@kinotic-ai/os-api 1.7.0 → 1.9.0

package/dist/index.cjs

@@ -40,6 +40,9 @@ var __export = (target, all) => {
 // packages/os-api/src/index.ts
 var exports_src = {};
 __export(exports_src, {
+  isSystemParticipant: () => isSystemParticipant,
+  isOrganizationParticipant: () => isOrganizationParticipant,
+  isApplicationParticipant: () => isApplicationParticipant,
   WorkloadStatus: () => WorkloadStatus,
   WorkloadServiceProxy: () => WorkloadServiceProxy,
   Workload: () => Workload,
@@ -59,6 +62,8 @@ __export(exports_src, {
   ProjectService: () => ProjectService,
   Project: () => Project,
   ProgressType: () => ProgressType,
+  PendingInviteSummary: () => PendingInviteSummary,
+  ParticipantType: () => ParticipantType,
   PageableC3Type: () => PageableC3Type,
   PageC3Type: () => PageC3Type,
   OsApiPlugin: () => OsApiPlugin,
@@ -69,13 +74,13 @@ __export(exports_src, {
   NamedQueriesDefinitionService: () => NamedQueriesDefinitionService,
   NamedQueriesDefinition: () => NamedQueriesDefinition,
   MigrationService: () => MigrationService,
+  MemberService: () => MemberService,
   LoggersDescriptor: () => LoggersDescriptor,
   LoggerLevelsDescriptor: () => LoggerLevelsDescriptor,
   LogManager: () => LogManager,
   LogLevel: () => LogLevel,
   KinoticProjectConfig: () => KinoticProjectConfig,
   IdDecorator: () => IdDecorator,
-  IamUserService: () => IamUserService,
   IamUser: () => IamUser,
   GroupLoggerLevelsDescriptor: () => GroupLoggerLevelsDescriptor,
   GitHubToken: () => GitHubToken,
@@ -278,6 +283,7 @@ class Application {
   id;
   organizationId;
   description;
+  tenantPerUser = false;
   updated = null;
   constructor(id, description) {
     this.id = id;
@@ -456,6 +462,16 @@ class IamUser {
   created = null;
   updated = null;
 }
+// packages/os-api/src/api/model/iam/PendingInviteSummary.ts
+class PendingInviteSummary {
+  id = null;
+  email = "";
+  displayName = null;
+  applicationId = null;
+  invitedByName = null;
+  created = null;
+  expiresAt = null;
+}
 // packages/os-api/src/api/model/github/GitHubAppInstallation.ts
 class GitHubAppInstallation {
   id = null;
@@ -493,6 +509,26 @@ class KinoticProjectConfig {
   fileExtensionForImports = ".js";
   validate;
 }
+// packages/os-api/src/api/security/ParticipantType.ts
+var ParticipantType;
+((ParticipantType2) => {
+  ParticipantType2["SYSTEM"] = "system";
+  ParticipantType2["ORGANIZATION"] = "organization";
+  ParticipantType2["APPLICATION"] = "application";
+})(ParticipantType ||= {});
+// packages/os-api/src/api/security/ParticipantGuards.ts
+function scopeType(participant) {
+  return participant.type;
+}
+function isSystemParticipant(participant) {
+  return scopeType(participant) === "system" /* SYSTEM */;
+}
+function isOrganizationParticipant(participant) {
+  return scopeType(participant) === "organization" /* ORGANIZATION */;
+}
+function isApplicationParticipant(participant) {
+  return scopeType(participant) === "application" /* APPLICATION */;
+}
 // packages/os-api/src/api/services/IApplicationService.ts
 var import_core = require("@kinotic-ai/core");
 
@@ -709,27 +745,43 @@ class WorkloadServiceProxy extends import_core7.CrudServiceProxy {
     return this.serviceProxy.invoke("syncIndex", []);
   }
 }
-// packages/os-api/src/api/services/IIamUserService.ts
+// packages/os-api/src/api/services/IMemberService.ts
 var import_core8 = require("@kinotic-ai/core");
 
-class IamUserService extends import_core8.CrudServiceProxy {
+class MemberService {
+  serviceProxy;
   constructor(kinotic) {
-    super(kinotic.serviceProxy("org.kinotic.domain.api.services.iam.IamUserService"));
+    this.serviceProxy = kinotic.serviceProxy("org.kinotic.os.api.services.iam.MemberService");
+  }
+  async findMembers(applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("findMembers", [applicationId, pageable]);
+    return new import_core8.FunctionalIterablePage(pageable, page, (next) => this.serviceProxy.invoke("findMembers", [applicationId, next]));
   }
-  findByEmail(email, organizationId, applicationId) {
-    return arguments.length >= 3 ? this.serviceProxy.invoke("findByEmail", [email, organizationId, applicationId]) : this.serviceProxy.invoke("findByEmail", [email]);
+  async searchMembers(searchText, applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("searchMembers", [searchText, applicationId, pageable]);
+    return new import_core8.FunctionalIterablePage(pageable, page, (next) => this.serviceProxy.invoke("searchMembers", [searchText, applicationId, next]));
   }
-  findFirstOrgUserByEmail(email) {
-    return this.serviceProxy.invoke("findFirstOrgUserByEmail", [email]);
