@oxyhq/core 3.18.1 → 4.0.0

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -6,7 +6,7 @@
 import type { User, RefreshAllResponse, RefreshCookieResponse } from '../models/interfaces';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
-import type { PublicApplication } from './OxyServices.applications';
+import type { PublicApplication } from './OxyServices.connectedApps';
 export interface ChallengeResponse {
     challenge: string;
     expiresAt: string;

package/dist/types/mixins/OxyServices.connectedApps.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Connected Apps (OAuth consent) Methods Mixin
+ *
+ * The user-facing OAuth-consent surface: resolving the PUBLIC identity of a
+ * requesting application (for consent/authorize/device-flow screens), and
+ * viewing/revoking the THIRD-PARTY applications the current user has authorized.
+ *
+ * This is deliberately separate from account ownership (`OxyServices.accounts.ts`):
+ * an account owns and manages its own applications, whereas this mixin is about a
+ * user granting/revoking another party's app access to their own data. None of
+ * these methods touch the account graph.
+ *
+ * Reference connected apps by their application `_id` (`applicationId`), NOT a
+ * credential/client id, so a grant — and its revocation — survive credential
+ * rotation.
+ */
+import type { OxyServicesBase } from '../OxyServices.base';
+import type { ApplicationType } from './OxyServices.accounts';
+/**
+ * Sanitized, PUBLIC application identity returned by the API when resolving a
+ * cross-app/OAuth client to a registered application.
+ *
+ * This shape carries NO sensitive or membership fields — it is safe to display
+ * unauthenticated in consent/authorize screens and device-flow approval UIs. The
+ * API resolves a `client_id` (OAuth credential public key) to the owning
+ * application and projects only the fields below. `id` is the application's
+ * `_id` as a string.
+ */
+export interface PublicApplication {
+    /** The application's Mongo `_id` as a string. */
+    id: string;
+    /** Human-readable application name shown to the user. */
+    name: string;
+    /** Optional short description of what the application does. */
+    description?: string;
+    /** Optional icon URL for the application. */
+    icon?: string;
+    /** Optional public website/homepage URL for the application. */
+    websiteUrl?: string;
+    /** Application classification (set by Oxy platform staff). */
+    type: ApplicationType;
+    /** Whether the application is an officially endorsed Oxy application. */
+    isOfficial: boolean;
+    /** Whether the application is an internal Oxy ecosystem application. */
+    isInternal: boolean;
+    /** OAuth scopes the application is configured to request. */
+    scopes: string[];
+    /** Optional display name of the developer/owner organisation. */
+    developerName?: string;
+}
+/**
+ * A connected (OAuth-authorized) application from the current user's point of
+ * view: an application the user has granted access to via the consent flow.
+ *
+ * Returned by `GET /auth/grants` and rendered in the user-facing "Connected
+ * apps" management surface. Keyed by `applicationId` (the application's Mongo
+ * `_id`) rather than a credential/client id, so the grant — and a subsequent
+ * {@link OxyServicesConnectedAppsMixin.revokeAppGrant} — survive credential
+ * rotation. This is a display shape: it carries the application's name/logo and
+ * the granted scopes, never any membership or credential material.
+ */
+export interface ConnectedApp {
+    /** The connected application's Mongo `_id`. Use this to revoke the grant. */
+    applicationId: string;
+    /** Human-readable application name shown to the user. */
+    name: string;
+    /** Optional logo URL for the application. */
+    logoUrl?: string;
+    /** OAuth scopes the user has granted to the application. */
+    scopes: string[];
+    /** ISO timestamp of when the user first authorized the application. */
+    firstGrantedAt: string;
+    /** ISO timestamp of when the grant was last exercised. */
+    lastUsedAt: string;
+}
+export declare function OxyServicesConnectedAppsMixin<T extends typeof OxyServicesBase>(Base: T): {
+    new (...args: any[]): {
+        /**
+         * Resolve an OAuth client identifier to the owning application's PUBLIC
+         * identity. No authentication required — the API returns only sanitized,
+         * display-safe metadata ({@link PublicApplication}). Use this to render the
+         * requesting application's name/icon in consent, authorize, and device-flow
+         * approval UIs before any session exists.
+         *
+         * @param clientId - The OAuth `client_id` (an active credential's public
+         *   key). URL-encoded before being placed in the path.
+         */
+        getPublicApplication(clientId: string): Promise<PublicApplication>;
+        /**
+         * List the OAuth-authorized applications the current user has connected —
+         * the third-party apps the user granted access to via the consent flow.
+         * Each entry is a {@link ConnectedApp} carrying the application's display
+         * identity, the granted scopes, and when the grant was first made and last
+         * exercised. Requires an authenticated session.
+         *
+         * Backed by `GET /auth/grants`. The response is briefly cached
+         * (identity-scoped); {@link revokeAppGrant} busts that cache so a revoke is
+         * reflected on the next read.
+         */
+        listConnectedApps(): Promise<ConnectedApp[]>;
+        /**
+         * Revoke the current user's grant for a connected application, identified by
+         * its application `_id` (a {@link ConnectedApp.applicationId}, NOT a
+         * credential/client id — keyed by application so the revocation survives
+         * credential rotation). After this the application can no longer act on the
+         * user's behalf until it is re-authorized.
+         *
+         * Backed by `DELETE /auth/grants/:applicationId`. On success the cached
+         * connected-apps list (`GET:/auth/grants`) is invalidated so the next
+         * {@link listConnectedApps} read reflects the removal.
+         *
+         * @param applicationId - The connected application's Mongo `_id`.
+         */
+        revokeAppGrant(applicationId: string): Promise<void>;
+        httpService: import("../HttpService").HttpService;
+        cloudURL: string;
+        config: import("../OxyServices.base").OxyConfig;
+        __resetTokensForTests(): void;
+        makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
+        getBaseURL(): string;
+        getSessionBaseUrl(): string;
+        getClient(): import("../HttpService").HttpService;
+        createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
+        getMetrics(): {
+            totalRequests: number;
+            successfulRequests: number;
+            failedRequests: number;
+            cacheHits: number;
+            cacheMisses: number;
+            averageResponseTime: number;
+        };
+        clearCache(): void;
+        clearCacheEntry(key: string): void;
+        clearCacheByPrefix(prefix: string): number;
+        getCacheStats(): {
+            size: number;
+            hits: number;
+            misses: number;
+            hitRate: number;
+        };
+        getCloudURL(): string;
+        setTokens(accessToken: string): void;
+        clearTokens(): void;
+        onTokensChanged(listener: (accessToken: string | null) => void): () => void;
+        _cachedUserId: string | null | undefined;
+        _cachedAccessToken: string | null;
+        getCurrentUserId(): string | null;
+        hasValidToken(): boolean;
+        getAccessToken(): string | null;
+        getAccessTokenExpiry(): number | null;
+        setActingAs(userId: string | null): void;
+        getActingAs(): string | null;
+        waitForAuth(timeoutMs?: number): Promise<boolean>;
+        withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
+            maxRetries?: number;
+            retryDelay?: number;
+            authTimeoutMs?: number;
+        }): Promise<T_1>;
+        validate(): Promise<boolean>;
+        handleError(error: unknown): Error;
+        healthCheck(): Promise<{
+            status: string;
+            users?: number;
+            timestamp?: string;
+            [key: string]: any;
+        }>;
+    };
+} & T;

