refactor(core): continue bounded risk-reduction for token client extraction

actions/core/token.js

@@ -1,4 +1,4 @@
-import axios from "axios";
+import { requestJson } from "../clients/endpointClient";
 import { ACCESS_TOKEN_ENDPOINT, TENANT_ID } from "./env";
 import { consoleLogger } from "./logger";
 
@@ -23,20 +23,19 @@ const tokenConfig = {
     }
 };
 
-export const getToken = () => {
-    return axios
-        .post(
-            `${ACCESS_TOKEN_ENDPOINT}${TENANT_ID}/oauth2/v2.0/token`,
-            tokenBody,
-            tokenConfig
-        )
-        .then((res) => res.data)
-        .then((data) => {
-            cache.tokenResponse = data;
-            return data;
-        })
-        .catch((error) => {
-            consoleLogger(error);
-            return error;
+export const getToken = async () => {
+    try {
+        const data = await requestJson({
+            method: "post",
+            url: `${ACCESS_TOKEN_ENDPOINT}${TENANT_ID}/oauth2/v2.0/token`,
+            data: tokenBody,
+            ...tokenConfig
         });
+
+        cache.tokenResponse = data;
+        return data;
+    } catch (error) {
+        consoleLogger(error);
+        return error;
+    }
 };

memory-bank/change-log.md

@@ -2109,3 +2109,39 @@ Validation:
 Follow-ups:
 
 - Optional next bounded risk-reduction slice: evaluate whether other legacy service test suites can adopt `tests/serviceHarness.cjs` to standardize migration-era service mocking behavior.
+
+---
+
+### CL-060: TASK22260 next slice — core token helper client-wrapper migration (continued bounded risk-reduction)
+
+date: 2026-03-25
+author: Cline
+scope: `actions/core/token.js`
+type: change
+rationale: Include the identified remaining candidate outside `actions/services` and continue the bounded risk-reduction stream by removing direct axios response extraction from core token retrieval.
+impact: Aligns token helper request execution with shared endpoint client conventions while preserving existing token caching and error-return behavior.
+status: completed
+
+Summary:
+
+- Refactored `getToken` in `actions/core/token.js`:
+    - replaced direct `axios.post(...).then(res => res.data)` chain with shared `requestJson({...})`
+    - migrated function to `async/await` with equivalent `try/catch` behavior
+    - retained existing semantics:
+        - successful token payload cached in `cache.tokenResponse`
+        - failures logged via `consoleLogger` and returned to caller
+- Removed direct `axios` dependency from `actions/core/token.js` in favor of `actions/clients/endpointClient`.
+
+Validation:
+
+- `node tests/phase21/api-contract-slice1.test.cjs` -> pass
+    - helper: 4/4
+    - file-handler: 53/53
+    - email-handler: 12/12
+    - endpoint-handler: 164/164
+    - documents-handler: 3/3
+- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps`; no new lint errors)
+
+Follow-ups:
+
+- Optional next bounded risk-reduction slice: assess whether any remaining non-service utility modules still use promise-chain axios extraction patterns and migrate them to shared clients where behavior contracts remain unchanged.