refactor(core): continue bounded risk-reduction for token client extraction

memory-bank/change-log.md

@@ -2109,3 +2109,39 @@ Validation:
 Follow-ups:
 
 - Optional next bounded risk-reduction slice: evaluate whether other legacy service test suites can adopt `tests/serviceHarness.cjs` to standardize migration-era service mocking behavior.
+
+---
+
+### CL-060: TASK22260 next slice — core token helper client-wrapper migration (continued bounded risk-reduction)
+
+date: 2026-03-25
+author: Cline
+scope: `actions/core/token.js`
+type: change
+rationale: Include the identified remaining candidate outside `actions/services` and continue the bounded risk-reduction stream by removing direct axios response extraction from core token retrieval.
+impact: Aligns token helper request execution with shared endpoint client conventions while preserving existing token caching and error-return behavior.
+status: completed
+
+Summary:
+
+- Refactored `getToken` in `actions/core/token.js`:
+    - replaced direct `axios.post(...).then(res => res.data)` chain with shared `requestJson({...})`
+    - migrated function to `async/await` with equivalent `try/catch` behavior
+    - retained existing semantics:
+        - successful token payload cached in `cache.tokenResponse`
+        - failures logged via `consoleLogger` and returned to caller
+- Removed direct `axios` dependency from `actions/core/token.js` in favor of `actions/clients/endpointClient`.
+
+Validation:
+
+- `node tests/phase21/api-contract-slice1.test.cjs` -> pass
+    - helper: 4/4
+    - file-handler: 53/53
+    - email-handler: 12/12
+    - endpoint-handler: 164/164
+    - documents-handler: 3/3
+- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps`; no new lint errors)
+
+Follow-ups:
+
+- Optional next bounded risk-reduction slice: assess whether any remaining non-service utility modules still use promise-chain axios extraction patterns and migrate them to shared clients where behavior contracts remain unchanged.