@oxyhq/core 3.18.1 → 4.0.0

package/dist/esm/OxyServices.js

@@ -20,8 +20,9 @@ import { composeOxyServices } from './mixins/index.js';
  * - **Payment**: Payment processing
  * - **Reputation**: Reputation system (Oxy Trust)
  * - **Assets**: File upload and asset management
- * - **Applications**: Application, membership, and credential management
- * - **Workspaces**: Workspace and membership management
+ * - **Accounts**: Unified account graph (tree, members, roles, bot credentials)
+ *   and the applications owned within it (Application = OAuth client)
+ * - **Connected apps**: OAuth-consent surface (public app identity, grants)
  * - **Location**: Location-based features
  * - **Analytics**: Analytics tracking
  * - **Devices**: Device management

package/dist/esm/mixins/OxyServices.accounts.js

@@ -0,0 +1,477 @@
+import { CACHE_TIMES } from './mixinHelpers.js';
+export function OxyServicesAccountsMixin(Base) {
+    return class extends Base {
+        constructor(...args) {
+            super(...args);
+        }
+        // =========================================================================
+        // Accounts
+        // =========================================================================
+        /**
+         * List the accounts the caller can access: their own personal (root)
+         * account, accounts they own, and accounts shared with them (including
+         * external organisations), plus the reachable subtree of each.
+         *
+         * @param opts - `{ tree: true }` requests the nested tree representation
+         *   (`children` populated) instead of a flat list. The flag is appended to
+         *   the path as `?tree=true`, so the response cache keys on it automatically —
+         *   the flat and tree variants never collide.
+         */
+        async listAccounts(opts) {
+            try {
+                const path = opts?.tree ? '/accounts?tree=true' : '/accounts';
+                const res = await this.makeRequest('GET', path, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                return res.accounts ?? [];
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Fetch a single account node by id.
+         * @param accountId - The account's Mongo `_id`.
+         */
+        async getAccount(accountId) {
+            try {
+                const res = await this.makeRequest('GET', `/accounts/${encodeURIComponent(accountId)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.LONG });
+                return res.account;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Create a new (non-personal) account. The caller becomes its `owner`.
+         * @param data - Account configuration: kind, optional parent, and profile.
+         */
+        async createAccount(data) {
+            try {
+                const res = await this.makeRequest('POST', '/accounts', data, { cache: false });
+                // A new account changes the accessible forest — bust every cached list
+                // (flat + tree) so it appears on the next `listAccounts()` read.
+                this._invalidateAccountLists();
+                return res.account;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Update an account's mutable profile fields. Tree placement changes
+         * (reparenting) go through the dedicated move endpoint, not here.
+         * @param accountId - The account's Mongo `_id`.
+         * @param data - Subset of updatable profile fields.
+         */
+        async updateAccount(accountId, data) {
+            try {
+                const res = await this.makeRequest('PATCH', `/accounts/${encodeURIComponent(accountId)}`, data, { cache: false });
+                // Bust the cached detail and every list (which embeds account profile
+                // data) so neither serves the pre-update snapshot.
+                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}`);
+                this._invalidateAccountLists();
+                return res.account;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Archive an account (soft delete). Named `archiveAccount` — NOT
+         * `deleteAccount`, which is reserved for the GDPR self-deletion flow on the
+         * user mixin (`OxyServices.user.ts`).
+         * @param accountId - The account's Mongo `_id`.
+         */
+        async archiveAccount(accountId) {
+            try {
+                const result = await this.makeRequest('DELETE', `/accounts/${encodeURIComponent(accountId)}`, undefined, { cache: false });
+                // Bust every cached representation of the archived account.
+                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}`);
+                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/members`);
+                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/credentials`);
+                this._invalidateAccountLists();
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * List the direct child accounts of an account.
+         * @param accountId - The parent account's Mongo `_id`.
+         */
+        async listChildAccounts(accountId) {
+            try {
+                const res = await this.makeRequest('GET', `/accounts/${encodeURIComponent(accountId)}/children`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                return res.accounts ?? [];
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        // =========================================================================
+        // Account members
+        // =========================================================================
+        /**
+         * List members of an account (direct membership rows on the account).
+         * @param accountId - The account's Mongo `_id`.
+         */
+        async listAccountMembers(accountId) {
+            try {
+                const res = await this.makeRequest('GET', `/accounts/${encodeURIComponent(accountId)}/members`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                return res.members ?? [];
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Add a member to an account.
+         * @param accountId - The account's Mongo `_id`.
+         * @param data - Target user's username or email and role (never `owner`).
+         *   The server resolves `usernameOrEmail` to a personal account; an unknown
+         *   value yields a 404 "User not found".
+         */
+        async inviteAccountMember(accountId, data) {
+            try {
+                const res = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/members`, data, { cache: false });
+                this._invalidateAccountMembership(accountId);
+                return res.member;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Change a member's role.
+         * @param accountId - The account's Mongo `_id`.
+         * @param memberId - The member's Mongo `_id`.
+         * @param data - New role (never `owner`).
+         */
+        async updateAccountMember(accountId, memberId, data) {
+            try {
+                const res = await this.makeRequest('PATCH', `/accounts/${encodeURIComponent(accountId)}/members/${encodeURIComponent(memberId)}`, data, { cache: false });
