@oxyhq/core 3.18.1 → 4.0.1

package/src/mixins/OxyServices.applications.ts

@@ -1,773 +0,0 @@
-/**
- * Applications Methods Mixin
- *
- * Provides methods for managing Oxy applications, their members, and their
- * credentials via the `/applications` API. An application is a multi-user
- * entity: membership (with a role) grants permissions; credentials
- * (public/confidential/service) carry OAuth client identifiers and the
- * service-token API key material.
- *
- * Reference applications by their Mongo `_id` (`applicationId`) and credentials
- * by their `credentialId`. Never by name.
- */
-import type { OxyServicesBase } from '../OxyServices.base';
-import { CACHE_TIMES } from './mixinHelpers';
-
-/**
- * Application classification. Set only by Oxy platform staff — never editable
- * through the normal member-facing update path.
- */
-export type ApplicationType = 'first_party' | 'third_party' | 'internal' | 'system';
-
-/** Lifecycle status of an application. */
-export type ApplicationStatus = 'active' | 'suspended' | 'deleted' | 'pending_review';
-
-/** Role a member holds within an application. */
-export type ApplicationRole = 'owner' | 'admin' | 'developer' | 'viewer' | 'billing';
-
-/** Membership lifecycle status. */
-export type ApplicationMemberStatus = 'active' | 'invited' | 'removed';
-
-/** Credential kind. `service` credentials mint service tokens. */
-export type ApplicationCredentialType = 'public' | 'confidential' | 'service';
-
-/** Deployment environment a credential is scoped to. */
-export type ApplicationEnvironment = 'development' | 'staging' | 'production';
-
-/** Credential lifecycle status. */
-export type ApplicationCredentialStatus = 'active' | 'deprecated' | 'revoked';
-
-/**
- * Client-facing Application shape returned by the `/applications` API.
- * Mirrors the server `Application` model with `_id` as a string and dates
- * serialized to ISO strings.
- */
-export interface Application {
-  _id: string;
-  name: string;
-  description?: string;
-  websiteUrl?: string;
-  icon?: string;
-  type: ApplicationType;
-  status: ApplicationStatus;
-  isOfficial: boolean;
-  isInternal: boolean;
-  capabilities: string[];
-  redirectUris: string[];
-  scopes: string[];
-  webhookUrl?: string;
-  devWebhookUrl?: string;
-  createdByUserId: string;
-  /**
-   * The workspace this application belongs to (workspace `_id`), or `null` for
-   * applications not owned by a workspace. Used by the console to scope apps to
-   * a workspace and to branch on workspace-derived access.
-   */
-  workspaceId: string | null;
-  createdAt: string;
-  updatedAt: string;
-  /**
-   * The calling user's own membership in this application, embedded by the API
-   * on list (`GET /applications`) and detail (`GET /applications/:appId`)
-   * responses. Use `callerMembership.permissions` to gate UI affordances.
-   *
-   * When the caller's access is derived from a workspace membership rather than
-   * a direct application membership, the API returns a synthetic membership
-   * with `source: 'workspace'` and `_id: null`.
-   */
-  callerMembership?: ApplicationMember;
-}
-
-/**
- * Client-facing ApplicationMember shape. `permissions` is derived from `role`
- * on the server at write time.
- */
-export interface ApplicationMember {
-  /**
-   * The membership's Mongo `_id`. `null` for a synthetic, workspace-derived
-   * membership (see {@link Application.callerMembership} and `source`).
-   */
-  _id: string | null;
-  applicationId: string;
-  userId: string;
-  role: ApplicationRole;
-  permissions: string[];
-  invitedByUserId?: string;
-  joinedAt?: string;
-  status: ApplicationMemberStatus;
-  /**
-   * Origin of this membership. When `'workspace'`, the membership is synthetic
-   * and derived from the caller's workspace membership rather than a direct
-   * application membership (in which case `_id` is `null`). Absent or any other
-   * value indicates a direct application membership.
-   */
-  source?: 'workspace';
-  createdAt: string;
-  updatedAt: string;
-}
-
-/**
- * Client-facing ApplicationCredential shape. The raw secret is NEVER part of
- * this shape — it is returned exactly once, separately, at creation/rotation.