+  inviteMember(email, displayName, applicationId) {
+    return this.serviceProxy.invoke("inviteMember", [email, displayName, applicationId]);
   }
-  findByOidcIdentity(oidcSubject, oidcConfigId, organizationId, applicationId) {
-    return this.serviceProxy.invoke("findByOidcIdentity", [oidcSubject, oidcConfigId, organizationId, applicationId]);
+  setMemberEnabled(userId, enabled) {
+    return this.serviceProxy.invoke("setMemberEnabled", [userId, enabled]);
   }
-  findAllByOidcIdentity(oidcSubject, oidcConfigId) {
-    return this.serviceProxy.invoke("findAllByOidcIdentity", [oidcSubject, oidcConfigId]);
+  removeMember(userId) {
+    return this.serviceProxy.invoke("removeMember", [userId]);
   }
-  createUser(user, password) {
-    return this.serviceProxy.invoke("createUser", [user, password]);
+  async findPendingInvites(applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("findPendingInvites", [applicationId, pageable]);
+    return new import_core8.FunctionalIterablePage(pageable, page, (next) => this.serviceProxy.invoke("findPendingInvites", [applicationId, next]));
+  }
+  cancelInvite(inviteId) {
+    return this.serviceProxy.invoke("cancelInvite", [inviteId]);
+  }
+  memberDataSource(applicationId) {
+    return {
+      findAll: (pageable) => this.findMembers(applicationId, pageable),
+      search: (searchText, pageable) => this.searchMembers(searchText, applicationId, pageable)
+    };
   }
 }
 // packages/os-api/src/api/services/IDeviceApprovalService.ts
@@ -773,7 +825,7 @@ var OsApiPlugin = {
       dataInsights: new DataInsightsService(kinotic),
       vmNodes: new VmNodeServiceProxy(kinotic),
       workloads: new WorkloadServiceProxy(kinotic),
-      iamUsers: new IamUserService(kinotic),
+      members: new MemberService(kinotic),
       deviceApproval: new DeviceApprovalService(kinotic),
       githubAppInstallations: new GitHubAppInstallationService(kinotic)
     };

package/dist/index.d.cts

@@ -145,6 +145,12 @@ declare class Application implements Identifiable<string> {
 	*/
 	organizationId: string;
 	description: string;
+	/**
+	* When true, every APPLICATION-scope user created for this application receives an
+	* auto-generated unique tenantId, isolating each user's SHARED entity data in its own
+	* tenant. Applies only to users created after it is enabled.
+	*/
+	tenantPerUser: boolean;
 	updated: number | null;
 	constructor(id: string, description: string);
 }
@@ -585,12 +591,31 @@ interface CompleteOrgRequest {
 }
 import { Identifiable as Identifiable9 } from "@kinotic-ai/core";
 /**
+* Console view of a pending invitation. Deliberately excludes the accept token — anyone who
+* can list invitations must not be able to redeem them.
+*/
+declare class PendingInviteSummary implements Identifiable9<string> {
+	id: string | null;
+	/** Email the invitation was sent to. */
+	email: string;
+	/** Display name the inviter entered, if any. */
+	displayName: string | null;
+	/** The application the invitee would join; null for an organization-member invite. */
+	applicationId: string | null;
+	/** Display name of the member who sent the invitation. */
+	invitedByName: string | null;
+	created: number | null;
+	/** When the invitation stops being acceptable. */
+	expiresAt: number | null;
+}
+import { Identifiable as Identifiable10 } from "@kinotic-ai/core";
+/**
 * Persisted record of one GitHub App installation that a Kinotic Org has authorised.
 * The durable binding that says "Org X has access to GitHub install Y" — without it,
 * no installation token can be minted on behalf of the org and webhook deliveries
 * can't be matched to a project.
 */
-declare class GitHubAppInstallation implements Identifiable9<string> {
+declare class GitHubAppInstallation implements Identifiable10<string> {
 	id: string | null;
 	organizationId: string;
 	githubInstallationId: number;
@@ -696,6 +721,78 @@ declare class KinoticProjectConfig {
 	*/
 	validate?: boolean;
 }
+/**
+* Identifies which scope layer a participant authenticated against. The server serializes this as
+* the {@code type} discriminator on a participant, and it is used to narrow a base
+* {@code IParticipant} to one of the scope-typed participant interfaces.
+*/
+declare enum ParticipantType {
+	SYSTEM = "system",
+	ORGANIZATION = "organization",
+	APPLICATION = "application"
+}
+import { IParticipant } from "@kinotic-ai/core";
+/**
+* A participant authenticated against the platform SYSTEM scope — a platform operator with no
+* organization or application context. Mirrors the server {@code SystemParticipant}.