+                this._invalidateAccountMembership(accountId);
+                return res.member;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Remove a member from an account.
+         * @param accountId - The account's Mongo `_id`.
+         * @param memberId - The member's Mongo `_id`.
+         */
+        async removeAccountMember(accountId, memberId) {
+            try {
+                const result = await this.makeRequest('DELETE', `/accounts/${encodeURIComponent(accountId)}/members/${encodeURIComponent(memberId)}`, undefined, { cache: false });
+                this._invalidateAccountMembership(accountId);
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Transfer ownership of an account to another member (owner only).
+         * @param accountId - The account's Mongo `_id`.
+         * @param data - Target user id.
+         */
+        async transferAccountOwnership(accountId, data) {
+            try {
+                const result = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/transfer-ownership`, data, { cache: false });
+                // Ownership change alters roles in the member list AND the detail, and
+                // can change which accounts the caller "owns" in the list view.
+                this._invalidateAccountMembership(accountId);
+                this._invalidateAccountLists();
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        // =========================================================================
+        // Bot (account) service credentials  —  /accounts/:id/credentials
+        // =========================================================================
+        /**
+         * List a bot account's service credentials. The response NEVER includes
+         * secrets.
+         * @param accountId - The account's Mongo `_id`.
+         */
+        async listAccountCredentials(accountId) {
+            try {
+                const res = await this.makeRequest('GET', `/accounts/${encodeURIComponent(accountId)}/credentials`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                return res.credentials ?? [];
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Create a service credential for a bot account. The plaintext `secret` is
+         * returned exactly ONCE; the server stores only a hash and will never return
+         * it again.
+         * @param accountId - The account's Mongo `_id`.
+         * @param data - Credential configuration (`type` is always `service`).
+         */
+        async createAccountCredential(accountId, data) {
+            try {
+                const result = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/credentials`, data, { cache: false });
+                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/credentials`);
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Rotate a bot credential's secret. The new plaintext `secret` is returned
+         * exactly ONCE, along with audit fields: `rotatedFrom` (the previous
+         * credentialId) and `graceExpiresAt` (ISO string for the grace window during
+         * which the old credential is still honoured).
+         * @param accountId - The account's Mongo `_id`.
+         * @param credentialId - The credential's Mongo `_id`.
+         */
+        async rotateAccountCredential(accountId, credentialId) {
+            try {
+                const result = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/credentials/${encodeURIComponent(credentialId)}/rotate`, undefined, { cache: false });
+                // Rotation changes credential status/audit fields surfaced by the list.
+                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/credentials`);
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Revoke a bot credential (`status='revoked'`). Revoked credentials can no
+         * longer authenticate.
+         * @param accountId - The account's Mongo `_id`.
+         * @param credentialId - The credential's Mongo `_id`.
+         */
+        async revokeAccountCredential(accountId, credentialId) {
+            try {
+                const result = await this.makeRequest('DELETE', `/accounts/${encodeURIComponent(accountId)}/credentials/${encodeURIComponent(credentialId)}`, undefined, { cache: false });
+                // Revocation flips the credential's status in the cached list.
+                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/credentials`);
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        // =========================================================================
+        // Applications owned by an account  —  /applications
+        // =========================================================================
+        /**
+         * List the applications owned by an account. Backed by
+         * `GET /applications?ownerAccountId=<id>`.
+         * @param accountId - The owning account's Mongo `_id`.
+         */
+        async listAccountApps(accountId) {
+            try {
+                const res = await this.makeRequest('GET', `/applications?ownerAccountId=${encodeURIComponent(accountId)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                return res.applications ?? [];
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Create a new application owned by an account.
+         * @param data - Application configuration. `ownerAccountId` defaults to the
+         *   caller's personal account when omitted. Staff-only fields are ignored.
+         */
+        async createApp(data) {
+            try {
+                const res = await this.makeRequest('POST', '/applications', data, { cache: false });
+                // Bust every cached application list (per owning account) so the new app
+                // appears on the next `listAccountApps()` read.
+                this._invalidateAppLists();
+                return res.application;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Fetch a single application by id.
+         * @param applicationId - The application's Mongo `_id`.
+         */
+        async getApp(applicationId) {
+            try {
+                const res = await this.makeRequest('GET', `/applications/${encodeURIComponent(applicationId)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.LONG });
+                return res.application;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Update an application's mutable fields.
+         * @param applicationId - The application's Mongo `_id`.
+         * @param data - Subset of updatable fields. Staff-only fields are ignored.
+         */
+        async updateApp(applicationId, data) {
+            try {
+                const res = await this.makeRequest('PATCH', `/applications/${encodeURIComponent(applicationId)}`, data, { cache: false });
+                // Bust the cached detail and every list (which embeds application fields).
+                this.clearCacheEntry(`GET:/applications/${encodeURIComponent(applicationId)}`);
+                this._invalidateAppLists();
+                return res.application;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Soft-delete an application.
+         * @param applicationId - The application's Mongo `_id`.
+         */
