthClientCredentialsManager(clientCredentialsFetcher(config), skew);
+}
+/**
+ * Decodes the granted scopes from a JWT access token's `scope` (space-delimited) or `scp` (array)
+ * claim, sorted and de-duplicated. Returns an empty array for an empty, opaque (non-JWT), or
+ * undecodable token — never throws. Server-side only (uses Node's `Buffer`).
+ */
+function scopesOf(accessToken) {
+    const parts = accessToken ? accessToken.split('.') : [];
+    if (parts.length < 2)
+        return [];
+    try {
+        const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/'); // base64url -> base64 ('base64' tolerates missing padding)
+        const payload = JSON.parse(Buffer.from(b64, 'base64').toString('utf8'));
+        const scopes = new Set();
+        if (typeof payload.scope === 'string') {
+            for (const s of payload.scope.trim().split(/\s+/))
+                if (s)
+                    scopes.add(s);
+        }
+        if (Array.isArray(payload.scp)) {
+            for (const s of payload.scp)
+                if (typeof s === 'string')
+                    scopes.add(s);
+        }
+        return [...scopes].sort();
+    }
+    catch (_a) {
+        return [];
+    }
+}
+function availableScopes(configOrUrl, credentials) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const config = typeof configOrUrl === 'string'
+            ? { tokenUrl: configOrUrl, clientId: credentials.clientId, clientSecret: (_a = credentials.clientSecret) !== null && _a !== void 0 ? _a : '' }
+            : configOrUrl;
+        const token = yield clientCredentialsFetcher(Object.assign(Object.assign({}, config), { scopes: [] }))();
+        return scopesOf(token.accessToken);
+    });
 }

package/dist/oauth/index.d.ts

@@ -1,3 +1,3 @@
-export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
-export { OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
+export { ClientCredentials, OAuthConfig, clientCredentials, clientCredentialsFetcher, availableScopes, scopesOf, } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/dist/oauth/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCredentials = exports.TokenManager = void 0;
+exports.createOAuthAxios = exports.scopesOf = exports.availableScopes = exports.clientCredentialsFetcher = exports.clientCredentials = exports.OAuthClientCredentialsManager = void 0;
 /*
  * Enfuce nextgen SDK — OAuth token-management helper.
  *
@@ -26,9 +26,11 @@ exports.createOAuthAxios = exports.clientCredentialsFetcher = exports.clientCred
  * Server-side only — a client secret must never ship to a browser.
  */
 var tokenManager_1 = require("./tokenManager");
-Object.defineProperty(exports, "TokenManager", { enumerable: true, get: function () { return tokenManager_1.TokenManager; } });
+Object.defineProperty(exports, "OAuthClientCredentialsManager", { enumerable: true, get: function () { return tokenManager_1.OAuthClientCredentialsManager; } });
 var clientCredentials_1 = require("./clientCredentials");
 Object.defineProperty(exports, "clientCredentials", { enumerable: true, get: function () { return clientCredentials_1.clientCredentials; } });
 Object.defineProperty(exports, "clientCredentialsFetcher", { enumerable: true, get: function () { return clientCredentials_1.clientCredentialsFetcher; } });
+Object.defineProperty(exports, "availableScopes", { enumerable: true, get: function () { return clientCredentials_1.availableScopes; } });
+Object.defineProperty(exports, "scopesOf", { enumerable: true, get: function () { return clientCredentials_1.scopesOf; } });
 var axios_1 = require("./axios");
 Object.defineProperty(exports, "createOAuthAxios", { enumerable: true, get: function () { return axios_1.createOAuthAxios; } });

package/dist/oauth/tokenManager.d.ts

@@ -11,14 +11,14 @@ export type TokenFetcher = () => Promise<AccessToken>;
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export declare class TokenManager {
+export declare class OAuthClientCredentialsManager {
     private readonly fetcher;
     private readonly skewSeconds;
     private readonly now;

package/dist/oauth/tokenManager.js

@@ -16,20 +16,20 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenManager = void 0;
+exports.OAuthClientCredentialsManager = void 0;
 /**
  * Caches an access token and refreshes it before expiry. Plug it into a generated
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-class TokenManager {
+class OAuthClientCredentialsManager {
     constructor(fetcher, skewSeconds = 60, now = Date.now) {
         this.fetcher = fetcher;
         this.skewSeconds = skewSeconds;
@@ -78,4 +78,4 @@ class TokenManager {
         return this.inflight;
     }
 }
-exports.TokenManager = TokenManager;
+exports.OAuthClientCredentialsManager = OAuthClientCredentialsManager;