+*/
+interface ISystemParticipant extends IParticipant {
+	type: ParticipantType.SYSTEM;
+}
+import { IParticipant as IParticipant2 } from "@kinotic-ai/core";
+/**
+* A participant authenticated against an Organization, carrying ORGANIZATION-scope authority over
+* that Organization's resources. {@link organizationId} is the id of the owning Organization and
+* is never null. Mirrors the server {@code OrganizationParticipant}.
+*/
+interface IOrganizationParticipant extends IParticipant2 {
+	type: ParticipantType.ORGANIZATION;
+	/**
+	* The id of the Organization this participant is authenticated under; never null.
+	*/
+	organizationId: string;
+}
+import { IParticipant as IParticipant3 } from "@kinotic-ai/core";
+/**
+* A participant authenticated against an Application, carrying APPLICATION-scope authority over
+* that Application's own resources and end-user data. {@link organizationId} is the id of the
+* Organization that owns the Application; it identifies the owning org for data ownership and
+* routing of the Application's entity definitions and end-user data, and is never null.
+* Mirrors the server {@code ApplicationParticipant}.
+*/
+interface IApplicationParticipant extends IParticipant3 {
+	type: ParticipantType.APPLICATION;
+	/**
+	* The id of the Organization that owns the Application this participant is authenticated
+	* under; never null.
+	*/
+	organizationId: string;
+	/**
+	* The id of the Application this participant is authenticated under; never null.
+	*/
+	applicationId: string;
+	/**
+	* The tenant slice of the Application's end-user data this participant belongs to, or null
+	* when the Application is not multi-tenant.
+	*/
+	tenantId?: string | null;
+}
+import { IParticipant as IParticipant4 } from "@kinotic-ai/core";
+/**
+* @return true if the participant authenticated against the platform SYSTEM scope
+*/
+declare function isSystemParticipant(participant: IParticipant4): participant is ISystemParticipant;
+/**
+* Narrows to an {@link IOrganizationParticipant}, which carries an {@code organizationId} and
+* ORGANIZATION-scope authority.
+*
+* @return true if the participant authenticated against an Organization
+*/
+declare function isOrganizationParticipant(participant: IParticipant4): participant is IOrganizationParticipant;
+/**
+* @return true if the participant authenticated against an Application
+*/
+declare function isApplicationParticipant(participant: IParticipant4): participant is IApplicationParticipant;
 import { IKinotic } from "@kinotic-ai/core";
 import { CrudServiceProxy, ICrudServiceProxy } from "@kinotic-ai/core";
 interface IApplicationService extends ICrudServiceProxy<Application> {
@@ -1015,46 +1112,55 @@ declare class WorkloadServiceProxy extends CrudServiceProxy7<Workload> implement
 	countForNode(nodeId: string): Promise<number>;
 	syncIndex(): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+import { IDataSource, IKinotic as IKinotic11, IterablePage as IterablePage4, Pageable as Pageable4 } from "@kinotic-ai/core";
 /**
-* Client proxy for the server's {@code IamUserService}; method shapes mirror the Java interface.
-*
-* NOTE: the server interface now lives in {@code kinotic-domain} and is not currently
-* {@code @Publish}-annotated, so this proxy is not callable over RPC until the backend publishes
-* the service. The shape here is kept in sync so it is ready once that happens; confirm the
-* published namespace before relying on it.
+* Member management for the caller's organization and its applications. Scope is selected
+* with applicationId — null addresses org members, set addresses that application's
+* members — and the backend derives the organization from the authenticated participant,
+* so it is never a parameter.
 */
-interface IIamUserService extends ICrudServiceProxy8<IamUser> {
-	/** Finds the first user with the given email across all scopes, or null. */
-	findByEmail(email: string): Promise<IamUser | null>;
+interface IMemberService {
+	/** Lists the members of the scope. */
+	findMembers(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
 	/**
-	* Finds the user with the given email within a scope identified structurally by
-	* (organizationId, applicationId): both null → SYSTEM, organizationId only → ORGANIZATION,
-	* both set → APPLICATION.
+	* Searches the scope's members by free text over email and display name. Blank
+	* searchText is equivalent to {@link findMembers}.
 	*/
-	findByEmail(email: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	searchMembers(searchText: string, applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
 	/**
-	* Finds the first ORGANIZATION-scope user with the given email across all organizations.
-	* Used by sign-up to enforce one user per email before the new org's id exists.
+	* Invites someone into the scope by email. Sends the invitation email and returns the
+	* pending invitation. Rejects when the email already has an account in the scope or an
+	* invitation is already pending for it.
 	*/
-	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
+	inviteMember(email: string, displayName: string | null, applicationId: string | null): Promise<PendingInviteSummary>;
 	/**
-	* Finds the user (if any) with the given OIDC identity within a specific scope, using the
-	* same (organizationId, applicationId) null conventions as {@link findByEmail}.
