@oxyhq/core 3.18.1 → 4.0.0

package/dist/esm/mixins/OxyServices.workspaces.js

@@ -1,178 +0,0 @@
-import { CACHE_TIMES } from './mixinHelpers.js';
-export function OxyServicesWorkspacesMixin(Base) {
-    return class extends Base {
-        constructor(...args) {
-            super(...args);
-        }
-        /**
-         * List workspaces the current user is an active member of.
-         */
-        async getWorkspaces() {
-            try {
-                const res = await this.makeRequest('GET', '/workspaces', undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
-                return res.workspaces ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Create a new team workspace. The caller becomes its `owner`.
-         * @param data - Workspace configuration.
-         */
-        async createWorkspace(data) {
-            try {
-                const res = await this.makeRequest('POST', '/workspaces', data, { cache: false });
-                // Bust the cached workspace list so the new workspace appears on the
-                // next `getWorkspaces()` read within the TTL window.
-                this.clearCacheEntry('GET:/workspaces');
-                return res.workspace;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Fetch a single workspace by id.
-         * @param workspaceId - The workspace's Mongo `_id`.
-         */
-        async getWorkspace(workspaceId) {
-            try {
-                const res = await this.makeRequest('GET', `/workspaces/${encodeURIComponent(workspaceId)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.LONG });
-                return res.workspace;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Update a workspace's mutable fields.
-         * @param workspaceId - The workspace's Mongo `_id`.
-         * @param data - Subset of updatable fields.
-         */
-        async updateWorkspace(workspaceId, data) {
-            try {
-                const res = await this.makeRequest('PATCH', `/workspaces/${encodeURIComponent(workspaceId)}`, data, { cache: false });
-                // Bust the cached detail and list — both surface workspace fields.
-                this.clearCacheEntry(`GET:/workspaces/${encodeURIComponent(workspaceId)}`);
-                this.clearCacheEntry('GET:/workspaces');
-                return res.workspace;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Soft-delete a workspace (owner only).
-         * @param workspaceId - The workspace's Mongo `_id`.
-         */
-        async deleteWorkspace(workspaceId) {
-            try {
-                const result = await this.makeRequest('DELETE', `/workspaces/${encodeURIComponent(workspaceId)}`, undefined, { cache: false });
-                // Bust every cached representation of the deleted workspace.
-                this.clearCacheEntry(`GET:/workspaces/${encodeURIComponent(workspaceId)}`);
-                this.clearCacheEntry(`GET:/workspaces/${encodeURIComponent(workspaceId)}/members`);
-                this.clearCacheEntry('GET:/workspaces');
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * List members of a workspace.
-         * @param workspaceId - The workspace's Mongo `_id`.
-         */
-        async getWorkspaceMembers(workspaceId) {
-            try {
-                const res = await this.makeRequest('GET', `/workspaces/${encodeURIComponent(workspaceId)}/members`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
-                return res.members ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Add a member to a workspace.
-         * @param workspaceId - The workspace's Mongo `_id`.
-         * @param data - Target user's username or email and role (never `owner`).
-         *   The server resolves `usernameOrEmail` to a user; an unknown value yields
-         *   a 404 "User not found".
-         */
-        async inviteWorkspaceMember(workspaceId, data) {
-            try {
-                const res = await this.makeRequest('POST', `/workspaces/${encodeURIComponent(workspaceId)}/members`, data, { cache: false });
-                this._invalidateWorkspaceMembership(workspaceId);
-                return res.member;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Change a member's role.
-         * @param workspaceId - The workspace's Mongo `_id`.
-         * @param memberId - The member's Mongo `_id`.
-         * @param data - New role (never `owner`).
-         */
-        async updateWorkspaceMember(workspaceId, memberId, data) {
-            try {
-                const res = await this.makeRequest('PATCH', `/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(memberId)}`, data, { cache: false });
-                this._invalidateWorkspaceMembership(workspaceId);
-                return res.member;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Remove a member from a workspace.
-         * @param workspaceId - The workspace's Mongo `_id`.
-         * @param memberId - The member's Mongo `_id`.
-         */
-        async removeWorkspaceMember(workspaceId, memberId) {
-            try {
-                const result = await this.makeRequest('DELETE', `/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(memberId)}`, undefined, { cache: false });
-                this._invalidateWorkspaceMembership(workspaceId);
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Transfer ownership of a workspace to another member (owner only).
