@kinotic-ai/os-api 1.6.0 → 1.7.0

package/dist/index.cjs

@@ -349,7 +349,7 @@ class NamedQueriesDefinition {
   projectId;
   entityDefinitionName;
   namedQueries;
-  constructor(organizationId, id, applicationId, projectId, entityDefinitionName, namedQueries) {
+  constructor(id, organizationId, applicationId, projectId, entityDefinitionName, namedQueries) {
     this.id = id;
     this.organizationId = organizationId;
     this.applicationId = applicationId;
@@ -449,8 +449,8 @@ class IamUser {
   authType = null;
   oidcSubject = null;
   oidcConfigId = null;
-  authScopeType = "";
-  authScopeId = "";
+  organizationId = null;
+  applicationId = null;
   tenantId = null;
   enabled = true;
   created = null;
@@ -714,25 +714,22 @@ var import_core8 = require("@kinotic-ai/core");
 
 class IamUserService extends import_core8.CrudServiceProxy {
   constructor(kinotic) {
-    super(kinotic.serviceProxy("org.kinotic.os.api.services.iam.IamUserService"));
+    super(kinotic.serviceProxy("org.kinotic.domain.api.services.iam.IamUserService"));
   }
-  findByEmailAndScope(email, authScopeType, authScopeId) {
-    return this.serviceProxy.invoke("findByEmailAndScope", [email, authScopeType, authScopeId]);
+  findByEmail(email, organizationId, applicationId) {
+    return arguments.length >= 3 ? this.serviceProxy.invoke("findByEmail", [email, organizationId, applicationId]) : this.serviceProxy.invoke("findByEmail", [email]);
   }
-  findByScope(authScopeType, authScopeId, pageable) {
-    return this.serviceProxy.invoke("findByScope", [authScopeType, authScopeId, pageable]);
+  findFirstOrgUserByEmail(email) {
+    return this.serviceProxy.invoke("findFirstOrgUserByEmail", [email]);
   }
-  createUser(user, password) {
-    return this.serviceProxy.invoke("createUser", [user, password]);
-  }
-  changePassword(userId, currentPassword, newPassword) {
-    return this.serviceProxy.invoke("changePassword", [userId, currentPassword, newPassword]);
+  findByOidcIdentity(oidcSubject, oidcConfigId, organizationId, applicationId) {
+    return this.serviceProxy.invoke("findByOidcIdentity", [oidcSubject, oidcConfigId, organizationId, applicationId]);
   }
-  resetPassword(userId, newPassword) {
-    return this.serviceProxy.invoke("resetPassword", [userId, newPassword]);
+  findAllByOidcIdentity(oidcSubject, oidcConfigId) {
+    return this.serviceProxy.invoke("findAllByOidcIdentity", [oidcSubject, oidcConfigId]);
   }
-  findFirstByEmailInScopeType(email, authScopeType) {
-    return this.serviceProxy.invoke("findFirstByEmailInScopeType", [email, authScopeType]);
+  createUser(user, password) {
+    return this.serviceProxy.invoke("createUser", [user, password]);
   }
 }
 // packages/os-api/src/api/services/IDeviceApprovalService.ts

package/dist/index.d.cts

@@ -261,7 +261,7 @@ declare class NamedQueriesDefinition implements Identifiable5<string> {
 	projectId: string;
 	entityDefinitionName: string;
 	namedQueries: FunctionDefinition[];
-	constructor(organizationId: string, id: string, applicationId: string, projectId: string, entityDefinitionName: string, namedQueries: FunctionDefinition[]);
+	constructor(id: string, organizationId: string, applicationId: string, projectId: string, entityDefinitionName: string, namedQueries: FunctionDefinition[]);
 }
 /**
 * Represents a migration definition that can be sent via the API.
@@ -533,12 +533,12 @@ declare enum AuthType {
 }
 import { Identifiable as Identifiable8 } from "@kinotic-ai/core";
 /**
-* Represents an authenticated identity at any scope layer in the IAM system.
-* Each user is scoped to exactly one layer and is unique by email within that scope.
+* Represents an authenticated identity in the IAM system. Scope is encoded structurally by
+* which of {@link organizationId} / {@link applicationId} is set:
 *
-* - For SYSTEM and ORGANIZATION scopes, {@link tenantId} must be null.