- */
-export interface ApplicationCredential {
-  _id: string;
-  applicationId: string;
-  name: string;
-  publicKey: string;
-  type: ApplicationCredentialType;
-  environment: ApplicationEnvironment;
-  scopes: string[];
-  status: ApplicationCredentialStatus;
-  lastUsedAt?: string;
-  expiresAt?: string;
-  /**
-   * Audit link to the credential this one was rotated FROM. Populated by the
-   * API on credentials created via rotation; absent on original credentials.
-   */
-  rotatedFromCredentialId?: string;
-  createdByUserId: string;
-  createdAt: string;
-  updatedAt: string;
-}
-
-/**
- * Sanitized, PUBLIC application identity returned by the API when resolving a
- * cross-app/OAuth client to a registered {@link Application}.
- *
- * Unlike {@link Application}, this shape carries NO sensitive or membership
- * fields — it is safe to display unauthenticated in consent/authorize screens
- * and device-flow approval UIs. The API resolves a `client_id` (OAuth
- * credential public key) to the owning application and projects only the
- * fields below. `id` is the application's `_id` as a string.
- */
-export interface PublicApplication {
-  /** The application's Mongo `_id` as a string. */
-  id: string;
-  /** Human-readable application name shown to the user. */
-  name: string;
-  /** Optional short description of what the application does. */
-  description?: string;
-  /** Optional icon URL for the application. */
-  icon?: string;
-  /** Optional public website/homepage URL for the application. */
-  websiteUrl?: string;
-  /** Application classification (set by Oxy platform staff). */
-  type: ApplicationType;
-  /** Whether the application is an officially endorsed Oxy application. */
-  isOfficial: boolean;
-  /** Whether the application is an internal Oxy ecosystem application. */
-  isInternal: boolean;
-  /** OAuth scopes the application is configured to request. */
-  scopes: string[];
-  /** Optional display name of the developer/owner organisation. */
-  developerName?: string;
-}
-
-/**
- * A connected (OAuth-authorized) application from the current user's point of
- * view: an application the user has granted access to via the consent flow.
- *
- * Returned by `GET /auth/grants` and rendered in the user-facing "Connected
- * apps" management surface. Keyed by `applicationId` (the application's Mongo
- * `_id`) rather than a credential/client id, so the grant — and a subsequent
- * {@link OxyServicesApplicationsMixin.revokeAppGrant} — survive credential
- * rotation. This is a display shape: it carries the application's name/logo and
- * the granted scopes, never any membership or credential material.
- */
-export interface ConnectedApp {
-  /** The connected application's Mongo `_id`. Use this to revoke the grant. */
-  applicationId: string;
-  /** Human-readable application name shown to the user. */
-  name: string;
-  /** Optional logo URL for the application. */
-  logoUrl?: string;
-  /** OAuth scopes the user has granted to the application. */
-  scopes: string[];
-  /** ISO timestamp of when the user first authorized the application. */
-  firstGrantedAt: string;
-  /** ISO timestamp of when the grant was last exercised. */
-  lastUsedAt: string;
-}
-
-/** Input accepted by `createApplication`. Staff-only fields are not settable here. */
-export interface CreateApplicationInput {
-  name: string;
-  description?: string;
-  websiteUrl?: string;
-  icon?: string;
-  redirectUris?: string[];
-  scopes?: string[];
-  /**
-   * Optional workspace `_id` to create the app in. Omitted → API defaults to
-   * the caller's personal workspace.
-   */
-  workspaceId?: string;
-}
-
-/** Input accepted by `updateApplication`. Staff-only fields are not settable here. */
-export interface UpdateApplicationInput {
-  name?: string;
-  description?: string;
-  websiteUrl?: string;
-  icon?: string;
-  redirectUris?: string[];
-  scopes?: string[];
-  webhookUrl?: string;
-  devWebhookUrl?: string;
-  status?: ApplicationStatus;
-}
-
-/** Input accepted by `inviteApplicationMember`. The owner role cannot be invited. */
-export interface InviteApplicationMemberInput {
-  /**
-   * The username or email of the user to invite. Resolved to a user server-side;
-   * an unknown value yields a 404 "User not found".