-         * Demotes the current owner and promotes the target to `owner`.
-         * @param workspaceId - The workspace's Mongo `_id`.
-         * @param data - Target user id.
-         */
-        async transferWorkspaceOwnership(workspaceId, data) {
-            try {
-                const result = await this.makeRequest('POST', `/workspaces/${encodeURIComponent(workspaceId)}/transfer-ownership`, data, { cache: false });
-                // Ownership change alters roles in the member list AND the detail, and
-                // can change which workspaces the caller "owns" in the list view.
-                this._invalidateWorkspaceMembership(workspaceId);
-                this.clearCacheEntry('GET:/workspaces');
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Bust the cached member list and detail for a workspace after a membership
-         * mutation. The member list (`getWorkspaceMembers`) and the detail
-         * (`getWorkspace`, which can embed member counts) both go stale when the
-         * member set or a member's role changes.
-         *
-         * Internal helper (leading underscore); not part of the supported public
-         * surface. Public rather than `private` because mixins compose into an
-         * exported anonymous class, where TypeScript cannot represent a private
-         * member in the emitted declaration file (TS4094).
-         */
-        _invalidateWorkspaceMembership(workspaceId) {
-            this.clearCacheEntry(`GET:/workspaces/${encodeURIComponent(workspaceId)}/members`);
-            this.clearCacheEntry(`GET:/workspaces/${encodeURIComponent(workspaceId)}`);
-        }
-    };
-}

package/dist/types/mixins/OxyServices.applications.d.ts

@@ -1,496 +0,0 @@
-/**
- * Applications Methods Mixin
- *
- * Provides methods for managing Oxy applications, their members, and their
- * credentials via the `/applications` API. An application is a multi-user
- * entity: membership (with a role) grants permissions; credentials
- * (public/confidential/service) carry OAuth client identifiers and the
- * service-token API key material.
- *
- * Reference applications by their Mongo `_id` (`applicationId`) and credentials
- * by their `credentialId`. Never by name.
- */
-import type { OxyServicesBase } from '../OxyServices.base';
-/**
- * Application classification. Set only by Oxy platform staff — never editable
- * through the normal member-facing update path.
- */
-export type ApplicationType = 'first_party' | 'third_party' | 'internal' | 'system';
-/** Lifecycle status of an application. */
-export type ApplicationStatus = 'active' | 'suspended' | 'deleted' | 'pending_review';
-/** Role a member holds within an application. */
-export type ApplicationRole = 'owner' | 'admin' | 'developer' | 'viewer' | 'billing';
-/** Membership lifecycle status. */
-export type ApplicationMemberStatus = 'active' | 'invited' | 'removed';
-/** Credential kind. `service` credentials mint service tokens. */
-export type ApplicationCredentialType = 'public' | 'confidential' | 'service';
-/** Deployment environment a credential is scoped to. */
-export type ApplicationEnvironment = 'development' | 'staging' | 'production';
-/** Credential lifecycle status. */
-export type ApplicationCredentialStatus = 'active' | 'deprecated' | 'revoked';
-/**
- * Client-facing Application shape returned by the `/applications` API.
- * Mirrors the server `Application` model with `_id` as a string and dates
- * serialized to ISO strings.
- */
-export interface Application {
-    _id: string;
-    name: string;
-    description?: string;
-    websiteUrl?: string;
-    icon?: string;
-    type: ApplicationType;
-    status: ApplicationStatus;
-    isOfficial: boolean;
-    isInternal: boolean;
-    capabilities: string[];
-    redirectUris: string[];
-    scopes: string[];
-    webhookUrl?: string;
-    devWebhookUrl?: string;
-    createdByUserId: string;
-    /**
-     * The workspace this application belongs to (workspace `_id`), or `null` for
-     * applications not owned by a workspace. Used by the console to scope apps to
-     * a workspace and to branch on workspace-derived access.
-     */
-    workspaceId: string | null;
-    createdAt: string;
-    updatedAt: string;
-    /**
-     * The calling user's own membership in this application, embedded by the API
-     * on list (`GET /applications`) and detail (`GET /applications/:appId`)
-     * responses. Use `callerMembership.permissions` to gate UI affordances.
