@kinotic-ai/os-api 1.6.1 → 1.8.0

package/dist/index.cjs

@@ -40,6 +40,9 @@ var __export = (target, all) => {
 // packages/os-api/src/index.ts
 var exports_src = {};
 __export(exports_src, {
+  isSystemParticipant: () => isSystemParticipant,
+  isOrganizationParticipant: () => isOrganizationParticipant,
+  isApplicationParticipant: () => isApplicationParticipant,
   WorkloadStatus: () => WorkloadStatus,
   WorkloadServiceProxy: () => WorkloadServiceProxy,
   Workload: () => Workload,
@@ -59,6 +62,7 @@ __export(exports_src, {
   ProjectService: () => ProjectService,
   Project: () => Project,
   ProgressType: () => ProgressType,
+  ParticipantType: () => ParticipantType,
   PageableC3Type: () => PageableC3Type,
   PageC3Type: () => PageC3Type,
   OsApiPlugin: () => OsApiPlugin,
@@ -449,8 +453,8 @@ class IamUser {
   authType = null;
   oidcSubject = null;
   oidcConfigId = null;
-  authScopeType = "";
-  authScopeId = "";
+  organizationId = null;
+  applicationId = null;
   tenantId = null;
   enabled = true;
   created = null;
@@ -493,6 +497,27 @@ class KinoticProjectConfig {
   fileExtensionForImports = ".js";
   validate;
 }
+// packages/os-api/src/api/security/ParticipantType.ts
+var ParticipantType;
+((ParticipantType2) => {
+  ParticipantType2["SYSTEM"] = "system";
+  ParticipantType2["ORGANIZATION"] = "organization";
+  ParticipantType2["APPLICATION"] = "application";
+})(ParticipantType ||= {});
+// packages/os-api/src/api/security/ParticipantGuards.ts
+function scopeType(participant) {
+  return participant.type;
+}
+function isSystemParticipant(participant) {
+  return scopeType(participant) === "system" /* SYSTEM */;
+}
+function isOrganizationParticipant(participant) {
+  const type = scopeType(participant);
+  return type === "organization" /* ORGANIZATION */ || type === "application" /* APPLICATION */;
+}
+function isApplicationParticipant(participant) {
+  return scopeType(participant) === "application" /* APPLICATION */;
+}
 // packages/os-api/src/api/services/IApplicationService.ts
 var import_core = require("@kinotic-ai/core");
 
@@ -714,25 +739,22 @@ var import_core8 = require("@kinotic-ai/core");
 
 class IamUserService extends import_core8.CrudServiceProxy {
   constructor(kinotic) {
-    super(kinotic.serviceProxy("org.kinotic.os.api.services.iam.IamUserService"));
+    super(kinotic.serviceProxy("org.kinotic.domain.api.services.iam.IamUserService"));
   }
-  findByEmailAndScope(email, authScopeType, authScopeId) {
-    return this.serviceProxy.invoke("findByEmailAndScope", [email, authScopeType, authScopeId]);
+  findByEmail(email, organizationId, applicationId) {
+    return arguments.length >= 3 ? this.serviceProxy.invoke("findByEmail", [email, organizationId, applicationId]) : this.serviceProxy.invoke("findByEmail", [email]);
   }
-  findByScope(authScopeType, authScopeId, pageable) {
-    return this.serviceProxy.invoke("findByScope", [authScopeType, authScopeId, pageable]);
+  findFirstOrgUserByEmail(email) {
+    return this.serviceProxy.invoke("findFirstOrgUserByEmail", [email]);
   }
-  createUser(user, password) {
-    return this.serviceProxy.invoke("createUser", [user, password]);
-  }
-  changePassword(userId, currentPassword, newPassword) {
-    return this.serviceProxy.invoke("changePassword", [userId, currentPassword, newPassword]);
+  findByOidcIdentity(oidcSubject, oidcConfigId, organizationId, applicationId) {
+    return this.serviceProxy.invoke("findByOidcIdentity", [oidcSubject, oidcConfigId, organizationId, applicationId]);
   }
-  resetPassword(userId, newPassword) {
-    return this.serviceProxy.invoke("resetPassword", [userId, newPassword]);
+  findAllByOidcIdentity(oidcSubject, oidcConfigId) {
+    return this.serviceProxy.invoke("findAllByOidcIdentity", [oidcSubject, oidcConfigId]);
   }
-  findFirstByEmailInScopeType(email, authScopeType) {
-    return this.serviceProxy.invoke("findFirstByEmailInScopeType", [email, authScopeType]);
+  createUser(user, password) {
+    return this.serviceProxy.invoke("createUser", [user, password]);
   }
 }
 // packages/os-api/src/api/services/IDeviceApprovalService.ts

package/dist/index.d.cts

@@ -533,12 +533,12 @@ declare enum AuthType {
 }
 import { Identifiable as Identifiable8 } from "@kinotic-ai/core";
 /**
-* Represents an authenticated identity at any scope layer in the IAM system.
