[mzanoni]

https://trello.com/c/RyptoX8f/22757-js-sdk-add-support-for-oauth

Scope

• Add OAuth 2.0 client-credentials authentication to the shared @relewise/client base client.
• Add token acquisition, caching, early renewal, concurrent acquisition sharing, and one retry for an invalid_token challenge.
• Add OAuth constructor overloads to Tracker, Searcher, and Recommender while preserving the existing API-key signatures.
• Add unit coverage, a live OAuth integration test, and usage documentation.
• No new runtime dependencies.

Integrations support is split into the stacked PR #232.

Risk

• Authentication and request dispatch in the shared base client.
• Existing API-key behavior and constructor compatibility are covered by unit tests.

Validation

• packages/client: npm run build
• packages/client: npm run build:types
• packages/client: npm test
• GitHub Actions: test-sdk

The live OAuth test previously acquired a token successfully but received 403 until product-view permission was granted; it was not rerun with the exposed credential. The credential should be rotated.

API generation

• npm run gen-api not run because no Swagger-generated contracts changed.

[soe-relewise]

Please address the two P2 recovery issues below before merging: a stalled shared token acquisition has no SDK-controlled lifetime, and empty authentication-list elements prevent invalid_token recovery. Both were reproduced against this commit and independently validated by three reviewers.

The separate P3 comment about sanitizing malformed token responses is defensive hardening, not a reason for requesting changes on its own.

Validation: all 113 client unit tests, npm run build, and npm run build:types passed locally using the installed tooling. Focused checks reproduced the additional cases below. Live OAuth integration tests were not run. PHP PR #86 provides useful existing examples of bounded acquisition and empty-list handling.

[soe-relewise]