-     *
-     * When the caller's access is derived from a workspace membership rather than
-     * a direct application membership, the API returns a synthetic membership
-     * with `source: 'workspace'` and `_id: null`.
-     */
-    callerMembership?: ApplicationMember;
-}
-/**
- * Client-facing ApplicationMember shape. `permissions` is derived from `role`
- * on the server at write time.
- */
-export interface ApplicationMember {
-    /**
-     * The membership's Mongo `_id`. `null` for a synthetic, workspace-derived
-     * membership (see {@link Application.callerMembership} and `source`).
-     */
-    _id: string | null;
-    applicationId: string;
-    userId: string;
-    role: ApplicationRole;
-    permissions: string[];
-    invitedByUserId?: string;
-    joinedAt?: string;
-    status: ApplicationMemberStatus;
-    /**
-     * Origin of this membership. When `'workspace'`, the membership is synthetic
-     * and derived from the caller's workspace membership rather than a direct
-     * application membership (in which case `_id` is `null`). Absent or any other
-     * value indicates a direct application membership.
-     */
-    source?: 'workspace';
-    createdAt: string;
-    updatedAt: string;
-}
-/**
- * Client-facing ApplicationCredential shape. The raw secret is NEVER part of
- * this shape — it is returned exactly once, separately, at creation/rotation.
- */
-export interface ApplicationCredential {
-    _id: string;
-    applicationId: string;
-    name: string;
-    publicKey: string;
-    type: ApplicationCredentialType;
-    environment: ApplicationEnvironment;
-    scopes: string[];
-    status: ApplicationCredentialStatus;
-    lastUsedAt?: string;
-    expiresAt?: string;
-    /**
-     * Audit link to the credential this one was rotated FROM. Populated by the
-     * API on credentials created via rotation; absent on original credentials.
-     */
-    rotatedFromCredentialId?: string;
-    createdByUserId: string;
-    createdAt: string;
-    updatedAt: string;
-}
-/**
- * Sanitized, PUBLIC application identity returned by the API when resolving a
- * cross-app/OAuth client to a registered {@link Application}.
- *
- * Unlike {@link Application}, this shape carries NO sensitive or membership
- * fields — it is safe to display unauthenticated in consent/authorize screens
- * and device-flow approval UIs. The API resolves a `client_id` (OAuth
- * credential public key) to the owning application and projects only the
- * fields below. `id` is the application's `_id` as a string.
- */
-export interface PublicApplication {
-    /** The application's Mongo `_id` as a string. */
-    id: string;
-    /** Human-readable application name shown to the user. */
-    name: string;
-    /** Optional short description of what the application does. */
-    description?: string;
-    /** Optional icon URL for the application. */
-    icon?: string;
-    /** Optional public website/homepage URL for the application. */
-    websiteUrl?: string;
-    /** Application classification (set by Oxy platform staff). */
-    type: ApplicationType;
-    /** Whether the application is an officially endorsed Oxy application. */
-    isOfficial: boolean;
-    /** Whether the application is an internal Oxy ecosystem application. */
-    isInternal: boolean;
-    /** OAuth scopes the application is configured to request. */
-    scopes: string[];
-    /** Optional display name of the developer/owner organisation. */
-    developerName?: string;
-}
-/**
- * A connected (OAuth-authorized) application from the current user's point of
- * view: an application the user has granted access to via the consent flow.
- *
- * Returned by `GET /auth/grants` and rendered in the user-facing "Connected
- * apps" management surface. Keyed by `applicationId` (the application's Mongo
- * `_id`) rather than a credential/client id, so the grant — and a subsequent
- * {@link OxyServicesApplicationsMixin.revokeAppGrant} — survive credential
- * rotation. This is a display shape: it carries the application's name/logo and
- * the granted scopes, never any membership or credential material.
- */
-export interface ConnectedApp {
-    /** The connected application's Mongo `_id`. Use this to revoke the grant. */
-    applicationId: string;
-    /** Human-readable application name shown to the user. */
-    name: string;
-    /** Optional logo URL for the application. */
-    logoUrl?: string;
-    /** OAuth scopes the user has granted to the application. */
-    scopes: string[];
-    /** ISO timestamp of when the user first authorized the application. */
-    firstGrantedAt: string;
-    /** ISO timestamp of when the grant was last exercised. */
-    lastUsedAt: string;
-}
-/** Input accepted by `createApplication`. Staff-only fields are not settable here. */
-export interface CreateApplicationInput {
-    name: string;
-    description?: string;
-    websiteUrl?: string;
-    icon?: string;
-    redirectUris?: string[];
-    scopes?: string[];
-    /**
-     * Optional workspace `_id` to create the app in. Omitted → API defaults to
-     * the caller's personal workspace.