-* Each user is scoped to exactly one layer and is unique by email within that scope.
+* Represents an authenticated identity in the IAM system. Scope is encoded structurally by
+* which of {@link organizationId} / {@link applicationId} is set:
 *
-* - For SYSTEM and ORGANIZATION scopes, {@link tenantId} must be null.
-* - For APPLICATION scopes, {@link tenantId} is required and identifies the
-*   client tenant the user belongs to within the application's data.
+* - both null → SYSTEM
+* - {@link organizationId} only → ORGANIZATION
+* - both set → APPLICATION, with {@link tenantId} identifying the end-user data slice
 */
 declare class IamUser implements Identifiable8<string> {
 	id: string | null;
@@ -547,39 +547,42 @@ declare class IamUser implements Identifiable8<string> {
 	authType: AuthType | null;
 	oidcSubject: string | null;
 	oidcConfigId: string | null;
-	authScopeType: string;
-	authScopeId: string;
+	organizationId: string | null;
+	applicationId: string | null;
 	tenantId: string | null;
 	enabled: boolean;
 	created: number | null;
 	updated: number | null;
 }
 /**
-* Sent to the server to initiate an organization sign-up.
-* The user provides {@link orgName}, {@link orgDescription}, {@link email}, and
-* {@link displayName}. The remaining fields ({@link id}, {@link verificationToken},
-* {@link expiresAt}, {@link created}) are populated by the server before the record
-* is persisted.
+* Sent to {@code POST /api/signup} to start an email/password organization sign-up.
+* Only the user's identity is collected up front; the organization name and password are
+* provided after email verification (see {@link SignUpCompleteRequest}).
 */
 interface SignUpRequest {
-	id?: string | null;
-	verificationToken?: string | null;
-	expiresAt?: number | null;
-	created?: number | null;
-	orgName: string;
-	orgDescription?: string | null;
 	email: string;
 	displayName: string;
 }
 /**
-* Sent to the server to complete an organization sign-up after email verification.
-* The {@link token} comes from the verification email link; the {@link password}
-* is what the user enters on the "set your password" form.
+* Sent to {@code POST /api/signup/complete} after the user clicks the verification link.
+* The {@link token} comes from that link; {@link orgName} (with optional {@link orgDescription})
+* names the organization to create, and {@link password} is the chosen account password.
 */
 interface SignUpCompleteRequest {
 	token: string;
+	orgName: string;
+	orgDescription?: string | null;
 	password: string;
 }
+/**
+* Sent to {@code POST /api/signup/complete-org} to finish an OIDC sign-up by naming the
+* organization to create. The verified identity is held server-side, keyed by {@link token}.
+*/
+interface CompleteOrgRequest {
+	token: string;
+	orgName: string;
+	orgDescription?: string | null;
+}
 import { Identifiable as Identifiable9 } from "@kinotic-ai/core";
 /**
 * Persisted record of one GitHub App installation that a Kinotic Org has authorised.
@@ -693,6 +696,73 @@ declare class KinoticProjectConfig {
 	*/
 	validate?: boolean;
 }
+/**
+* Identifies which scope layer a participant authenticated against. The server serializes this as
+* the {@code type} discriminator on a participant, and it is used to narrow a base
+* {@code IParticipant} to one of the scope-typed participant interfaces.
+*/
+declare enum ParticipantType {
+	SYSTEM = "system",
+	ORGANIZATION = "organization",
+	APPLICATION = "application"
+}
+import { IParticipant } from "@kinotic-ai/core";
+/**
+* A participant authenticated against the platform SYSTEM scope — a platform operator with no
+* organization or application context. Mirrors the server {@code SystemParticipant}.