-* - For APPLICATION scopes, {@link tenantId} is required and identifies the
-*   client tenant the user belongs to within the application's data.
+* - both null → SYSTEM
+* - {@link organizationId} only → ORGANIZATION
+* - both set → APPLICATION, with {@link tenantId} identifying the end-user data slice
 */
 declare class IamUser implements Identifiable8<string> {
 	id: string | null;
@@ -547,39 +547,42 @@ declare class IamUser implements Identifiable8<string> {
 	authType: AuthType | null;
 	oidcSubject: string | null;
 	oidcConfigId: string | null;
-	authScopeType: string;
-	authScopeId: string;
+	organizationId: string | null;
+	applicationId: string | null;
 	tenantId: string | null;
 	enabled: boolean;
 	created: number | null;
 	updated: number | null;
 }
 /**
-* Sent to the server to initiate an organization sign-up.
-* The user provides {@link orgName}, {@link orgDescription}, {@link email}, and
-* {@link displayName}. The remaining fields ({@link id}, {@link verificationToken},
-* {@link expiresAt}, {@link created}) are populated by the server before the record
-* is persisted.
+* Sent to {@code POST /api/signup} to start an email/password organization sign-up.
+* Only the user's identity is collected up front; the organization name and password are
+* provided after email verification (see {@link SignUpCompleteRequest}).
 */
 interface SignUpRequest {
-	id?: string | null;
-	verificationToken?: string | null;
-	expiresAt?: number | null;
-	created?: number | null;
-	orgName: string;
-	orgDescription?: string | null;
 	email: string;
 	displayName: string;
 }
 /**
-* Sent to the server to complete an organization sign-up after email verification.
-* The {@link token} comes from the verification email link; the {@link password}
-* is what the user enters on the "set your password" form.
+* Sent to {@code POST /api/signup/complete} after the user clicks the verification link.
+* The {@link token} comes from that link; {@link orgName} (with optional {@link orgDescription})
+* names the organization to create, and {@link password} is the chosen account password.
 */
 interface SignUpCompleteRequest {
 	token: string;
+	orgName: string;
+	orgDescription?: string | null;
 	password: string;
 }
+/**
+* Sent to {@code POST /api/signup/complete-org} to finish an OIDC sign-up by naming the
+* organization to create. The verified identity is held server-side, keyed by {@link token}.
+*/
+interface CompleteOrgRequest {
+	token: string;
+	orgName: string;
+	orgDescription?: string | null;
+}
 import { Identifiable as Identifiable9 } from "@kinotic-ai/core";
 /**
 * Persisted record of one GitHub App installation that a Kinotic Org has authorised.
@@ -1012,65 +1015,46 @@ declare class WorkloadServiceProxy extends CrudServiceProxy7<Workload> implement
 	countForNode(nodeId: string): Promise<number>;
 	syncIndex(): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8, Page as Page3, Pageable as Pageable4 } from "@kinotic-ai/core";
+import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+/**
+* Client proxy for the server's {@code IamUserService}; method shapes mirror the Java interface.
+*
+* NOTE: the server interface now lives in {@code kinotic-domain} and is not currently
+* {@code @Publish}-annotated, so this proxy is not callable over RPC until the backend publishes
+* the service. The shape here is kept in sync so it is ready once that happens; confirm the
+* published namespace before relying on it.
+*/
 interface IIamUserService extends ICrudServiceProxy8<IamUser> {
+	/** Finds the first user with the given email across all scopes, or null. */
+	findByEmail(email: string): Promise<IamUser | null>;
 	/**
-	* Finds the user with the given email within the given auth scope.
-	* @param email the email address to look up
-	* @param authScopeType the scope type the user is registered against (e.g. {@code SYSTEM}, {@code ORGANIZATION}, {@code APPLICATION})
-	* @param authScopeId the id of the scope the user is registered against
-	* @return {@link Promise} emitting the matching user, or {@code null} if no user matches
+	* Finds the user with the given email within a scope identified structurally by
+	* (organizationId, applicationId): both null → SYSTEM, organizationId only → ORGANIZATION,
+	* both set → APPLICATION.