+	* Enables or disables a member of the caller's organization. Disabling gates future
+	* logins; established sessions last until they expire. Callers cannot disable themselves.
 	*/
-	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
-	/** Finds every user across scopes for a given OIDC identity — e.g. the orgs it can access. */
-	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
-	/** Creates a user and, if a password is provided, the matching credential. */
-	createUser(user: IamUser, password: string | null): Promise<IamUser>;
+	setMemberEnabled(userId: string, enabled: boolean): Promise<void>;
+	/**
+	* Permanently removes a member of the caller's organization, including any stored
+	* credential. Callers cannot remove themselves.
+	*/
+	removeMember(userId: string): Promise<void>;
+	/** Lists the scope's live (unexpired) pending invitations. */
+	findPendingInvites(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<PendingInviteSummary>>;
+	/** Cancels a pending invitation belonging to the caller's organization. */
+	cancelInvite(inviteId: string): Promise<void>;
+	/** An {@link IDataSource} over the scope's members, for table components. */
+	memberDataSource(applicationId: string | null): IDataSource<IamUser>;
 }
-declare class IamUserService extends CrudServiceProxy8<IamUser> implements IIamUserService {
+declare class MemberService implements IMemberService {
+	private readonly serviceProxy;
 	constructor(kinotic: IKinotic11);
-	findByEmail(email: string, organizationId?: string | null, applicationId?: string | null): Promise<IamUser | null>;
-	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
-	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
-	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
-	createUser(user: IamUser, password: string | null): Promise<IamUser>;
+	findMembers(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	searchMembers(searchText: string, applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	inviteMember(email: string, displayName: string | null, applicationId: string | null): Promise<PendingInviteSummary>;
+	setMemberEnabled(userId: string, enabled: boolean): Promise<void>;
+	removeMember(userId: string): Promise<void>;
+	findPendingInvites(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<PendingInviteSummary>>;
+	cancelInvite(inviteId: string): Promise<void>;
+	memberDataSource(applicationId: string | null): IDataSource<IamUser>;
 }
 import { IKinotic as IKinotic12 } from "@kinotic-ai/core";
 /**
@@ -1074,8 +1180,8 @@ declare class DeviceApprovalService implements IDeviceApprovalService {
 	constructor(kinotic: IKinotic12);
 	approve(userCode: string): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy9, IKinotic as IKinotic13, ICrudServiceProxy as ICrudServiceProxy9 } from "@kinotic-ai/core";
-interface IGitHubAppInstallationService extends ICrudServiceProxy9<GitHubAppInstallation> {
+import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic13, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+interface IGitHubAppInstallationService extends ICrudServiceProxy8<GitHubAppInstallation> {
 	/**
 	* Stages a single-use state token bound to the caller's organization plus the
 	* supplied returnTo, then returns the GitHub install URL with that state
@@ -1100,7 +1206,7 @@ interface IGitHubAppInstallationService extends ICrudServiceProxy9<GitHubAppInst
 	*/
 	findForCurrentOrg(): Promise<GitHubAppInstallation | null>;
 }
-declare class GitHubAppInstallationService extends CrudServiceProxy9<GitHubAppInstallation> implements IGitHubAppInstallationService {
+declare class GitHubAppInstallationService extends CrudServiceProxy8<GitHubAppInstallation> implements IGitHubAppInstallationService {
 	constructor(kinotic: IKinotic13);
 	startInstall(returnTo: string | null): Promise<string>;
 	completeInstall(installationId: number, state: string): Promise<GitHubInstallCompletion>;
@@ -1118,7 +1224,7 @@ interface IOsApiExtension {
 	dataInsights: IDataInsightsService;
 	vmNodes: IVmNodeService;
 	workloads: IWorkloadService;
-	iamUsers: IIamUserService;
+	members: IMemberService;
 	deviceApproval: IDeviceApprovalService;
 	githubAppInstallations: IGitHubAppInstallationService;
 }
@@ -1126,4 +1232,4 @@ declare const OsApiPlugin: KinoticPlugin<IOsApiExtension>;
 declare module "@kinotic-ai/core" {
 	interface KinoticSingleton extends IOsApiExtension {}
 }
-export { WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, IProjectService, IOsApiExtension, IOrganizationService, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };
+export { isSystemParticipant, isOrganizationParticipant, isApplicationParticipant, WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PendingInviteSummary, ParticipantType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, MemberService, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUser, IWorkloadService, IVmNodeService, ISystemParticipant, IProjectService, IOsApiExtension, IOrganizationService, IOrganizationParticipant, INamedQueriesDefinitionService, IMigrationService, IMemberService, ILogManager, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, IApplicationParticipant, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };

package/dist/index.d.ts

@@ -145,6 +145,12 @@ declare class Application implements Identifiable<string> {
 	*/
 	organizationId: string;
 	description: string;
+	/**
+	* When true, every APPLICATION-scope user created for this application receives an
+	* auto-generated unique tenantId, isolating each user's SHARED entity data in its own
+	* tenant. Applies only to users created after it is enabled.