-   */
-  usernameOrEmail: string;
-  role: Exclude<ApplicationRole, 'owner'>;
-}
-
-/** Input accepted by `updateApplicationMember`. */
-export interface UpdateApplicationMemberInput {
-  role: ApplicationRole;
-}
-
-/** Input accepted by `transferApplicationOwnership`. */
-export interface TransferApplicationOwnershipInput {
-  userId: string;
-}
-
-/** Input accepted by `createApplicationCredential`. */
-export interface CreateApplicationCredentialInput {
-  name: string;
-  type: ApplicationCredentialType;
-  environment: ApplicationEnvironment;
-  scopes?: string[];
-}
-
-/** Result of creating a credential — `secret` is returned ONCE. */
-export interface ApplicationCredentialWithSecret {
-  credential: ApplicationCredential;
-  secret: string;
-}
-
-/**
- * Result of rotating a credential. Extends the create result with audit fields:
- * the new plaintext `secret` is returned ONCE, plus `rotatedFrom` (the previous
- * credential's `credentialId`) and `graceExpiresAt` (ISO string marking when the
- * old credential stops being honoured during the rotation grace window).
- */
-export interface RotateApplicationCredentialResult extends ApplicationCredentialWithSecret {
-  /** The previous credential's `credentialId` that this rotation supersedes. */
-  rotatedFrom: string;
-  /** ISO timestamp at which the rotated-from credential's grace window ends. */
-  graceExpiresAt: string;
-}
-
-/** Time window for application usage statistics. */
-export type ApplicationUsagePeriod = '24h' | '7d' | '30d' | '90d';
-
-/** Aggregate totals for an application over the requested period. */
-export interface ApplicationUsageSummary {
-  totalRequests: number;
-  totalTokens: number;
-  totalCredits: number;
-  avgResponseTime: number;
-  successfulRequests: number;
-  errorRequests: number;
-}
-
-/** Per-day usage bucket. `_id` is the day key (e.g. `YYYY-MM-DD`). */
-export interface ApplicationUsageByDay {
-  _id: string;
-  requests: number;
-  tokens: number;
-  credits: number;
-}
-
-/** Per-endpoint usage bucket. `_id` is the endpoint identifier. */
-export interface ApplicationUsageByEndpoint {
-  _id: string;
-  requests: number;
-  tokens: number;
-}
-
-/** Usage statistics for an application over a period. */
-export interface ApplicationUsageStats {
-  summary: ApplicationUsageSummary;
-  byDay: ApplicationUsageByDay[];
-  byEndpoint: ApplicationUsageByEndpoint[];
-}
-
-/** Result of a delete/remove/revoke/transfer operation. */
-export interface ApplicationSuccessResult {
-  success: boolean;
-}
-
-export function OxyServicesApplicationsMixin<T extends typeof OxyServicesBase>(Base: T) {
-  return class extends Base {
-    constructor(...args: any[]) {
-      super(...(args as [any]));
-    }
-
-    /**
-     * Resolve an OAuth client identifier to the owning application's PUBLIC
-     * identity. No authentication required — the API returns only sanitized,
-     * display-safe metadata ({@link PublicApplication}). Use this to render the
-     * requesting application's name/icon in consent, authorize, and device-flow
-     * approval UIs before any session exists.
-     *
-     * @param clientId - The OAuth `client_id` (an active credential's public
-     *   key). URL-encoded before being placed in the path.
-     */
-    async getPublicApplication(clientId: string): Promise<PublicApplication> {
-      try {
-        const res = await this.makeRequest<{ application: PublicApplication }>(
-          'GET',
-          `/auth/oauth/client/${encodeURIComponent(clientId)}`,
-          undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.MEDIUM },
-        );
-        return res.application;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * List the OAuth-authorized applications the current user has connected —
-     * the third-party apps the user granted access to via the consent flow.
-     * Each entry is a {@link ConnectedApp} carrying the application's display
-     * identity, the granted scopes, and when the grant was first made and last
-     * exercised. Requires an authenticated session.
-     *
-     * Backed by `GET /auth/grants`. The response is briefly cached
-     * (identity-scoped); {@link revokeAppGrant} busts that cache so a revoke is
-     * reflected on the next read.