-     */
-    workspaceId?: string;
-}
-/** Input accepted by `updateApplication`. Staff-only fields are not settable here. */
-export interface UpdateApplicationInput {
-    name?: string;
-    description?: string;
-    websiteUrl?: string;
-    icon?: string;
-    redirectUris?: string[];
-    scopes?: string[];
-    webhookUrl?: string;
-    devWebhookUrl?: string;
-    status?: ApplicationStatus;
-}
-/** Input accepted by `inviteApplicationMember`. The owner role cannot be invited. */
-export interface InviteApplicationMemberInput {
-    /**
-     * The username or email of the user to invite. Resolved to a user server-side;
-     * an unknown value yields a 404 "User not found".
-     */
-    usernameOrEmail: string;
-    role: Exclude<ApplicationRole, 'owner'>;
-}
-/** Input accepted by `updateApplicationMember`. */
-export interface UpdateApplicationMemberInput {
-    role: ApplicationRole;
-}
-/** Input accepted by `transferApplicationOwnership`. */
-export interface TransferApplicationOwnershipInput {
-    userId: string;
-}
-/** Input accepted by `createApplicationCredential`. */
-export interface CreateApplicationCredentialInput {
-    name: string;
-    type: ApplicationCredentialType;
-    environment: ApplicationEnvironment;
-    scopes?: string[];
-}
-/** Result of creating a credential — `secret` is returned ONCE. */
-export interface ApplicationCredentialWithSecret {
-    credential: ApplicationCredential;
-    secret: string;
-}
-/**
- * Result of rotating a credential. Extends the create result with audit fields:
- * the new plaintext `secret` is returned ONCE, plus `rotatedFrom` (the previous
- * credential's `credentialId`) and `graceExpiresAt` (ISO string marking when the
- * old credential stops being honoured during the rotation grace window).
- */
-export interface RotateApplicationCredentialResult extends ApplicationCredentialWithSecret {
-    /** The previous credential's `credentialId` that this rotation supersedes. */
-    rotatedFrom: string;
-    /** ISO timestamp at which the rotated-from credential's grace window ends. */
-    graceExpiresAt: string;
-}
-/** Time window for application usage statistics. */
-export type ApplicationUsagePeriod = '24h' | '7d' | '30d' | '90d';
-/** Aggregate totals for an application over the requested period. */
-export interface ApplicationUsageSummary {
-    totalRequests: number;
-    totalTokens: number;
-    totalCredits: number;
-    avgResponseTime: number;
-    successfulRequests: number;
-    errorRequests: number;
-}
-/** Per-day usage bucket. `_id` is the day key (e.g. `YYYY-MM-DD`). */
-export interface ApplicationUsageByDay {
-    _id: string;
-    requests: number;
-    tokens: number;
-    credits: number;
-}
-/** Per-endpoint usage bucket. `_id` is the endpoint identifier. */
-export interface ApplicationUsageByEndpoint {
-    _id: string;
-    requests: number;
-    tokens: number;
-}
-/** Usage statistics for an application over a period. */
-export interface ApplicationUsageStats {
-    summary: ApplicationUsageSummary;
-    byDay: ApplicationUsageByDay[];
-    byEndpoint: ApplicationUsageByEndpoint[];
-}
-/** Result of a delete/remove/revoke/transfer operation. */
-export interface ApplicationSuccessResult {
-    success: boolean;
-}
-export declare function OxyServicesApplicationsMixin<T extends typeof OxyServicesBase>(Base: T): {
-    new (...args: any[]): {
-        /**
-         * Resolve an OAuth client identifier to the owning application's PUBLIC
-         * identity. No authentication required — the API returns only sanitized,
-         * display-safe metadata ({@link PublicApplication}). Use this to render the
-         * requesting application's name/icon in consent, authorize, and device-flow
-         * approval UIs before any session exists.