+	*/
+	tenantPerUser: boolean;
 	updated: number | null;
 	constructor(id: string, description: string);
 }
@@ -585,12 +591,31 @@ interface CompleteOrgRequest {
 }
 import { Identifiable as Identifiable9 } from "@kinotic-ai/core";
 /**
+* Console view of a pending invitation. Deliberately excludes the accept token — anyone who
+* can list invitations must not be able to redeem them.
+*/
+declare class PendingInviteSummary implements Identifiable9<string> {
+	id: string | null;
+	/** Email the invitation was sent to. */
+	email: string;
+	/** Display name the inviter entered, if any. */
+	displayName: string | null;
+	/** The application the invitee would join; null for an organization-member invite. */
+	applicationId: string | null;
+	/** Display name of the member who sent the invitation. */
+	invitedByName: string | null;
+	created: number | null;
+	/** When the invitation stops being acceptable. */
+	expiresAt: number | null;
+}
+import { Identifiable as Identifiable10 } from "@kinotic-ai/core";
+/**
 * Persisted record of one GitHub App installation that a Kinotic Org has authorised.
 * The durable binding that says "Org X has access to GitHub install Y" — without it,
 * no installation token can be minted on behalf of the org and webhook deliveries
 * can't be matched to a project.
 */
-declare class GitHubAppInstallation implements Identifiable9<string> {
+declare class GitHubAppInstallation implements Identifiable10<string> {
 	id: string | null;
 	organizationId: string;
 	githubInstallationId: number;
@@ -696,6 +721,78 @@ declare class KinoticProjectConfig {
 	*/
 	validate?: boolean;
 }
+/**
+* Identifies which scope layer a participant authenticated against. The server serializes this as
+* the {@code type} discriminator on a participant, and it is used to narrow a base
+* {@code IParticipant} to one of the scope-typed participant interfaces.
+*/
+declare enum ParticipantType {
+	SYSTEM = "system",
+	ORGANIZATION = "organization",
+	APPLICATION = "application"
+}
+import { IParticipant } from "@kinotic-ai/core";
+/**
+* A participant authenticated against the platform SYSTEM scope — a platform operator with no
+* organization or application context. Mirrors the server {@code SystemParticipant}.
+*/
+interface ISystemParticipant extends IParticipant {
+	type: ParticipantType.SYSTEM;
+}
+import { IParticipant as IParticipant2 } from "@kinotic-ai/core";
+/**
+* A participant authenticated against an Organization, carrying ORGANIZATION-scope authority over
+* that Organization's resources. {@link organizationId} is the id of the owning Organization and
+* is never null. Mirrors the server {@code OrganizationParticipant}.
+*/
+interface IOrganizationParticipant extends IParticipant2 {
+	type: ParticipantType.ORGANIZATION;
+	/**
+	* The id of the Organization this participant is authenticated under; never null.
+	*/
+	organizationId: string;
+}
+import { IParticipant as IParticipant3 } from "@kinotic-ai/core";
+/**
+* A participant authenticated against an Application, carrying APPLICATION-scope authority over
+* that Application's own resources and end-user data. {@link organizationId} is the id of the
+* Organization that owns the Application; it identifies the owning org for data ownership and
+* routing of the Application's entity definitions and end-user data, and is never null.
+* Mirrors the server {@code ApplicationParticipant}.
+*/
+interface IApplicationParticipant extends IParticipant3 {
+	type: ParticipantType.APPLICATION;
+	/**
+	* The id of the Organization that owns the Application this participant is authenticated
+	* under; never null.
+	*/
+	organizationId: string;
+	/**
+	* The id of the Application this participant is authenticated under; never null.
+	*/
+	applicationId: string;
+	/**
+	* The tenant slice of the Application's end-user data this participant belongs to, or null
+	* when the Application is not multi-tenant.
+	*/
+	tenantId?: string | null;
+}
+import { IParticipant as IParticipant4 } from "@kinotic-ai/core";
+/**
+* @return true if the participant authenticated against the platform SYSTEM scope
+*/
+declare function isSystemParticipant(participant: IParticipant4): participant is ISystemParticipant;
+/**
+* Narrows to an {@link IOrganizationParticipant}, which carries an {@code organizationId} and
+* ORGANIZATION-scope authority.
+*
+* @return true if the participant authenticated against an Organization
+*/
+declare function isOrganizationParticipant(participant: IParticipant4): participant is IOrganizationParticipant;
+/**
+* @return true if the participant authenticated against an Application
+*/
+declare function isApplicationParticipant(participant: IParticipant4): participant is IApplicationParticipant;
 import { IKinotic } from "@kinotic-ai/core";
 import { CrudServiceProxy, ICrudServiceProxy } from "@kinotic-ai/core";
 interface IApplicationService extends ICrudServiceProxy<Application> {
@@ -1015,46 +1112,55 @@ declare class WorkloadServiceProxy extends CrudServiceProxy7<Workload> implement
 	countForNode(nodeId: string): Promise<number>;
 	syncIndex(): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+import { IDataSource, IKinotic as IKinotic11, IterablePage as IterablePage4, Pageable as Pageable4 } from "@kinotic-ai/core";
 /**
-* Client proxy for the server's {@code IamUserService}; method shapes mirror the Java interface.