-     */
-    async listConnectedApps(): Promise<ConnectedApp[]> {
-      try {
-        return await this.makeRequest<ConnectedApp[]>(
-          'GET',
-          '/auth/grants',
-          undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.SHORT },
-        );
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Revoke the current user's grant for a connected application, identified by
-     * its application `_id` (a {@link ConnectedApp.applicationId}, NOT a
-     * credential/client id — keyed by application so the revocation survives
-     * credential rotation). After this the application can no longer act on the
-     * user's behalf until it is re-authorized.
-     *
-     * Backed by `DELETE /auth/grants/:applicationId`. On success the cached
-     * connected-apps list (`GET:/auth/grants`) is invalidated so the next
-     * {@link listConnectedApps} read reflects the removal.
-     *
-     * @param applicationId - The connected application's Mongo `_id`.
-     */
-    async revokeAppGrant(applicationId: string): Promise<void> {
-      try {
-        await this.makeRequest<{ revoked: boolean }>(
-          'DELETE',
-          `/auth/grants/${applicationId}`,
-          undefined,
-          { cache: false },
-        );
-        // A revoke removes an entry from the user's connected-apps list; bust
-        // the cached `GET /auth/grants` so the next read re-fetches.
-        this.clearCacheEntry('GET:/auth/grants');
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * List applications the current user is an active member of.
-     *
-     * @param workspaceId - Optional workspace `_id` to scope the listing to
-     *   applications belonging to that workspace. When provided it is appended
-     *   as a `workspaceId` query parameter (URL-encoded). The query string is
-     *   part of the request path, so the response cache keys on it
-     *   automatically — scoped and unscoped lists never collide.
-     */
-    async getApplications(workspaceId?: string): Promise<Application[]> {
-      try {
-        const path = workspaceId
-          ? `/applications?workspaceId=${encodeURIComponent(workspaceId)}`
-          : '/applications';
-        const res = await this.makeRequest<{ applications?: Application[] }>(
-          'GET',
-          path,
-          undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.MEDIUM },
-        );
-        return res.applications ?? [];
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Create a new application. The caller becomes its `owner`.
-     * @param data - Application configuration. Staff-only fields are ignored.
-     */
-    async createApplication(data: CreateApplicationInput): Promise<Application> {
-      try {
-        const res = await this.makeRequest<{ application: Application }>(
-          'POST',
-          '/applications',
-          data,
-          { cache: false },
-        );
-        // Bust every cached application list (unscoped + per-workspace) so the
-        // new application appears on the next `getApplications()` read.
-        this._invalidateApplicationLists();
-        return res.application;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Fetch a single application by id.
-     * @param applicationId - The application's Mongo `_id`.
-     */
-    async getApplication(applicationId: string): Promise<Application> {
-      try {
-        const res = await this.makeRequest<{ application: Application }>(
-          'GET',
-          `/applications/${applicationId}`,
-          undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.LONG },
-        );
-        return res.application;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Update an application's mutable fields.
-     * @param applicationId - The application's Mongo `_id`.
-     * @param data - Subset of updatable fields. Staff-only fields are ignored.
-     */
-    async updateApplication(
-      applicationId: string,
-      data: UpdateApplicationInput,
-    ): Promise<Application> {
-      try {
-        const res = await this.makeRequest<{ application: Application }>(
-          'PATCH',
-          `/applications/${applicationId}`,
-          data,
-          { cache: false },
-        );
-        // Bust the cached detail and every list (which embeds application
-        // fields) so neither serves the pre-update snapshot.
-        this.clearCacheEntry(`GET:/applications/${applicationId}`);
-        this._invalidateApplicationLists();
-        return res.application;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Soft-delete an application (owner only).
-     * @param applicationId - The application's Mongo `_id`.
-     */
-    async deleteApplication(applicationId: string): Promise<ApplicationSuccessResult> {
-      try {
-        const result = await this.makeRequest<ApplicationSuccessResult>(
-          'DELETE',
-          `/applications/${applicationId}`,
-          undefined,
-          { cache: false },
-        );
-        // Bust every cached representation of the deleted application.