package/dist/pin/api.d.ts

@@ -75,6 +75,22 @@ export interface SetPinRequestBody {
      */
     'zpkIndex'?: number;
 }
+export interface SetPinTzpkRequestBody {
+    /**
+     * Control ID that was returned in the [Request PIN Control Access Token Endpoint](https://nextgen-docs.enfuce.com/api/cards/post-card/create-pin-control-access-token).
+     */
+    'pinControlId': string;
+    /**
+     * RSA 2048 public key in PEM format (X.509 SubjectPublicKeyInfo). The key may contain:   - new lines,   - the PEM headers (\"-----BEGIN PUBLIC KEY-----\" and \"-----END PUBLIC KEY-----\") The key must not contain any spaces.
+     */
+    'pubKey': string;
+}
+export interface SetTzpkResponseBody {
+    /**
+     * Base64 encoded encrypted Terminal Zone PIN Key (TZPK), encrypted with the pubKey passed as input.
+     */
+    'tzpk': string;
+}
 export interface ViewPinRequestBody {
     /**
      * Control ID that was returned in the [Request PIN Control Access Token Endpoint](https://nextgen-docs.enfuce.com/api/cards/post-card/create-pin-control-access-token).
@@ -99,6 +115,15 @@ export interface ViewPinResponseBody {
  * PINOperationsUsingPKIApi - axios parameter creator
  */
 export declare const PINOperationsUsingPKIApiAxiosParamCreator: (configuration?: Configuration) => {
+    /**
+     * Send a request to this endpoint to generate a temporary Terminal Zone PIN Key (TZPK) for Set PIN or Change PIN flows. The TZPK is encrypted with the provided ephemeral RSA 2048 bit public key and returned as a base64 encoded value.
+     * @summary Generate Set/Change PIN TZPK
+     * @param {SetPinTzpkRequestBody} setPinTzpkRequestBody Request payload for generating a temporary PIN encryption key.
+     * @param {string} [xAuditUser] Optional audit user header
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setPinTzpk: (setPinTzpkRequestBody: SetPinTzpkRequestBody, xAuditUser?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption.
      * @summary Retrieve Encrypted PIN
@@ -113,6 +138,15 @@ export declare const PINOperationsUsingPKIApiAxiosParamCreator: (configuration?:
  * PINOperationsUsingPKIApi - functional programming interface
  */
 export declare const PINOperationsUsingPKIApiFp: (configuration?: Configuration) => {
+    /**
+     * Send a request to this endpoint to generate a temporary Terminal Zone PIN Key (TZPK) for Set PIN or Change PIN flows. The TZPK is encrypted with the provided ephemeral RSA 2048 bit public key and returned as a base64 encoded value.
+     * @summary Generate Set/Change PIN TZPK
+     * @param {SetPinTzpkRequestBody} setPinTzpkRequestBody Request payload for generating a temporary PIN encryption key.
+     * @param {string} [xAuditUser] Optional audit user header
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setPinTzpk(setPinTzpkRequestBody: SetPinTzpkRequestBody, xAuditUser?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<SetTzpkResponseBody>>;
     /**
      * Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption.
      * @summary Retrieve Encrypted PIN
@@ -127,6 +161,15 @@ export declare const PINOperationsUsingPKIApiFp: (configuration?: Configuration)
  * PINOperationsUsingPKIApi - factory interface
  */
 export declare const PINOperationsUsingPKIApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
+    /**
+     * Send a request to this endpoint to generate a temporary Terminal Zone PIN Key (TZPK) for Set PIN or Change PIN flows. The TZPK is encrypted with the provided ephemeral RSA 2048 bit public key and returned as a base64 encoded value.
+     * @summary Generate Set/Change PIN TZPK
+     * @param {SetPinTzpkRequestBody} setPinTzpkRequestBody Request payload for generating a temporary PIN encryption key.
+     * @param {string} [xAuditUser] Optional audit user header
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setPinTzpk(setPinTzpkRequestBody: SetPinTzpkRequestBody, xAuditUser?: string, options?: RawAxiosRequestConfig): AxiosPromise<SetTzpkResponseBody>;
     /**
      * Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption.
      * @summary Retrieve Encrypted PIN
@@ -141,6 +184,15 @@ export declare const PINOperationsUsingPKIApiFactory: (configuration?: Configura
  * PINOperationsUsingPKIApi - object-oriented interface
  */
 export declare class PINOperationsUsingPKIApi extends BaseAPI {
+    /**
+     * Send a request to this endpoint to generate a temporary Terminal Zone PIN Key (TZPK) for Set PIN or Change PIN flows. The TZPK is encrypted with the provided ephemeral RSA 2048 bit public key and returned as a base64 encoded value.
+     * @summary Generate Set/Change PIN TZPK
+     * @param {SetPinTzpkRequestBody} setPinTzpkRequestBody Request payload for generating a temporary PIN encryption key.
+     * @param {string} [xAuditUser] Optional audit user header
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    setPinTzpk(setPinTzpkRequestBody: SetPinTzpkRequestBody, xAuditUser?: string, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<SetTzpkResponseBody, any, {}>>;
     /**
      * Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption.
      * @summary Retrieve Encrypted PIN