 	*/
-	findByEmailAndScope(email: string, authScopeType: string, authScopeId: string): Promise<IamUser | null>;
+	findByEmail(email: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
 	/**
-	* Finds all users registered against the given auth scope.
-	* @param authScopeType the scope type to filter by (e.g. {@code SYSTEM}, {@code ORGANIZATION}, {@code APPLICATION})
-	* @param authScopeId the id of the scope to filter by
-	* @param pageable the paging and sort options
-	* @return {@link Promise} emitting a page of users registered against the scope
+	* Finds the first ORGANIZATION-scope user with the given email across all organizations.
+	* Used by sign-up to enforce one user per email before the new org's id exists.
 	*/
-	findByScope(authScopeType: string, authScopeId: string, pageable: Pageable4): Promise<Page3<IamUser>>;
+	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
 	/**
-	* Creates a user and, if a password is provided, the matching credential.
-	* {@code APPLICATION}-scoped users must carry a {@code tenantId}; {@code SYSTEM} and {@code ORGANIZATION} users must not.
-	* @param user the user to create
-	* @param password the password to set, or {@code null} to create the user without a credential
-	* @return {@link Promise} emitting the persisted user
+	* Finds the user (if any) with the given OIDC identity within a specific scope, using the
+	* same (organizationId, applicationId) null conventions as {@link findByEmail}.
 	*/
+	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	/** Finds every user across scopes for a given OIDC identity — e.g. the orgs it can access. */
+	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
+	/** Creates a user and, if a password is provided, the matching credential. */
 	createUser(user: IamUser, password: string | null): Promise<IamUser>;
-	/**
-	* Verifies the current password and updates it. Used when the user knows their current password.
-	* @param userId the id of the user whose password should be changed
-	* @param currentPassword the user's current password
-	* @param newPassword the new password to set
-	* @return {@link Promise} that resolves when the password has been updated
-	*/
-	changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
-	/**
-	* Replaces the user's password without verifying the current one. Administrative reset.
-	* @param userId the id of the user whose password should be reset
-	* @param newPassword the new password to set
-	* @return {@link Promise} that resolves when the password has been reset
-	*/
-	resetPassword(userId: string, newPassword: string): Promise<void>;
-	/**
-	* Finds the first user with the given email across all scope ids of the given scope type.
-	* Used by the sign-up flow to enforce one user per email at organization-creation time,
-	* before the new organization's scope id exists.
-	* @param email the email address to look up
-	* @param authScopeType the scope type to search within (e.g. {@code ORGANIZATION})
-	* @return {@link Promise} emitting the first matching user, or {@code null} if no user matches
-	*/
-	findFirstByEmailInScopeType(email: string, authScopeType: string): Promise<IamUser | null>;
 }
 declare class IamUserService extends CrudServiceProxy8<IamUser> implements IIamUserService {
 	constructor(kinotic: IKinotic11);
-	findByEmailAndScope(email: string, authScopeType: string, authScopeId: string): Promise<IamUser | null>;
-	findByScope(authScopeType: string, authScopeId: string, pageable: Pageable4): Promise<Page3<IamUser>>;
+	findByEmail(email: string, organizationId?: string | null, applicationId?: string | null): Promise<IamUser | null>;
+	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
+	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
 	createUser(user: IamUser, password: string | null): Promise<IamUser>;
-	changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
-	resetPassword(userId: string, newPassword: string): Promise<void>;
-	findFirstByEmailInScopeType(email: string, authScopeType: string): Promise<IamUser | null>;
 }
 import { IKinotic as IKinotic12 } from "@kinotic-ai/core";
 /**
@@ -1142,4 +1126,4 @@ declare const OsApiPlugin: KinoticPlugin<IOsApiExtension>;
 declare module "@kinotic-ai/core" {
 	interface KinoticSingleton extends IOsApiExtension {}
 }
-export { WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, IProjectService, IOsApiExtension, IOrganizationService, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };
+export { WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, IProjectService, IOsApiExtension, IOrganizationService, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };

package/dist/index.d.ts

@@ -261,7 +261,7 @@ declare class NamedQueriesDefinition implements Identifiable5<string> {
 	projectId: string;
 	entityDefinitionName: string;
 	namedQueries: FunctionDefinition[];
-	constructor(organizationId: string, id: string, applicationId: string, projectId: string, entityDefinitionName: string, namedQueries: FunctionDefinition[]);
+	constructor(id: string, organizationId: string, applicationId: string, projectId: string, entityDefinitionName: string, namedQueries: FunctionDefinition[]);
 }
 /**
 * Represents a migration definition that can be sent via the API.