-        this.clearCacheEntry(`GET:/applications/${applicationId}`);
-        this.clearCacheEntry(`GET:/applications/${applicationId}/members`);
-        this.clearCacheEntry(`GET:/applications/${applicationId}/credentials`);
-        this._invalidateApplicationLists();
-        return result;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * List members of an application.
-     * @param applicationId - The application's Mongo `_id`.
-     */
-    async getApplicationMembers(applicationId: string): Promise<ApplicationMember[]> {
-      try {
-        const res = await this.makeRequest<{ members?: ApplicationMember[] }>(
-          'GET',
-          `/applications/${applicationId}/members`,
-          undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.MEDIUM },
-        );
-        return res.members ?? [];
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Add a member to an application.
-     * @param applicationId - The application's Mongo `_id`.
-     * @param data - Target user's username or email and role (never `owner`).
-     *   The server resolves `usernameOrEmail` to a user; an unknown value yields
-     *   a 404 "User not found".
-     */
-    async inviteApplicationMember(
-      applicationId: string,
-      data: InviteApplicationMemberInput,
-    ): Promise<ApplicationMember> {
-      try {
-        const res = await this.makeRequest<{ member: ApplicationMember }>(
-          'POST',
-          `/applications/${applicationId}/members`,
-          data,
-          { cache: false },
-        );
-        this._invalidateApplicationMembership(applicationId);
-        return res.member;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Change a member's role.
-     * @param applicationId - The application's Mongo `_id`.
-     * @param memberId - The member's Mongo `_id`.
-     * @param data - New role.
-     */
-    async updateApplicationMember(
-      applicationId: string,
-      memberId: string,
-      data: UpdateApplicationMemberInput,
-    ): Promise<ApplicationMember> {
-      try {
-        const res = await this.makeRequest<{ member: ApplicationMember }>(
-          'PATCH',
-          `/applications/${applicationId}/members/${memberId}`,
-          data,
-          { cache: false },
-        );
-        this._invalidateApplicationMembership(applicationId);
-        return res.member;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Remove a member from an application.
-     * @param applicationId - The application's Mongo `_id`.
-     * @param memberId - The member's Mongo `_id`.
-     */
-    async removeApplicationMember(
-      applicationId: string,
-      memberId: string,
-    ): Promise<ApplicationSuccessResult> {
-      try {
-        const result = await this.makeRequest<ApplicationSuccessResult>(
-          'DELETE',
-          `/applications/${applicationId}/members/${memberId}`,
-          undefined,
-          { cache: false },
-        );
-        this._invalidateApplicationMembership(applicationId);
-        return result;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Transfer ownership of an application to another member (owner only).
-     * Demotes the current owner to `admin` and promotes the target to `owner`.
-     * @param applicationId - The application's Mongo `_id`.
-     * @param data - Target user id.
-     */
-    async transferApplicationOwnership(
-      applicationId: string,
-      data: TransferApplicationOwnershipInput,
-    ): Promise<ApplicationSuccessResult> {
-      try {
-        const result = await this.makeRequest<ApplicationSuccessResult>(
-          'POST',
-          `/applications/${applicationId}/transfer-ownership`,
-          data,
-          { cache: false },
-        );
-        // Ownership change alters roles in the member list AND the detail, and
-        // can change which applications the caller "owns" in the list view.
-        this._invalidateApplicationMembership(applicationId);
-        this._invalidateApplicationLists();
-        return result;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * List an application's credentials. The response NEVER includes secrets.
-     * @param applicationId - The application's Mongo `_id`.
-     */
-    async getApplicationCredentials(applicationId: string): Promise<ApplicationCredential[]> {
-      try {
-        const res = await this.makeRequest<{ credentials?: ApplicationCredential[] }>(
-          'GET',
-          `/applications/${applicationId}/credentials`,
-          undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.MEDIUM },
-        );
-        return res.credentials ?? [];
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Create a credential. The plaintext `secret` is returned exactly ONCE;
-     * the server stores only a hash and will never return it again.
-     * @param applicationId - The application's Mongo `_id`.
-     * @param data - Credential configuration.