+*/
+interface ISystemParticipant extends IParticipant {
+	type: ParticipantType.SYSTEM;
+}
+import { IParticipant as IParticipant2 } from "@kinotic-ai/core";
+/**
+* A participant authenticated against an Organization. {@link organizationId} is the id of the
+* owning Organization and is never null. {@link IApplicationParticipant} extends this type, so an
+* application-scoped participant also satisfies it. Mirrors the server
+* {@code OrganizationParticipant}.
+*/
+interface IOrganizationParticipant extends IParticipant2 {
+	type: ParticipantType.ORGANIZATION | ParticipantType.APPLICATION;
+	/**
+	* The id of the Organization this participant is authenticated under; never null.
+	*/
+	organizationId: string;
+}
+/**
+* A participant authenticated against an Application. Extends {@link IOrganizationParticipant}
+* because every Application belongs to an Organization, so an application-scoped session
+* intrinsically carries the owning Organization's id as well. Mirrors the server
+* {@code ApplicationParticipant}.
+*/
+interface IApplicationParticipant extends IOrganizationParticipant {
+	type: ParticipantType.APPLICATION;
+	/**
+	* The id of the Application this participant is authenticated under; never null.
+	*/
+	applicationId: string;
+	/**
+	* The tenant slice of the Application's end-user data this participant belongs to, or null
+	* when the Application is not multi-tenant.
+	*/
+	tenantId?: string | null;
+}
+import { IParticipant as IParticipant3 } from "@kinotic-ai/core";
+/**
+* @return true if the participant authenticated against the platform SYSTEM scope
+*/
+declare function isSystemParticipant(participant: IParticipant3): participant is ISystemParticipant;
+/**
+* Narrows to an {@link IOrganizationParticipant}, which carries an {@code organizationId}. An
+* application-scoped participant satisfies this too, since every Application is owned by an
+* Organization.
+*
+* @return true if the participant authenticated against an Organization or an Application
+*/
+declare function isOrganizationParticipant(participant: IParticipant3): participant is IOrganizationParticipant;
+/**
+* @return true if the participant authenticated against an Application
+*/
+declare function isApplicationParticipant(participant: IParticipant3): participant is IApplicationParticipant;
 import { IKinotic } from "@kinotic-ai/core";
 import { CrudServiceProxy, ICrudServiceProxy } from "@kinotic-ai/core";
 interface IApplicationService extends ICrudServiceProxy<Application> {
@@ -1012,65 +1082,46 @@ declare class WorkloadServiceProxy extends CrudServiceProxy7<Workload> implement
 	countForNode(nodeId: string): Promise<number>;
 	syncIndex(): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8, Page as Page3, Pageable as Pageable4 } from "@kinotic-ai/core";
+import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+/**
+* Client proxy for the server's {@code IamUserService}; method shapes mirror the Java interface.
+*
+* NOTE: the server interface now lives in {@code kinotic-domain} and is not currently
+* {@code @Publish}-annotated, so this proxy is not callable over RPC until the backend publishes
+* the service. The shape here is kept in sync so it is ready once that happens; confirm the
+* published namespace before relying on it.
+*/
 interface IIamUserService extends ICrudServiceProxy8<IamUser> {
+	/** Finds the first user with the given email across all scopes, or null. */
+	findByEmail(email: string): Promise<IamUser | null>;
 	/**
-	* Finds the user with the given email within the given auth scope.
-	* @param email the email address to look up
-	* @param authScopeType the scope type the user is registered against (e.g. {@code SYSTEM}, {@code ORGANIZATION}, {@code APPLICATION})
-	* @param authScopeId the id of the scope the user is registered against
-	* @return {@link Promise} emitting the matching user, or {@code null} if no user matches
+	* Finds the user with the given email within a scope identified structurally by
+	* (organizationId, applicationId): both null → SYSTEM, organizationId only → ORGANIZATION,
+	* both set → APPLICATION.
 	*/
-	findByEmailAndScope(email: string, authScopeType: string, authScopeId: string): Promise<IamUser | null>;
+	findByEmail(email: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
 	/**
-	* Finds all users registered against the given auth scope.