-         *
-         * @param clientId - The OAuth `client_id` (an active credential's public
-         *   key). URL-encoded before being placed in the path.
-         */
-        getPublicApplication(clientId: string): Promise<PublicApplication>;
-        /**
-         * List the OAuth-authorized applications the current user has connected —
-         * the third-party apps the user granted access to via the consent flow.
-         * Each entry is a {@link ConnectedApp} carrying the application's display
-         * identity, the granted scopes, and when the grant was first made and last
-         * exercised. Requires an authenticated session.
-         *
-         * Backed by `GET /auth/grants`. The response is briefly cached
-         * (identity-scoped); {@link revokeAppGrant} busts that cache so a revoke is
-         * reflected on the next read.
-         */
-        listConnectedApps(): Promise<ConnectedApp[]>;
-        /**
-         * Revoke the current user's grant for a connected application, identified by
-         * its application `_id` (a {@link ConnectedApp.applicationId}, NOT a
-         * credential/client id — keyed by application so the revocation survives
-         * credential rotation). After this the application can no longer act on the
-         * user's behalf until it is re-authorized.
-         *
-         * Backed by `DELETE /auth/grants/:applicationId`. On success the cached
-         * connected-apps list (`GET:/auth/grants`) is invalidated so the next
-         * {@link listConnectedApps} read reflects the removal.
-         *
-         * @param applicationId - The connected application's Mongo `_id`.
-         */
-        revokeAppGrant(applicationId: string): Promise<void>;
-        /**
-         * List applications the current user is an active member of.
-         *
-         * @param workspaceId - Optional workspace `_id` to scope the listing to
-         *   applications belonging to that workspace. When provided it is appended
-         *   as a `workspaceId` query parameter (URL-encoded). The query string is
-         *   part of the request path, so the response cache keys on it
-         *   automatically — scoped and unscoped lists never collide.
-         */
-        getApplications(workspaceId?: string): Promise<Application[]>;
-        /**
-         * Create a new application. The caller becomes its `owner`.
-         * @param data - Application configuration. Staff-only fields are ignored.
-         */
-        createApplication(data: CreateApplicationInput): Promise<Application>;
-        /**
-         * Fetch a single application by id.
-         * @param applicationId - The application's Mongo `_id`.
-         */
-        getApplication(applicationId: string): Promise<Application>;
-        /**
-         * Update an application's mutable fields.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param data - Subset of updatable fields. Staff-only fields are ignored.
-         */
-        updateApplication(applicationId: string, data: UpdateApplicationInput): Promise<Application>;
-        /**
-         * Soft-delete an application (owner only).
-         * @param applicationId - The application's Mongo `_id`.
-         */
-        deleteApplication(applicationId: string): Promise<ApplicationSuccessResult>;
-        /**
-         * List members of an application.
-         * @param applicationId - The application's Mongo `_id`.
-         */
-        getApplicationMembers(applicationId: string): Promise<ApplicationMember[]>;
-        /**
-         * Add a member to an application.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param data - Target user's username or email and role (never `owner`).
-         *   The server resolves `usernameOrEmail` to a user; an unknown value yields
-         *   a 404 "User not found".
-         */
-        inviteApplicationMember(applicationId: string, data: InviteApplicationMemberInput): Promise<ApplicationMember>;
-        /**
-         * Change a member's role.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param memberId - The member's Mongo `_id`.
-         * @param data - New role.
-         */
-        updateApplicationMember(applicationId: string, memberId: string, data: UpdateApplicationMemberInput): Promise<ApplicationMember>;
-        /**
-         * Remove a member from an application.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param memberId - The member's Mongo `_id`.
-         */
-        removeApplicationMember(applicationId: string, memberId: string): Promise<ApplicationSuccessResult>;
-        /**
-         * Transfer ownership of an application to another member (owner only).
-         * Demotes the current owner to `admin` and promotes the target to `owner`.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param data - Target user id.
-         */
-        transferApplicationOwnership(applicationId: string, data: TransferApplicationOwnershipInput): Promise<ApplicationSuccessResult>;
-        /**
-         * List an application's credentials. The response NEVER includes secrets.
-         * @param applicationId - The application's Mongo `_id`.
-         */
-        getApplicationCredentials(applicationId: string): Promise<ApplicationCredential[]>;
-        /**
-         * Create a credential. The plaintext `secret` is returned exactly ONCE;
-         * the server stores only a hash and will never return it again.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param data - Credential configuration.