-     */
-    async createApplicationCredential(
-      applicationId: string,
-      data: CreateApplicationCredentialInput,
-    ): Promise<ApplicationCredentialWithSecret> {
-      try {
-        const result = await this.makeRequest<ApplicationCredentialWithSecret>(
-          'POST',
-          `/applications/${applicationId}/credentials`,
-          data,
-          { cache: false },
-        );
-        this.clearCacheEntry(`GET:/applications/${applicationId}/credentials`);
-        return result;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Rotate a credential's secret. The new plaintext `secret` is returned
-     * exactly ONCE, along with audit fields: `rotatedFrom` (the previous
-     * credentialId) and `graceExpiresAt` (ISO string for the grace window during
-     * which the old credential is still honoured).
-     * @param applicationId - The application's Mongo `_id`.
-     * @param credentialId - The credential's Mongo `_id`.
-     */
-    async rotateApplicationCredential(
-      applicationId: string,
-      credentialId: string,
-    ): Promise<RotateApplicationCredentialResult> {
-      try {
-        const result = await this.makeRequest<RotateApplicationCredentialResult>(
-          'POST',
-          `/applications/${applicationId}/credentials/${credentialId}/rotate`,
-          undefined,
-          { cache: false },
-        );
-        // Rotation changes credential status/audit fields surfaced by the
-        // credentials list (`rotatedFrom`, grace window, new active credential).
-        this.clearCacheEntry(`GET:/applications/${applicationId}/credentials`);
-        return result;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Revoke a credential (`status='revoked'`). Revoked credentials can no
-     * longer authenticate.
-     * @param applicationId - The application's Mongo `_id`.
-     * @param credentialId - The credential's Mongo `_id`.
-     */
-    async revokeApplicationCredential(
-      applicationId: string,
-      credentialId: string,
-    ): Promise<ApplicationSuccessResult> {
-      try {
-        const result = await this.makeRequest<ApplicationSuccessResult>(
-          'DELETE',
-          `/applications/${applicationId}/credentials/${credentialId}`,
-          undefined,
-          { cache: false },
-        );
-        // Revocation flips the credential's status in the cached list.
-        this.clearCacheEntry(`GET:/applications/${applicationId}/credentials`);
-        return result;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Fetch usage statistics for an application.
-     * @param applicationId - The application's Mongo `_id`.
-     * @param period - Time window (defaults to the server default).
-     */
-    async getApplicationUsage(
-      applicationId: string,
-      period?: ApplicationUsagePeriod,
-    ): Promise<ApplicationUsageStats> {
-      try {
-        return await this.makeRequest<ApplicationUsageStats>(
-          'GET',
-          `/applications/${applicationId}/usage`,
-          period ? { period } : undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.SHORT },
-        );
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Bust every cached application list. `getApplications(workspaceId?)` keys
-     * the unscoped list as `GET:/applications` and each workspace-scoped list as
-     * `GET:/applications?workspaceId=<id>` (the query string is part of the URL
-     * path). A change to list membership (create/delete/ownership transfer)
-     * invalidates all of them, so we clear the unscoped entry plus every
-     * `?workspaceId=` variant via a prefix sweep. The prefix `GET:/applications?`
-     * matches only the query-string list variants, never the `GET:/applications/<id>…`
-     * detail/sub-resource keys.
-     *
-     * Internal helper (leading underscore); not part of the supported public
-     * surface. Public rather than `private` because mixins compose into an
-     * exported anonymous class, where TypeScript cannot represent a private
-     * member in the emitted declaration file (TS4094).
-     */
-    _invalidateApplicationLists(): void {
-      this.clearCacheEntry('GET:/applications');
-      this.clearCacheByPrefix('GET:/applications?');
-    }
-
-    /**
-     * Bust the cached member list and detail for an application after a
-     * membership mutation. The member list (`getApplicationMembers`) and the
-     * detail (`getApplication`, which can embed member counts) both go stale
-     * when the member set or a member's role changes.
-     *
-     * Internal helper (leading underscore); see `_invalidateApplicationLists`
-     * for why this is public rather than `private`.
-     */
-    _invalidateApplicationMembership(applicationId: string): void {
-      this.clearCacheEntry(`GET:/applications/${applicationId}/members`);
-      this.clearCacheEntry(`GET:/applications/${applicationId}`);
-    }
-  };
-}