-	* @param authScopeType the scope type to filter by (e.g. {@code SYSTEM}, {@code ORGANIZATION}, {@code APPLICATION})
-	* @param authScopeId the id of the scope to filter by
-	* @param pageable the paging and sort options
-	* @return {@link Promise} emitting a page of users registered against the scope
+	* Finds the first ORGANIZATION-scope user with the given email across all organizations.
+	* Used by sign-up to enforce one user per email before the new org's id exists.
 	*/
-	findByScope(authScopeType: string, authScopeId: string, pageable: Pageable4): Promise<Page3<IamUser>>;
+	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
 	/**
-	* Creates a user and, if a password is provided, the matching credential.
-	* {@code APPLICATION}-scoped users must carry a {@code tenantId}; {@code SYSTEM} and {@code ORGANIZATION} users must not.
-	* @param user the user to create
-	* @param password the password to set, or {@code null} to create the user without a credential
-	* @return {@link Promise} emitting the persisted user
+	* Finds the user (if any) with the given OIDC identity within a specific scope, using the
+	* same (organizationId, applicationId) null conventions as {@link findByEmail}.
 	*/
+	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	/** Finds every user across scopes for a given OIDC identity — e.g. the orgs it can access. */
+	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
+	/** Creates a user and, if a password is provided, the matching credential. */
 	createUser(user: IamUser, password: string | null): Promise<IamUser>;
-	/**
-	* Verifies the current password and updates it. Used when the user knows their current password.
-	* @param userId the id of the user whose password should be changed
-	* @param currentPassword the user's current password
-	* @param newPassword the new password to set
-	* @return {@link Promise} that resolves when the password has been updated
-	*/
-	changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
-	/**
-	* Replaces the user's password without verifying the current one. Administrative reset.
-	* @param userId the id of the user whose password should be reset
-	* @param newPassword the new password to set
-	* @return {@link Promise} that resolves when the password has been reset
-	*/
-	resetPassword(userId: string, newPassword: string): Promise<void>;
-	/**
-	* Finds the first user with the given email across all scope ids of the given scope type.
-	* Used by the sign-up flow to enforce one user per email at organization-creation time,
-	* before the new organization's scope id exists.
-	* @param email the email address to look up
-	* @param authScopeType the scope type to search within (e.g. {@code ORGANIZATION})
-	* @return {@link Promise} emitting the first matching user, or {@code null} if no user matches
-	*/
-	findFirstByEmailInScopeType(email: string, authScopeType: string): Promise<IamUser | null>;
 }
 declare class IamUserService extends CrudServiceProxy8<IamUser> implements IIamUserService {
 	constructor(kinotic: IKinotic11);
-	findByEmailAndScope(email: string, authScopeType: string, authScopeId: string): Promise<IamUser | null>;
-	findByScope(authScopeType: string, authScopeId: string, pageable: Pageable4): Promise<Page3<IamUser>>;
+	findByEmail(email: string, organizationId?: string | null, applicationId?: string | null): Promise<IamUser | null>;
+	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
+	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
 	createUser(user: IamUser, password: string | null): Promise<IamUser>;
-	changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
-	resetPassword(userId: string, newPassword: string): Promise<void>;
-	findFirstByEmailInScopeType(email: string, authScopeType: string): Promise<IamUser | null>;
 }
 import { IKinotic as IKinotic12 } from "@kinotic-ai/core";
 /**
@@ -1142,4 +1193,4 @@ declare const OsApiPlugin: KinoticPlugin<IOsApiExtension>;
 declare module "@kinotic-ai/core" {
 	interface KinoticSingleton extends IOsApiExtension {}
 }
-export { WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, IProjectService, IOsApiExtension, IOrganizationService, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };
+export { isSystemParticipant, isOrganizationParticipant, isApplicationParticipant, WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, ParticipantType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, ISystemParticipant, IProjectService, IOsApiExtension, IOrganizationService, IOrganizationParticipant, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, IApplicationParticipant, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };

package/dist/index.d.ts

@@ -533,12 +533,12 @@ declare enum AuthType {
 }
 import { Identifiable as Identifiable8 } from "@kinotic-ai/core";
 /**
-* Represents an authenticated identity at any scope layer in the IAM system.