package/dist/types/mixins/OxyServices.utility.d.ts

@@ -1,8 +1,10 @@
 import type { ApiError, User } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
 /**
- * Result from the managed-accounts verification endpoint.
- * Indicates whether a user is authorized to act as a given managed account.
+ * Result from the account acting-as verification endpoint
+ * (`GET /accounts/verify-acting-as`). Indicates whether a user is authorized to
+ * act as a given account. The `account:act_as` capability is granted only to the
+ * `owner`, `admin`, and `editor` account roles.
  */
 interface ActingAsVerification {
     authorized: boolean;
@@ -91,7 +93,8 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
             expiresAt: number;
         }>;
         /**
-         * Verify that a user is authorized to act as a managed account.
+         * Verify that a user is authorized to act as an account (direct membership
+         * or inherited via an ancestor). Backed by `GET /accounts/verify-acting-as`.
          * Results are cached in-memory for 5 minutes to avoid repeated API calls.
          *
          * @internal Used by the auth() middleware — not part of the public API

package/dist/types/mixins/index.d.ts

@@ -17,8 +17,8 @@ import { OxyServicesLanguageMixin } from './OxyServices.language';
 import { OxyServicesPaymentMixin } from './OxyServices.payment';
 import { OxyServicesReputationMixin } from './OxyServices.reputation';
 import { OxyServicesAssetsMixin } from './OxyServices.assets';
-import { OxyServicesApplicationsMixin } from './OxyServices.applications';
-import { OxyServicesWorkspacesMixin } from './OxyServices.workspaces';
+import { OxyServicesAccountsMixin } from './OxyServices.accounts';
+import { OxyServicesConnectedAppsMixin } from './OxyServices.connectedApps';
 import { OxyServicesLocationMixin } from './OxyServices.location';
 import { OxyServicesAnalyticsMixin } from './OxyServices.analytics';
 import { OxyServicesDevicesMixin } from './OxyServices.devices';
@@ -26,7 +26,6 @@ import { OxyServicesSecurityMixin } from './OxyServices.security';
 import { OxyServicesUtilityMixin } from './OxyServices.utility';
 import { OxyServicesFeaturesMixin } from './OxyServices.features';
 import { OxyServicesTopicsMixin } from './OxyServices.topics';
-import { OxyServicesManagedAccountsMixin } from './OxyServices.managedAccounts';
 import { OxyServicesContactsMixin } from './OxyServices.contacts';
 import { OxyServicesAppDataMixin } from './OxyServices.appData';
 import { OxyServicesCivicMixin } from './OxyServices.civic';
@@ -41,7 +40,7 @@ import { OxyServicesLinksMixin } from './OxyServices.links';
  * If you add a new mixin to `MIXIN_PIPELINE`, add it here too so its methods
  * are visible without a cast.
  */
-type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFedCMMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSilentAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesRedirectAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSsoMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesApplicationsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesWorkspacesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesManagedAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLinksMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
+type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFedCMMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSilentAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesRedirectAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSsoMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLinksMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
 /**
  * Constructor type for the fully composed mixin pipeline. Each mixin returns
  * a new constructor that augments its input; reducing across the pipeline