-*
-* NOTE: the server interface now lives in {@code kinotic-domain} and is not currently
-* {@code @Publish}-annotated, so this proxy is not callable over RPC until the backend publishes
-* the service. The shape here is kept in sync so it is ready once that happens; confirm the
-* published namespace before relying on it.
+* Member management for the caller's organization and its applications. Scope is selected
+* with applicationId — null addresses org members, set addresses that application's
+* members — and the backend derives the organization from the authenticated participant,
+* so it is never a parameter.
 */
-interface IIamUserService extends ICrudServiceProxy8<IamUser> {
-	/** Finds the first user with the given email across all scopes, or null. */
-	findByEmail(email: string): Promise<IamUser | null>;
+interface IMemberService {
+	/** Lists the members of the scope. */
+	findMembers(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
 	/**
-	* Finds the user with the given email within a scope identified structurally by
-	* (organizationId, applicationId): both null → SYSTEM, organizationId only → ORGANIZATION,
-	* both set → APPLICATION.
+	* Searches the scope's members by free text over email and display name. Blank
+	* searchText is equivalent to {@link findMembers}.
 	*/
-	findByEmail(email: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	searchMembers(searchText: string, applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
 	/**
-	* Finds the first ORGANIZATION-scope user with the given email across all organizations.
-	* Used by sign-up to enforce one user per email before the new org's id exists.
+	* Invites someone into the scope by email. Sends the invitation email and returns the
+	* pending invitation. Rejects when the email already has an account in the scope or an
+	* invitation is already pending for it.
 	*/
-	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
+	inviteMember(email: string, displayName: string | null, applicationId: string | null): Promise<PendingInviteSummary>;
 	/**
-	* Finds the user (if any) with the given OIDC identity within a specific scope, using the
-	* same (organizationId, applicationId) null conventions as {@link findByEmail}.
+	* Enables or disables a member of the caller's organization. Disabling gates future
+	* logins; established sessions last until they expire. Callers cannot disable themselves.
 	*/
-	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
-	/** Finds every user across scopes for a given OIDC identity — e.g. the orgs it can access. */
-	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
-	/** Creates a user and, if a password is provided, the matching credential. */
-	createUser(user: IamUser, password: string | null): Promise<IamUser>;
+	setMemberEnabled(userId: string, enabled: boolean): Promise<void>;
+	/**
+	* Permanently removes a member of the caller's organization, including any stored
+	* credential. Callers cannot remove themselves.
+	*/
+	removeMember(userId: string): Promise<void>;
+	/** Lists the scope's live (unexpired) pending invitations. */
+	findPendingInvites(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<PendingInviteSummary>>;
+	/** Cancels a pending invitation belonging to the caller's organization. */
+	cancelInvite(inviteId: string): Promise<void>;
+	/** An {@link IDataSource} over the scope's members, for table components. */
+	memberDataSource(applicationId: string | null): IDataSource<IamUser>;
 }
-declare class IamUserService extends CrudServiceProxy8<IamUser> implements IIamUserService {
+declare class MemberService implements IMemberService {
+	private readonly serviceProxy;
 	constructor(kinotic: IKinotic11);
-	findByEmail(email: string, organizationId?: string | null, applicationId?: string | null): Promise<IamUser | null>;
-	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
-	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
-	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
-	createUser(user: IamUser, password: string | null): Promise<IamUser>;
+	findMembers(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	searchMembers(searchText: string, applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	inviteMember(email: string, displayName: string | null, applicationId: string | null): Promise<PendingInviteSummary>;
+	setMemberEnabled(userId: string, enabled: boolean): Promise<void>;
+	removeMember(userId: string): Promise<void>;
+	findPendingInvites(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<PendingInviteSummary>>;
+	cancelInvite(inviteId: string): Promise<void>;
+	memberDataSource(applicationId: string | null): IDataSource<IamUser>;
 }
 import { IKinotic as IKinotic12 } from "@kinotic-ai/core";
 /**
@@ -1074,8 +1180,8 @@ declare class DeviceApprovalService implements IDeviceApprovalService {