-* Each user is scoped to exactly one layer and is unique by email within that scope.
+* Represents an authenticated identity in the IAM system. Scope is encoded structurally by
+* which of {@link organizationId} / {@link applicationId} is set:
 *
-* - For SYSTEM and ORGANIZATION scopes, {@link tenantId} must be null.
-* - For APPLICATION scopes, {@link tenantId} is required and identifies the
-*   client tenant the user belongs to within the application's data.
+* - both null → SYSTEM
+* - {@link organizationId} only → ORGANIZATION
+* - both set → APPLICATION, with {@link tenantId} identifying the end-user data slice
 */
 declare class IamUser implements Identifiable8<string> {
 	id: string | null;
@@ -547,39 +547,42 @@ declare class IamUser implements Identifiable8<string> {
 	authType: AuthType | null;
 	oidcSubject: string | null;
 	oidcConfigId: string | null;
-	authScopeType: string;
-	authScopeId: string;
+	organizationId: string | null;
+	applicationId: string | null;
 	tenantId: string | null;
 	enabled: boolean;
 	created: number | null;
 	updated: number | null;
 }
 /**
-* Sent to the server to initiate an organization sign-up.
-* The user provides {@link orgName}, {@link orgDescription}, {@link email}, and
-* {@link displayName}. The remaining fields ({@link id}, {@link verificationToken},
-* {@link expiresAt}, {@link created}) are populated by the server before the record
-* is persisted.
+* Sent to {@code POST /api/signup} to start an email/password organization sign-up.
+* Only the user's identity is collected up front; the organization name and password are
+* provided after email verification (see {@link SignUpCompleteRequest}).
 */
 interface SignUpRequest {
-	id?: string | null;
-	verificationToken?: string | null;
-	expiresAt?: number | null;
-	created?: number | null;
-	orgName: string;
-	orgDescription?: string | null;
 	email: string;
 	displayName: string;
 }
 /**
-* Sent to the server to complete an organization sign-up after email verification.
-* The {@link token} comes from the verification email link; the {@link password}
-* is what the user enters on the "set your password" form.
+* Sent to {@code POST /api/signup/complete} after the user clicks the verification link.
+* The {@link token} comes from that link; {@link orgName} (with optional {@link orgDescription})
+* names the organization to create, and {@link password} is the chosen account password.
 */
 interface SignUpCompleteRequest {
 	token: string;
+	orgName: string;
+	orgDescription?: string | null;
 	password: string;
 }
+/**
+* Sent to {@code POST /api/signup/complete-org} to finish an OIDC sign-up by naming the
+* organization to create. The verified identity is held server-side, keyed by {@link token}.
+*/
+interface CompleteOrgRequest {
+	token: string;
+	orgName: string;
+	orgDescription?: string | null;
+}
 import { Identifiable as Identifiable9 } from "@kinotic-ai/core";
 /**
 * Persisted record of one GitHub App installation that a Kinotic Org has authorised.
@@ -693,6 +696,73 @@ declare class KinoticProjectConfig {
 	*/
 	validate?: boolean;
 }
+/**
+* Identifies which scope layer a participant authenticated against. The server serializes this as
+* the {@code type} discriminator on a participant, and it is used to narrow a base
+* {@code IParticipant} to one of the scope-typed participant interfaces.
+*/
+declare enum ParticipantType {
+	SYSTEM = "system",
+	ORGANIZATION = "organization",
+	APPLICATION = "application"
+}
+import { IParticipant } from "@kinotic-ai/core";
+/**
+* A participant authenticated against the platform SYSTEM scope — a platform operator with no
+* organization or application context. Mirrors the server {@code SystemParticipant}.
+*/
+interface ISystemParticipant extends IParticipant {
+	type: ParticipantType.SYSTEM;
+}
+import { IParticipant as IParticipant2 } from "@kinotic-ai/core";
+/**
+* A participant authenticated against an Organization. {@link organizationId} is the id of the
+* owning Organization and is never null. {@link IApplicationParticipant} extends this type, so an
+* application-scoped participant also satisfies it. Mirrors the server
+* {@code OrganizationParticipant}.
+*/
+interface IOrganizationParticipant extends IParticipant2 {
+	type: ParticipantType.ORGANIZATION | ParticipantType.APPLICATION;
+	/**
+	* The id of the Organization this participant is authenticated under; never null.