+        async deleteApp(applicationId) {
+            try {
+                const result = await this.makeRequest('DELETE', `/applications/${encodeURIComponent(applicationId)}`, undefined, { cache: false });
+                // Bust every cached representation of the deleted application.
+                this.clearCacheEntry(`GET:/applications/${encodeURIComponent(applicationId)}`);
+                this.clearCacheEntry(`GET:/applications/${encodeURIComponent(applicationId)}/credentials`);
+                this._invalidateAppLists();
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        // =========================================================================
+        // Application OAuth credentials  —  /applications/:appId/credentials
+        // =========================================================================
+        /**
+         * List an application's OAuth credentials. The response NEVER includes
+         * secrets.
+         * @param applicationId - The application's Mongo `_id`.
+         */
+        async listAppCredentials(applicationId) {
+            try {
+                const res = await this.makeRequest('GET', `/applications/${encodeURIComponent(applicationId)}/credentials`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                return res.credentials ?? [];
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Create an application credential. The plaintext `secret` is returned
+         * exactly ONCE; the server stores only a hash and will never return it again.
+         * @param applicationId - The application's Mongo `_id`.
+         * @param data - Credential configuration.
+         */
+        async createAppCredential(applicationId, data) {
+            try {
+                const result = await this.makeRequest('POST', `/applications/${encodeURIComponent(applicationId)}/credentials`, data, { cache: false });
+                this.clearCacheEntry(`GET:/applications/${encodeURIComponent(applicationId)}/credentials`);
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Rotate an application credential's secret. The new plaintext `secret` is
+         * returned exactly ONCE, along with audit fields: `rotatedFrom` (the previous
+         * credentialId) and `graceExpiresAt` (ISO string for the grace window during
+         * which the old credential is still honoured).
+         * @param applicationId - The application's Mongo `_id`.
+         * @param credentialId - The credential's Mongo `_id`.
+         */
+        async rotateAppCredential(applicationId, credentialId) {
+            try {
+                const result = await this.makeRequest('POST', `/applications/${encodeURIComponent(applicationId)}/credentials/${encodeURIComponent(credentialId)}/rotate`, undefined, { cache: false });
+                // Rotation changes credential status/audit fields surfaced by the list.
+                this.clearCacheEntry(`GET:/applications/${encodeURIComponent(applicationId)}/credentials`);
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Revoke an application credential (`status='revoked'`). Revoked credentials
+         * can no longer authenticate.
+         * @param applicationId - The application's Mongo `_id`.
+         * @param credentialId - The credential's Mongo `_id`.
+         */
+        async revokeAppCredential(applicationId, credentialId) {
+            try {
+                const result = await this.makeRequest('DELETE', `/applications/${encodeURIComponent(applicationId)}/credentials/${encodeURIComponent(credentialId)}`, undefined, { cache: false });
+                // Revocation flips the credential's status in the cached list.
+                this.clearCacheEntry(`GET:/applications/${encodeURIComponent(applicationId)}/credentials`);
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Fetch usage statistics for an application.
+         * @param applicationId - The application's Mongo `_id`.
+         * @param period - Time window (defaults to the server default).
+         */
+        async getAppUsage(applicationId, period) {
+            try {
+                return await this.makeRequest('GET', `/applications/${encodeURIComponent(applicationId)}/usage`, period ? { period } : undefined, { cache: true, cacheTTL: CACHE_TIMES.SHORT });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        // =========================================================================
+        // Cache-invalidation helpers
+        // =========================================================================
+        /**
+         * Bust every cached account list. `listAccounts({tree?})` keys the flat list
+         * as `GET:/accounts` and the tree variant as `GET:/accounts?tree=true` (the
+         * query string is part of the URL path). A change to the accessible forest
+         * (create/archive/ownership transfer) invalidates both, so we clear the
+         * unscoped entry plus every `?`-query variant via a prefix sweep. The prefix
+         * `GET:/accounts?` matches only the query-string list variants, never the
+         * `GET:/accounts/<id>…` detail/sub-resource keys.
+         *
+         * Internal helper (leading underscore); not part of the supported public
+         * surface. Public rather than `private` because mixins compose into an
+         * exported anonymous class, where TypeScript cannot represent a private
+         * member in the emitted declaration file (TS4094).
+         */
+        _invalidateAccountLists() {
+            this.clearCacheEntry('GET:/accounts');
+            this.clearCacheByPrefix('GET:/accounts?');
+        }
+        /**
+         * Bust the cached member list and detail for an account after a membership
+         * mutation. The member list (`listAccountMembers`) and the detail
+         * (`getAccount`, which can embed the caller's membership) both go stale when
+         * the member set or a member's role changes.
+         *
+         * Internal helper (leading underscore); see `_invalidateAccountLists` for why
+         * this is public rather than `private`.
+         */
+        _invalidateAccountMembership(accountId) {
+            this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/members`);
+            this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}`);
+        }
+        /**
+         * Bust every cached application list. `listAccountApps(accountId)` keys each
+         * owner-scoped list as `GET:/applications?ownerAccountId=<id>` (the query
+         * string is part of the URL path). A change to any list (create/delete)
+         * invalidates them all, so we clear the unscoped entry plus every `?`-query
+         * variant via a prefix sweep. The prefix `GET:/applications?` matches only the
+         * query-string list variants, never the `GET:/applications/<id>…`
+         * detail/sub-resource keys.
+         *
+         * Internal helper (leading underscore); see `_invalidateAccountLists` for why
+         * this is public rather than `private`.
+         */
+        _invalidateAppLists() {
+            this.clearCacheEntry('GET:/applications');
+            this.clearCacheByPrefix('GET:/applications?');
+        }
+    };
+}