 	constructor(kinotic: IKinotic12);
 	approve(userCode: string): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy9, IKinotic as IKinotic13, ICrudServiceProxy as ICrudServiceProxy9 } from "@kinotic-ai/core";
-interface IGitHubAppInstallationService extends ICrudServiceProxy9<GitHubAppInstallation> {
+import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic13, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+interface IGitHubAppInstallationService extends ICrudServiceProxy8<GitHubAppInstallation> {
 	/**
 	* Stages a single-use state token bound to the caller's organization plus the
 	* supplied returnTo, then returns the GitHub install URL with that state
@@ -1100,7 +1206,7 @@ interface IGitHubAppInstallationService extends ICrudServiceProxy9<GitHubAppInst
 	*/
 	findForCurrentOrg(): Promise<GitHubAppInstallation | null>;
 }
-declare class GitHubAppInstallationService extends CrudServiceProxy9<GitHubAppInstallation> implements IGitHubAppInstallationService {
+declare class GitHubAppInstallationService extends CrudServiceProxy8<GitHubAppInstallation> implements IGitHubAppInstallationService {
 	constructor(kinotic: IKinotic13);
 	startInstall(returnTo: string | null): Promise<string>;
 	completeInstall(installationId: number, state: string): Promise<GitHubInstallCompletion>;
@@ -1118,7 +1224,7 @@ interface IOsApiExtension {
 	dataInsights: IDataInsightsService;
 	vmNodes: IVmNodeService;
 	workloads: IWorkloadService;
-	iamUsers: IIamUserService;
+	members: IMemberService;
 	deviceApproval: IDeviceApprovalService;
 	githubAppInstallations: IGitHubAppInstallationService;
 }
@@ -1126,4 +1232,4 @@ declare const OsApiPlugin: KinoticPlugin<IOsApiExtension>;
 declare module "@kinotic-ai/core" {
 	interface KinoticSingleton extends IOsApiExtension {}
 }
-export { WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, IProjectService, IOsApiExtension, IOrganizationService, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };
+export { isSystemParticipant, isOrganizationParticipant, isApplicationParticipant, WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PendingInviteSummary, ParticipantType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, MemberService, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUser, IWorkloadService, IVmNodeService, ISystemParticipant, IProjectService, IOsApiExtension, IOrganizationService, IOrganizationParticipant, INamedQueriesDefinitionService, IMigrationService, IMemberService, ILogManager, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, IApplicationParticipant, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };

package/dist/index.js

@@ -178,6 +178,7 @@ class Application {
   id;
   organizationId;
   description;
+  tenantPerUser = false;
   updated = null;
   constructor(id, description) {
     this.id = id;
@@ -356,6 +357,16 @@ class IamUser {
   created = null;
   updated = null;
 }
+// packages/os-api/src/api/model/iam/PendingInviteSummary.ts
+class PendingInviteSummary {
+  id = null;
+  email = "";
+  displayName = null;
+  applicationId = null;
+  invitedByName = null;
+  created = null;
+  expiresAt = null;
+}
 // packages/os-api/src/api/model/github/GitHubAppInstallation.ts
 class GitHubAppInstallation {
   id = null;
@@ -393,6 +404,26 @@ class KinoticProjectConfig {
   fileExtensionForImports = ".js";
   validate;
 }
+// packages/os-api/src/api/security/ParticipantType.ts
+var ParticipantType;
+((ParticipantType2) => {
+  ParticipantType2["SYSTEM"] = "system";
+  ParticipantType2["ORGANIZATION"] = "organization";
+  ParticipantType2["APPLICATION"] = "application";
+})(ParticipantType ||= {});
+// packages/os-api/src/api/security/ParticipantGuards.ts
+function scopeType(participant) {
+  return participant.type;
+}
+function isSystemParticipant(participant) {
+  return scopeType(participant) === "system" /* SYSTEM */;
+}
+function isOrganizationParticipant(participant) {
+  return scopeType(participant) === "organization" /* ORGANIZATION */;
+}
+function isApplicationParticipant(participant) {
+  return scopeType(participant) === "application" /* APPLICATION */;
+}
 // packages/os-api/src/api/services/IApplicationService.ts
 import { CrudServiceProxy } from "@kinotic-ai/core";
 
@@ -609,27 +640,45 @@ class WorkloadServiceProxy extends CrudServiceProxy7 {
     return this.serviceProxy.invoke("syncIndex", []);
   }
 }
-// packages/os-api/src/api/services/IIamUserService.ts
-import { CrudServiceProxy as CrudServiceProxy8 } from "@kinotic-ai/core";
+// packages/os-api/src/api/services/IMemberService.ts
+import {
+  FunctionalIterablePage as FunctionalIterablePage4
+} from "@kinotic-ai/core";
 
-class IamUserService extends CrudServiceProxy8 {
+class MemberService {
+  serviceProxy;
   constructor(kinotic) {
-    super(kinotic.serviceProxy("org.kinotic.domain.api.services.iam.IamUserService"));