+	*/
+	organizationId: string;
+}
+/**
+* A participant authenticated against an Application. Extends {@link IOrganizationParticipant}
+* because every Application belongs to an Organization, so an application-scoped session
+* intrinsically carries the owning Organization's id as well. Mirrors the server
+* {@code ApplicationParticipant}.
+*/
+interface IApplicationParticipant extends IOrganizationParticipant {
+	type: ParticipantType.APPLICATION;
+	/**
+	* The id of the Application this participant is authenticated under; never null.
+	*/
+	applicationId: string;
+	/**
+	* The tenant slice of the Application's end-user data this participant belongs to, or null
+	* when the Application is not multi-tenant.
+	*/
+	tenantId?: string | null;
+}
+import { IParticipant as IParticipant3 } from "@kinotic-ai/core";
+/**
+* @return true if the participant authenticated against the platform SYSTEM scope
+*/
+declare function isSystemParticipant(participant: IParticipant3): participant is ISystemParticipant;
+/**
+* Narrows to an {@link IOrganizationParticipant}, which carries an {@code organizationId}. An
+* application-scoped participant satisfies this too, since every Application is owned by an
+* Organization.
+*
+* @return true if the participant authenticated against an Organization or an Application
+*/
+declare function isOrganizationParticipant(participant: IParticipant3): participant is IOrganizationParticipant;
+/**
+* @return true if the participant authenticated against an Application
+*/
+declare function isApplicationParticipant(participant: IParticipant3): participant is IApplicationParticipant;
 import { IKinotic } from "@kinotic-ai/core";
 import { CrudServiceProxy, ICrudServiceProxy } from "@kinotic-ai/core";
 interface IApplicationService extends ICrudServiceProxy<Application> {
@@ -1012,65 +1082,46 @@ declare class WorkloadServiceProxy extends CrudServiceProxy7<Workload> implement
 	countForNode(nodeId: string): Promise<number>;
 	syncIndex(): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8, Page as Page3, Pageable as Pageable4 } from "@kinotic-ai/core";
+import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+/**
+* Client proxy for the server's {@code IamUserService}; method shapes mirror the Java interface.
+*
+* NOTE: the server interface now lives in {@code kinotic-domain} and is not currently
+* {@code @Publish}-annotated, so this proxy is not callable over RPC until the backend publishes
+* the service. The shape here is kept in sync so it is ready once that happens; confirm the
+* published namespace before relying on it.
+*/
 interface IIamUserService extends ICrudServiceProxy8<IamUser> {
+	/** Finds the first user with the given email across all scopes, or null. */
+	findByEmail(email: string): Promise<IamUser | null>;
 	/**
-	* Finds the user with the given email within the given auth scope.
-	* @param email the email address to look up
-	* @param authScopeType the scope type the user is registered against (e.g. {@code SYSTEM}, {@code ORGANIZATION}, {@code APPLICATION})
-	* @param authScopeId the id of the scope the user is registered against
-	* @return {@link Promise} emitting the matching user, or {@code null} if no user matches
+	* Finds the user with the given email within a scope identified structurally by
+	* (organizationId, applicationId): both null → SYSTEM, organizationId only → ORGANIZATION,
+	* both set → APPLICATION.
 	*/
-	findByEmailAndScope(email: string, authScopeType: string, authScopeId: string): Promise<IamUser | null>;
+	findByEmail(email: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
 	/**
-	* Finds all users registered against the given auth scope.
-	* @param authScopeType the scope type to filter by (e.g. {@code SYSTEM}, {@code ORGANIZATION}, {@code APPLICATION})
-	* @param authScopeId the id of the scope to filter by
-	* @param pageable the paging and sort options
-	* @return {@link Promise} emitting a page of users registered against the scope
+	* Finds the first ORGANIZATION-scope user with the given email across all organizations.
+	* Used by sign-up to enforce one user per email before the new org's id exists.
 	*/
-	findByScope(authScopeType: string, authScopeId: string, pageable: Pageable4): Promise<Page3<IamUser>>;
+	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
 	/**
-	* Creates a user and, if a password is provided, the matching credential.