@@ -533,12 +533,12 @@ declare enum AuthType {
 }
 import { Identifiable as Identifiable8 } from "@kinotic-ai/core";
 /**
-* Represents an authenticated identity at any scope layer in the IAM system.
-* Each user is scoped to exactly one layer and is unique by email within that scope.
+* Represents an authenticated identity in the IAM system. Scope is encoded structurally by
+* which of {@link organizationId} / {@link applicationId} is set:
 *
-* - For SYSTEM and ORGANIZATION scopes, {@link tenantId} must be null.
-* - For APPLICATION scopes, {@link tenantId} is required and identifies the
-*   client tenant the user belongs to within the application's data.
+* - both null → SYSTEM
+* - {@link organizationId} only → ORGANIZATION
+* - both set → APPLICATION, with {@link tenantId} identifying the end-user data slice
 */
 declare class IamUser implements Identifiable8<string> {
 	id: string | null;
@@ -547,39 +547,42 @@ declare class IamUser implements Identifiable8<string> {
 	authType: AuthType | null;
 	oidcSubject: string | null;
 	oidcConfigId: string | null;
-	authScopeType: string;
-	authScopeId: string;
+	organizationId: string | null;
+	applicationId: string | null;
 	tenantId: string | null;
 	enabled: boolean;
 	created: number | null;
 	updated: number | null;
 }
 /**
-* Sent to the server to initiate an organization sign-up.
-* The user provides {@link orgName}, {@link orgDescription}, {@link email}, and
-* {@link displayName}. The remaining fields ({@link id}, {@link verificationToken},
-* {@link expiresAt}, {@link created}) are populated by the server before the record
-* is persisted.
+* Sent to {@code POST /api/signup} to start an email/password organization sign-up.
+* Only the user's identity is collected up front; the organization name and password are
+* provided after email verification (see {@link SignUpCompleteRequest}).
 */
 interface SignUpRequest {
-	id?: string | null;
-	verificationToken?: string | null;
-	expiresAt?: number | null;
-	created?: number | null;
-	orgName: string;
-	orgDescription?: string | null;
 	email: string;
 	displayName: string;
 }
 /**
-* Sent to the server to complete an organization sign-up after email verification.
-* The {@link token} comes from the verification email link; the {@link password}
-* is what the user enters on the "set your password" form.
+* Sent to {@code POST /api/signup/complete} after the user clicks the verification link.
+* The {@link token} comes from that link; {@link orgName} (with optional {@link orgDescription})
+* names the organization to create, and {@link password} is the chosen account password.
 */
 interface SignUpCompleteRequest {
 	token: string;
+	orgName: string;
+	orgDescription?: string | null;
 	password: string;
 }
+/**
+* Sent to {@code POST /api/signup/complete-org} to finish an OIDC sign-up by naming the
+* organization to create. The verified identity is held server-side, keyed by {@link token}.
+*/
+interface CompleteOrgRequest {
+	token: string;
+	orgName: string;
+	orgDescription?: string | null;
+}
 import { Identifiable as Identifiable9 } from "@kinotic-ai/core";
 /**
 * Persisted record of one GitHub App installation that a Kinotic Org has authorised.
@@ -1012,65 +1015,46 @@ declare class WorkloadServiceProxy extends CrudServiceProxy7<Workload> implement
 	countForNode(nodeId: string): Promise<number>;
 	syncIndex(): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8, Page as Page3, Pageable as Pageable4 } from "@kinotic-ai/core";
+import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+/**
+* Client proxy for the server's {@code IamUserService}; method shapes mirror the Java interface.
+*
+* NOTE: the server interface now lives in {@code kinotic-domain} and is not currently
+* {@code @Publish}-annotated, so this proxy is not callable over RPC until the backend publishes
+* the service. The shape here is kept in sync so it is ready once that happens; confirm the
+* published namespace before relying on it.