+    this.serviceProxy = kinotic.serviceProxy("org.kinotic.os.api.services.iam.MemberService");
+  }
+  async findMembers(applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("findMembers", [applicationId, pageable]);
+    return new FunctionalIterablePage4(pageable, page, (next) => this.serviceProxy.invoke("findMembers", [applicationId, next]));
+  }
+  async searchMembers(searchText, applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("searchMembers", [searchText, applicationId, pageable]);
+    return new FunctionalIterablePage4(pageable, page, (next) => this.serviceProxy.invoke("searchMembers", [searchText, applicationId, next]));
   }
-  findByEmail(email, organizationId, applicationId) {
-    return arguments.length >= 3 ? this.serviceProxy.invoke("findByEmail", [email, organizationId, applicationId]) : this.serviceProxy.invoke("findByEmail", [email]);
+  inviteMember(email, displayName, applicationId) {
+    return this.serviceProxy.invoke("inviteMember", [email, displayName, applicationId]);
   }
-  findFirstOrgUserByEmail(email) {
-    return this.serviceProxy.invoke("findFirstOrgUserByEmail", [email]);
+  setMemberEnabled(userId, enabled) {
+    return this.serviceProxy.invoke("setMemberEnabled", [userId, enabled]);
   }
-  findByOidcIdentity(oidcSubject, oidcConfigId, organizationId, applicationId) {
-    return this.serviceProxy.invoke("findByOidcIdentity", [oidcSubject, oidcConfigId, organizationId, applicationId]);
+  removeMember(userId) {
+    return this.serviceProxy.invoke("removeMember", [userId]);
   }
-  findAllByOidcIdentity(oidcSubject, oidcConfigId) {
-    return this.serviceProxy.invoke("findAllByOidcIdentity", [oidcSubject, oidcConfigId]);
+  async findPendingInvites(applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("findPendingInvites", [applicationId, pageable]);
+    return new FunctionalIterablePage4(pageable, page, (next) => this.serviceProxy.invoke("findPendingInvites", [applicationId, next]));
   }
-  createUser(user, password) {
-    return this.serviceProxy.invoke("createUser", [user, password]);
+  cancelInvite(inviteId) {
+    return this.serviceProxy.invoke("cancelInvite", [inviteId]);
+  }
+  memberDataSource(applicationId) {
+    return {
+      findAll: (pageable) => this.findMembers(applicationId, pageable),
+      search: (searchText, pageable) => this.searchMembers(searchText, applicationId, pageable)
+    };
   }
 }
 // packages/os-api/src/api/services/IDeviceApprovalService.ts
@@ -643,9 +692,9 @@ class DeviceApprovalService {
   }
 }
 // packages/os-api/src/api/services/IGitHubAppInstallationService.ts
-import { CrudServiceProxy as CrudServiceProxy9 } from "@kinotic-ai/core";
+import { CrudServiceProxy as CrudServiceProxy8 } from "@kinotic-ai/core";
 
-class GitHubAppInstallationService extends CrudServiceProxy9 {
+class GitHubAppInstallationService extends CrudServiceProxy8 {
   constructor(kinotic) {
     super(kinotic.serviceProxy("org.kinotic.github.api.services.GitHubAppInstallationService"));
   }
@@ -673,13 +722,16 @@ var OsApiPlugin = {
       dataInsights: new DataInsightsService(kinotic),
       vmNodes: new VmNodeServiceProxy(kinotic),
       workloads: new WorkloadServiceProxy(kinotic),
-      iamUsers: new IamUserService(kinotic),
+      members: new MemberService(kinotic),
       deviceApproval: new DeviceApprovalService(kinotic),
       githubAppInstallations: new GitHubAppInstallationService(kinotic)
     };
   }
 };
 export {
+  isSystemParticipant,
+  isOrganizationParticipant,
+  isApplicationParticipant,
   WorkloadStatus,
   WorkloadServiceProxy,
   Workload,
@@ -699,6 +751,8 @@ export {
   ProjectService,
   Project,
   ProgressType,
+  PendingInviteSummary,
+  ParticipantType,
   PageableC3Type,
   PageC3Type,
   OsApiPlugin,
@@ -709,13 +763,13 @@ export {
   NamedQueriesDefinitionService,
   NamedQueriesDefinition,
   MigrationService,
+  MemberService,
   LoggersDescriptor,
   LoggerLevelsDescriptor,
   LogManager,
   LogLevel,
   KinoticProjectConfig,
   IdDecorator,
-  IamUserService,
   IamUser,
   GroupLoggerLevelsDescriptor,
   GitHubToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinotic-ai/os-api",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "type": "module",
   "files": [
     "dist"
@@ -33,15 +33,15 @@
     "ui-test": "vitest --ui --coverage.enabled=true --mode development"
   },
   "peerDependencies": {
-    "@kinotic-ai/core": ">=1.4.0"
+    "@kinotic-ai/core": ">=1.6.0"
   },
   "dependencies": {
     "@kinotic-ai/idl": "1.0.9",
-    "@kinotic-ai/persistence": "1.3.0",
+    "@kinotic-ai/persistence": "1.3.1",
     "rxjs": "^7.8.2"
   },
   "devDependencies": {
-    "@kinotic-ai/core": "1.4.0",
+    "@kinotic-ai/core": "1.6.2",
     "@types/node": "^25.3.2",
     "@vitest/coverage-v8": "^4.0.18",
     "@vitest/runner": "^4.0.18",