-	* {@code APPLICATION}-scoped users must carry a {@code tenantId}; {@code SYSTEM} and {@code ORGANIZATION} users must not.
-	* @param user the user to create
-	* @param password the password to set, or {@code null} to create the user without a credential
-	* @return {@link Promise} emitting the persisted user
+	* Finds the user (if any) with the given OIDC identity within a specific scope, using the
+	* same (organizationId, applicationId) null conventions as {@link findByEmail}.
 	*/
+	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	/** Finds every user across scopes for a given OIDC identity — e.g. the orgs it can access. */
+	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
+	/** Creates a user and, if a password is provided, the matching credential. */
 	createUser(user: IamUser, password: string | null): Promise<IamUser>;
-	/**
-	* Verifies the current password and updates it. Used when the user knows their current password.
-	* @param userId the id of the user whose password should be changed
-	* @param currentPassword the user's current password
-	* @param newPassword the new password to set
-	* @return {@link Promise} that resolves when the password has been updated
-	*/
-	changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
-	/**
-	* Replaces the user's password without verifying the current one. Administrative reset.
-	* @param userId the id of the user whose password should be reset
-	* @param newPassword the new password to set
-	* @return {@link Promise} that resolves when the password has been reset
-	*/
-	resetPassword(userId: string, newPassword: string): Promise<void>;
-	/**
-	* Finds the first user with the given email across all scope ids of the given scope type.
-	* Used by the sign-up flow to enforce one user per email at organization-creation time,
-	* before the new organization's scope id exists.
-	* @param email the email address to look up
-	* @param authScopeType the scope type to search within (e.g. {@code ORGANIZATION})
-	* @return {@link Promise} emitting the first matching user, or {@code null} if no user matches
-	*/
-	findFirstByEmailInScopeType(email: string, authScopeType: string): Promise<IamUser | null>;
 }
 declare class IamUserService extends CrudServiceProxy8<IamUser> implements IIamUserService {
 	constructor(kinotic: IKinotic11);
-	findByEmailAndScope(email: string, authScopeType: string, authScopeId: string): Promise<IamUser | null>;
-	findByScope(authScopeType: string, authScopeId: string, pageable: Pageable4): Promise<Page3<IamUser>>;
+	findByEmail(email: string, organizationId?: string | null, applicationId?: string | null): Promise<IamUser | null>;
+	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
+	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
 	createUser(user: IamUser, password: string | null): Promise<IamUser>;
-	changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
-	resetPassword(userId: string, newPassword: string): Promise<void>;
-	findFirstByEmailInScopeType(email: string, authScopeType: string): Promise<IamUser | null>;
 }
 import { IKinotic as IKinotic12 } from "@kinotic-ai/core";
 /**
@@ -1142,4 +1193,4 @@ declare const OsApiPlugin: KinoticPlugin<IOsApiExtension>;
 declare module "@kinotic-ai/core" {
 	interface KinoticSingleton extends IOsApiExtension {}
 }
-export { WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, IProjectService, IOsApiExtension, IOrganizationService, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };
+export { isSystemParticipant, isOrganizationParticipant, isApplicationParticipant, WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, ParticipantType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, ISystemParticipant, IProjectService, IOsApiExtension, IOrganizationService, IOrganizationParticipant, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, IApplicationParticipant, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };

package/dist/index.js

@@ -349,8 +349,8 @@ class IamUser {
   authType = null;
   oidcSubject = null;
   oidcConfigId = null;
-  authScopeType = "";
-  authScopeId = "";
+  organizationId = null;
+  applicationId = null;
   tenantId = null;
   enabled = true;