-         */
-        createApplicationCredential(applicationId: string, data: CreateApplicationCredentialInput): Promise<ApplicationCredentialWithSecret>;
-        /**
-         * Rotate a credential's secret. The new plaintext `secret` is returned
-         * exactly ONCE, along with audit fields: `rotatedFrom` (the previous
-         * credentialId) and `graceExpiresAt` (ISO string for the grace window during
-         * which the old credential is still honoured).
-         * @param applicationId - The application's Mongo `_id`.
-         * @param credentialId - The credential's Mongo `_id`.
-         */
-        rotateApplicationCredential(applicationId: string, credentialId: string): Promise<RotateApplicationCredentialResult>;
-        /**
-         * Revoke a credential (`status='revoked'`). Revoked credentials can no
-         * longer authenticate.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param credentialId - The credential's Mongo `_id`.
-         */
-        revokeApplicationCredential(applicationId: string, credentialId: string): Promise<ApplicationSuccessResult>;
-        /**
-         * Fetch usage statistics for an application.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param period - Time window (defaults to the server default).
-         */
-        getApplicationUsage(applicationId: string, period?: ApplicationUsagePeriod): Promise<ApplicationUsageStats>;
-        /**
-         * Bust every cached application list. `getApplications(workspaceId?)` keys
-         * the unscoped list as `GET:/applications` and each workspace-scoped list as
-         * `GET:/applications?workspaceId=<id>` (the query string is part of the URL
-         * path). A change to list membership (create/delete/ownership transfer)
-         * invalidates all of them, so we clear the unscoped entry plus every
-         * `?workspaceId=` variant via a prefix sweep. The prefix `GET:/applications?`
-         * matches only the query-string list variants, never the `GET:/applications/<id>…`
-         * detail/sub-resource keys.
-         *
-         * Internal helper (leading underscore); not part of the supported public
-         * surface. Public rather than `private` because mixins compose into an
-         * exported anonymous class, where TypeScript cannot represent a private
-         * member in the emitted declaration file (TS4094).
-         */
-        _invalidateApplicationLists(): void;
-        /**
-         * Bust the cached member list and detail for an application after a
-         * membership mutation. The member list (`getApplicationMembers`) and the
-         * detail (`getApplication`, which can embed member counts) both go stale
-         * when the member set or a member's role changes.
-         *
-         * Internal helper (leading underscore); see `_invalidateApplicationLists`
-         * for why this is public rather than `private`.
-         */
-        _invalidateApplicationMembership(applicationId: string): void;
-        httpService: import("../HttpService").HttpService;
-        cloudURL: string;
-        config: import("../OxyServices.base").OxyConfig;
-        __resetTokensForTests(): void;
-        makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
-        getBaseURL(): string;
-        getSessionBaseUrl(): string;
-        getClient(): import("../HttpService").HttpService;
-        createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
-        getMetrics(): {
-            totalRequests: number;
-            successfulRequests: number;
-            failedRequests: number;
-            cacheHits: number;
-            cacheMisses: number;
-            averageResponseTime: number;
-        };
-        clearCache(): void;
-        clearCacheEntry(key: string): void;
-        clearCacheByPrefix(prefix: string): number;
-        getCacheStats(): {
-            size: number;
-            hits: number;
-            misses: number;
-            hitRate: number;
-        };
-        getCloudURL(): string;
-        setTokens(accessToken: string): void;
-        clearTokens(): void;
-        onTokensChanged(listener: (accessToken: string | null) => void): () => void;
-        _cachedUserId: string | null | undefined;
-        _cachedAccessToken: string | null;
-        getCurrentUserId(): string | null;
-        hasValidToken(): boolean;
-        getAccessToken(): string | null;
-        getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
-        waitForAuth(timeoutMs?: number): Promise<boolean>;
-        withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
-            maxRetries?: number;
-            retryDelay?: number;
-            authTimeoutMs?: number;
-        }): Promise<T_1>;
-        validate(): Promise<boolean>;
-        handleError(error: unknown): Error;
-        healthCheck(): Promise<{
-            status: string;
-            users?: number;
-            timestamp?: string;
-            [key: string]: any;
-        }>;
-    };
-} & T;