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "3.18.1",
+  "version": "4.0.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/OxyServices.ts

@@ -85,8 +85,9 @@ import { composeOxyServices } from './mixins';
  * - **Payment**: Payment processing
  * - **Reputation**: Reputation system (Oxy Trust)
  * - **Assets**: File upload and asset management
- * - **Applications**: Application, membership, and credential management
- * - **Workspaces**: Workspace and membership management
+ * - **Accounts**: Unified account graph (tree, members, roles, bot credentials)
+ *   and the applications owned within it (Application = OAuth client)
+ * - **Connected apps**: OAuth-consent surface (public app identity, grants)
  * - **Location**: Location-based features
  * - **Analytics**: Analytics tracking
  * - **Devices**: Device management

package/src/index.ts

@@ -63,11 +63,6 @@ export type {
     CommonsSignInActionResult,
 } from './mixins/OxyServices.auth';
 export type { ServiceApp, ServiceActingAsVerification } from './mixins/OxyServices.utility';
-export type {
-    CreateManagedAccountInput,
-    ManagedAccountManager,
-    ManagedAccount,
-} from './mixins/OxyServices.managedAccounts';
 export type {
     ContactDiscoveryMatch,
     ContactDiscoveryResponse,
@@ -97,26 +92,49 @@ export { normalizeProfileLinks } from './utils/profileLinks';
 export type { ProfileLink, ProfileLinkMetadata } from './utils/profileLinks';
 
 // ---------------------------------------------------------------------------
-// Applications (multi-user apps: membership, roles, credentials)
+// Connected apps (OAuth consent: public app identity + authorized-app grants)
 // ---------------------------------------------------------------------------
 export type {
-    Application,
     PublicApplication,
     ConnectedApp,
-    ApplicationMember,
-    ApplicationCredential,
-    ApplicationRole,
+} from './mixins/OxyServices.connectedApps';
+
+// ---------------------------------------------------------------------------
+// Accounts (unified account graph: tree, membership, roles, bot credentials)
+// plus the applications owned within it (Application = OAuth client).
+// ---------------------------------------------------------------------------
+export type {
+    AccountKind,
+    AccountRelationship,
+    AccountRole,
+    AccountMemberStatus,
+    AccountMemberSource,
+    AccountMember,
+    AccountNode,
+    AccountCredentialType,
+    AccountCredentialEnvironment,
+    AccountCredentialStatus,
+    AccountCredential,
+    AccountCredentialWithSecret,
+    RotateAccountCredentialResult,
+    ListAccountsOptions,
+    CreateAccountInput,
+    UpdateAccountInput,
+    InviteAccountMemberInput,
+    UpdateAccountMemberInput,
+    TransferAccountOwnershipInput,
+    CreateAccountCredentialInput,
+    AccountSuccessResult,
+    // Applications owned within the account graph (Application = OAuth client).
+    Application,
     ApplicationType,
     ApplicationStatus,
-    ApplicationMemberStatus,
+    ApplicationCredential,
     ApplicationCredentialType,
     ApplicationCredentialStatus,
     ApplicationEnvironment,
     CreateApplicationInput,
     UpdateApplicationInput,
-    InviteApplicationMemberInput,
-    UpdateApplicationMemberInput,
-    TransferApplicationOwnershipInput,
     CreateApplicationCredentialInput,
     ApplicationCredentialWithSecret,
     RotateApplicationCredentialResult,
@@ -125,26 +143,7 @@ export type {
     ApplicationUsageByDay,
     ApplicationUsageByEndpoint,
     ApplicationUsageStats,
-    ApplicationSuccessResult,
-} from './mixins/OxyServices.applications';
-
-// ---------------------------------------------------------------------------
-// Workspaces (multi-user containers: membership, roles)
-// ---------------------------------------------------------------------------
-export type {
-    Workspace,
-    WorkspaceMember,
-    WorkspaceRole,
-    WorkspaceType,
-    WorkspaceStatus,
-    WorkspaceMemberStatus,
-    CreateWorkspaceInput,
-    UpdateWorkspaceInput,
-    InviteWorkspaceMemberInput,
-    UpdateWorkspaceMemberInput,
-    TransferWorkspaceOwnershipInput,
-    WorkspaceSuccessResult,
-} from './mixins/OxyServices.workspaces';
+} from './mixins/OxyServices.accounts';
 
 // ---------------------------------------------------------------------------
 // Reputation (Oxy Trust: ledger, balances, disputes, rules, influence)