   created = null;
@@ -393,6 +393,27 @@ class KinoticProjectConfig {
   fileExtensionForImports = ".js";
   validate;
 }
+// packages/os-api/src/api/security/ParticipantType.ts
+var ParticipantType;
+((ParticipantType2) => {
+  ParticipantType2["SYSTEM"] = "system";
+  ParticipantType2["ORGANIZATION"] = "organization";
+  ParticipantType2["APPLICATION"] = "application";
+})(ParticipantType ||= {});
+// packages/os-api/src/api/security/ParticipantGuards.ts
+function scopeType(participant) {
+  return participant.type;
+}
+function isSystemParticipant(participant) {
+  return scopeType(participant) === "system" /* SYSTEM */;
+}
+function isOrganizationParticipant(participant) {
+  const type = scopeType(participant);
+  return type === "organization" /* ORGANIZATION */ || type === "application" /* APPLICATION */;
+}
+function isApplicationParticipant(participant) {
+  return scopeType(participant) === "application" /* APPLICATION */;
+}
 // packages/os-api/src/api/services/IApplicationService.ts
 import { CrudServiceProxy } from "@kinotic-ai/core";
 
@@ -614,25 +635,22 @@ import { CrudServiceProxy as CrudServiceProxy8 } from "@kinotic-ai/core";
 
 class IamUserService extends CrudServiceProxy8 {
   constructor(kinotic) {
-    super(kinotic.serviceProxy("org.kinotic.os.api.services.iam.IamUserService"));
+    super(kinotic.serviceProxy("org.kinotic.domain.api.services.iam.IamUserService"));
   }
-  findByEmailAndScope(email, authScopeType, authScopeId) {
-    return this.serviceProxy.invoke("findByEmailAndScope", [email, authScopeType, authScopeId]);
+  findByEmail(email, organizationId, applicationId) {
+    return arguments.length >= 3 ? this.serviceProxy.invoke("findByEmail", [email, organizationId, applicationId]) : this.serviceProxy.invoke("findByEmail", [email]);
   }
-  findByScope(authScopeType, authScopeId, pageable) {
-    return this.serviceProxy.invoke("findByScope", [authScopeType, authScopeId, pageable]);
+  findFirstOrgUserByEmail(email) {
+    return this.serviceProxy.invoke("findFirstOrgUserByEmail", [email]);
   }
-  createUser(user, password) {
-    return this.serviceProxy.invoke("createUser", [user, password]);
-  }
-  changePassword(userId, currentPassword, newPassword) {
-    return this.serviceProxy.invoke("changePassword", [userId, currentPassword, newPassword]);
+  findByOidcIdentity(oidcSubject, oidcConfigId, organizationId, applicationId) {
+    return this.serviceProxy.invoke("findByOidcIdentity", [oidcSubject, oidcConfigId, organizationId, applicationId]);
   }
-  resetPassword(userId, newPassword) {
-    return this.serviceProxy.invoke("resetPassword", [userId, newPassword]);
+  findAllByOidcIdentity(oidcSubject, oidcConfigId) {
+    return this.serviceProxy.invoke("findAllByOidcIdentity", [oidcSubject, oidcConfigId]);
   }
-  findFirstByEmailInScopeType(email, authScopeType) {
-    return this.serviceProxy.invoke("findFirstByEmailInScopeType", [email, authScopeType]);
+  createUser(user, password) {
+    return this.serviceProxy.invoke("createUser", [user, password]);
   }
 }
 // packages/os-api/src/api/services/IDeviceApprovalService.ts
@@ -683,6 +701,9 @@ var OsApiPlugin = {
   }
 };
 export {
+  isSystemParticipant,
+  isOrganizationParticipant,
+  isApplicationParticipant,
   WorkloadStatus,
   WorkloadServiceProxy,
   Workload,
@@ -702,6 +723,7 @@ export {
   ProjectService,
   Project,
   ProgressType,
+  ParticipantType,
   PageableC3Type,
   PageC3Type,
   OsApiPlugin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinotic-ai/os-api",
-  "version": "1.6.1",
+  "version": "1.8.0",
   "type": "module",
   "files": [
     "dist"
@@ -33,15 +33,15 @@
     "ui-test": "vitest --ui --coverage.enabled=true --mode development"
   },
   "peerDependencies": {
-    "@kinotic-ai/core": ">=1.2.0"
+    "@kinotic-ai/core": ">=1.6.0"
   },
   "dependencies": {
     "@kinotic-ai/idl": "1.0.9",
-    "@kinotic-ai/persistence": "1.2.1",
+    "@kinotic-ai/persistence": "1.3.1",
     "rxjs": "^7.8.2"
   },
   "devDependencies": {
-    "@kinotic-ai/core": "1.4.0",
+    "@kinotic-ai/core": "1.6.0",
     "@types/node": "^25.3.2",
     "@vitest/coverage-v8": "^4.0.18",
     "@vitest/runner": "^4.0.18",