+*/
 interface IIamUserService extends ICrudServiceProxy8<IamUser> {
+	/** Finds the first user with the given email across all scopes, or null. */
+	findByEmail(email: string): Promise<IamUser | null>;
 	/**
-	* Finds the user with the given email within the given auth scope.
-	* @param email the email address to look up
-	* @param authScopeType the scope type the user is registered against (e.g. {@code SYSTEM}, {@code ORGANIZATION}, {@code APPLICATION})
-	* @param authScopeId the id of the scope the user is registered against
-	* @return {@link Promise} emitting the matching user, or {@code null} if no user matches
+	* Finds the user with the given email within a scope identified structurally by
+	* (organizationId, applicationId): both null → SYSTEM, organizationId only → ORGANIZATION,
+	* both set → APPLICATION.
 	*/
-	findByEmailAndScope(email: string, authScopeType: string, authScopeId: string): Promise<IamUser | null>;
+	findByEmail(email: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
 	/**
-	* Finds all users registered against the given auth scope.
-	* @param authScopeType the scope type to filter by (e.g. {@code SYSTEM}, {@code ORGANIZATION}, {@code APPLICATION})
-	* @param authScopeId the id of the scope to filter by
-	* @param pageable the paging and sort options
-	* @return {@link Promise} emitting a page of users registered against the scope
+	* Finds the first ORGANIZATION-scope user with the given email across all organizations.
+	* Used by sign-up to enforce one user per email before the new org's id exists.
 	*/
-	findByScope(authScopeType: string, authScopeId: string, pageable: Pageable4): Promise<Page3<IamUser>>;
+	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
 	/**
-	* Creates a user and, if a password is provided, the matching credential.
-	* {@code APPLICATION}-scoped users must carry a {@code tenantId}; {@code SYSTEM} and {@code ORGANIZATION} users must not.
-	* @param user the user to create
-	* @param password the password to set, or {@code null} to create the user without a credential
-	* @return {@link Promise} emitting the persisted user
+	* Finds the user (if any) with the given OIDC identity within a specific scope, using the
+	* same (organizationId, applicationId) null conventions as {@link findByEmail}.
 	*/
+	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	/** Finds every user across scopes for a given OIDC identity — e.g. the orgs it can access. */
+	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
+	/** Creates a user and, if a password is provided, the matching credential. */
 	createUser(user: IamUser, password: string | null): Promise<IamUser>;
-	/**
-	* Verifies the current password and updates it. Used when the user knows their current password.
-	* @param userId the id of the user whose password should be changed
-	* @param currentPassword the user's current password
-	* @param newPassword the new password to set
-	* @return {@link Promise} that resolves when the password has been updated
-	*/
-	changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
-	/**
-	* Replaces the user's password without verifying the current one. Administrative reset.
-	* @param userId the id of the user whose password should be reset
-	* @param newPassword the new password to set
-	* @return {@link Promise} that resolves when the password has been reset
-	*/
-	resetPassword(userId: string, newPassword: string): Promise<void>;
-	/**
-	* Finds the first user with the given email across all scope ids of the given scope type.
-	* Used by the sign-up flow to enforce one user per email at organization-creation time,
-	* before the new organization's scope id exists.