package/dist/esm/mixins/OxyServices.connectedApps.js

@@ -0,0 +1,70 @@
+import { CACHE_TIMES } from './mixinHelpers.js';
+export function OxyServicesConnectedAppsMixin(Base) {
+    return class extends Base {
+        constructor(...args) {
+            super(...args);
+        }
+        /**
+         * Resolve an OAuth client identifier to the owning application's PUBLIC
+         * identity. No authentication required — the API returns only sanitized,
+         * display-safe metadata ({@link PublicApplication}). Use this to render the
+         * requesting application's name/icon in consent, authorize, and device-flow
+         * approval UIs before any session exists.
+         *
+         * @param clientId - The OAuth `client_id` (an active credential's public
+         *   key). URL-encoded before being placed in the path.
+         */
+        async getPublicApplication(clientId) {
+            try {
+                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                return res.application;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * List the OAuth-authorized applications the current user has connected —
+         * the third-party apps the user granted access to via the consent flow.
+         * Each entry is a {@link ConnectedApp} carrying the application's display
+         * identity, the granted scopes, and when the grant was first made and last
+         * exercised. Requires an authenticated session.
+         *
+         * Backed by `GET /auth/grants`. The response is briefly cached
+         * (identity-scoped); {@link revokeAppGrant} busts that cache so a revoke is
+         * reflected on the next read.
+         */
+        async listConnectedApps() {
+            try {
+                return await this.makeRequest('GET', '/auth/grants', undefined, { cache: true, cacheTTL: CACHE_TIMES.SHORT });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Revoke the current user's grant for a connected application, identified by
+         * its application `_id` (a {@link ConnectedApp.applicationId}, NOT a
+         * credential/client id — keyed by application so the revocation survives
+         * credential rotation). After this the application can no longer act on the
+         * user's behalf until it is re-authorized.
+         *
+         * Backed by `DELETE /auth/grants/:applicationId`. On success the cached
+         * connected-apps list (`GET:/auth/grants`) is invalidated so the next
+         * {@link listConnectedApps} read reflects the removal.
+         *
+         * @param applicationId - The connected application's Mongo `_id`.
+         */
+        async revokeAppGrant(applicationId) {
+            try {
+                await this.makeRequest('DELETE', `/auth/grants/${applicationId}`, undefined, { cache: false });
+                // A revoke removes an entry from the user's connected-apps list; bust
+                // the cached `GET /auth/grants` so the next read re-fetches.
+                this.clearCacheEntry('GET:/auth/grants');
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+    };
+}

package/dist/esm/mixins/OxyServices.utility.js

@@ -59,7 +59,8 @@ export function OxyServicesUtilityMixin(Base) {
             this._serviceActingAsCache = new Map();
         }
         /**
-         * Verify that a user is authorized to act as a managed account.
+         * Verify that a user is authorized to act as an account (direct membership
+         * or inherited via an ancestor). Backed by `GET /accounts/verify-acting-as`.
          * Results are cached in-memory for 5 minutes to avoid repeated API calls.
          *
          * @internal Used by the auth() middleware — not part of the public API
@@ -74,7 +75,7 @@ export function OxyServicesUtilityMixin(Base) {
             }
             // Query the API
             try {
-                const result = await this.makeRequest('GET', '/managed-accounts/verify', { accountId, userId }, { cache: false, retry: false, timeout: 5000 });
+                const result = await this.makeRequest('GET', '/accounts/verify-acting-as', { accountId, userId }, { cache: false, retry: false, timeout: 5000 });
                 // Cache successful result for 5 minutes
                 this._actingAsCache.set(cacheKey, {
                     result: result && result.authorized ? result : null,

package/dist/esm/mixins/index.js

@@ -17,8 +17,8 @@ import { OxyServicesLanguageMixin } from './OxyServices.language.js';
 import { OxyServicesPaymentMixin } from './OxyServices.payment.js';
 import { OxyServicesReputationMixin } from './OxyServices.reputation.js';
 import { OxyServicesAssetsMixin } from './OxyServices.assets.js';
-import { OxyServicesApplicationsMixin } from './OxyServices.applications.js';
-import { OxyServicesWorkspacesMixin } from './OxyServices.workspaces.js';
+import { OxyServicesAccountsMixin } from './OxyServices.accounts.js';
+import { OxyServicesConnectedAppsMixin } from './OxyServices.connectedApps.js';
 import { OxyServicesLocationMixin } from './OxyServices.location.js';
 import { OxyServicesAnalyticsMixin } from './OxyServices.analytics.js';
 import { OxyServicesDevicesMixin } from './OxyServices.devices.js';
@@ -26,7 +26,6 @@ import { OxyServicesSecurityMixin } from './OxyServices.security.js';
 import { OxyServicesUtilityMixin } from './OxyServices.utility.js';
 import { OxyServicesFeaturesMixin } from './OxyServices.features.js';
 import { OxyServicesTopicsMixin } from './OxyServices.topics.js';
-import { OxyServicesManagedAccountsMixin } from './OxyServices.managedAccounts.js';
 import { OxyServicesContactsMixin } from './OxyServices.contacts.js';
 import { OxyServicesAppDataMixin } from './OxyServices.appData.js';
 import { OxyServicesCivicMixin } from './OxyServices.civic.js';
@@ -66,15 +65,19 @@ const MIXIN_PIPELINE = [
     OxyServicesPaymentMixin,
     OxyServicesReputationMixin,
     OxyServicesAssetsMixin,
-    OxyServicesApplicationsMixin,
-    OxyServicesWorkspacesMixin,
+    // Unified account graph + the applications owned within it. The clean-cut
+    // replacement for the former managedAccounts + workspaces + applications
+    // (account-management) mixins.
+    OxyServicesAccountsMixin,
+    // OAuth-consent surface (public app identity + connected-app grants). Kept
+    // separate from account ownership.
+    OxyServicesConnectedAppsMixin,
     OxyServicesLocationMixin,
     OxyServicesAnalyticsMixin,
     OxyServicesDevicesMixin,
     OxyServicesSecurityMixin,
     OxyServicesFeaturesMixin,
     OxyServicesTopicsMixin,
-    OxyServicesManagedAccountsMixin,
     OxyServicesContactsMixin,
     OxyServicesAppDataMixin,
     // Civic / Commons "Oxy ID" (public signed cards, Oxy ID QR payload)