-	* @param email the email address to look up
-	* @param authScopeType the scope type to search within (e.g. {@code ORGANIZATION})
-	* @return {@link Promise} emitting the first matching user, or {@code null} if no user matches
-	*/
-	findFirstByEmailInScopeType(email: string, authScopeType: string): Promise<IamUser | null>;
 }
 declare class IamUserService extends CrudServiceProxy8<IamUser> implements IIamUserService {
 	constructor(kinotic: IKinotic11);
-	findByEmailAndScope(email: string, authScopeType: string, authScopeId: string): Promise<IamUser | null>;
-	findByScope(authScopeType: string, authScopeId: string, pageable: Pageable4): Promise<Page3<IamUser>>;
+	findByEmail(email: string, organizationId?: string | null, applicationId?: string | null): Promise<IamUser | null>;
+	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
+	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
 	createUser(user: IamUser, password: string | null): Promise<IamUser>;
-	changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
-	resetPassword(userId: string, newPassword: string): Promise<void>;
-	findFirstByEmailInScopeType(email: string, authScopeType: string): Promise<IamUser | null>;
 }
 import { IKinotic as IKinotic12 } from "@kinotic-ai/core";
 /**
@@ -1142,4 +1126,4 @@ declare const OsApiPlugin: KinoticPlugin<IOsApiExtension>;
 declare module "@kinotic-ai/core" {
 	interface KinoticSingleton extends IOsApiExtension {}
 }
-export { WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, IProjectService, IOsApiExtension, IOrganizationService, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };
+export { WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, IProjectService, IOsApiExtension, IOrganizationService, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };

package/dist/index.js

@@ -249,7 +249,7 @@ class NamedQueriesDefinition {
   projectId;
   entityDefinitionName;
   namedQueries;
-  constructor(organizationId, id, applicationId, projectId, entityDefinitionName, namedQueries) {
+  constructor(id, organizationId, applicationId, projectId, entityDefinitionName, namedQueries) {
     this.id = id;
     this.organizationId = organizationId;
     this.applicationId = applicationId;
@@ -349,8 +349,8 @@ class IamUser {
   authType = null;
   oidcSubject = null;
   oidcConfigId = null;
-  authScopeType = "";
-  authScopeId = "";
+  organizationId = null;
+  applicationId = null;
   tenantId = null;
   enabled = true;
   created = null;
@@ -614,25 +614,22 @@ import { CrudServiceProxy as CrudServiceProxy8 } from "@kinotic-ai/core";
 
 class IamUserService extends CrudServiceProxy8 {
   constructor(kinotic) {
-    super(kinotic.serviceProxy("org.kinotic.os.api.services.iam.IamUserService"));
+    super(kinotic.serviceProxy("org.kinotic.domain.api.services.iam.IamUserService"));
   }
-  findByEmailAndScope(email, authScopeType, authScopeId) {
-    return this.serviceProxy.invoke("findByEmailAndScope", [email, authScopeType, authScopeId]);
+  findByEmail(email, organizationId, applicationId) {
+    return arguments.length >= 3 ? this.serviceProxy.invoke("findByEmail", [email, organizationId, applicationId]) : this.serviceProxy.invoke("findByEmail", [email]);
   }
-  findByScope(authScopeType, authScopeId, pageable) {
-    return this.serviceProxy.invoke("findByScope", [authScopeType, authScopeId, pageable]);
+  findFirstOrgUserByEmail(email) {
+    return this.serviceProxy.invoke("findFirstOrgUserByEmail", [email]);
   }
-  createUser(user, password) {
-    return this.serviceProxy.invoke("createUser", [user, password]);
-  }
-  changePassword(userId, currentPassword, newPassword) {
-    return this.serviceProxy.invoke("changePassword", [userId, currentPassword, newPassword]);
+  findByOidcIdentity(oidcSubject, oidcConfigId, organizationId, applicationId) {
+    return this.serviceProxy.invoke("findByOidcIdentity", [oidcSubject, oidcConfigId, organizationId, applicationId]);
   }
-  resetPassword(userId, newPassword) {
-    return this.serviceProxy.invoke("resetPassword", [userId, newPassword]);
+  findAllByOidcIdentity(oidcSubject, oidcConfigId) {
+    return this.serviceProxy.invoke("findAllByOidcIdentity", [oidcSubject, oidcConfigId]);
   }
-  findFirstByEmailInScopeType(email, authScopeType) {
-    return this.serviceProxy.invoke("findFirstByEmailInScopeType", [email, authScopeType]);
+  createUser(user, password) {
+    return this.serviceProxy.invoke("createUser", [user, password]);
   }
 }
 // packages/os-api/src/api/services/IDeviceApprovalService.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinotic-ai/os-api",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "type": "module",
   "files": [
     "dist"
@@ -33,11 +33,11 @@
     "ui-test": "vitest --ui --coverage.enabled=true --mode development"
   },
   "peerDependencies": {
-    "@kinotic-ai/core": ">=1.2.0"
+    "@kinotic-ai/core": ">=1.4.0"
   },
   "dependencies": {
     "@kinotic-ai/idl": "1.0.9",
-    "@kinotic-ai/persistence": "1.2.1",
+    "@kinotic-ai/persistence": "1.3.0",
     "rxjs": "^7.8.2"
   },
   "devDependencies": {