@kinotic-ai/os-api 1.8.0 → 1.9.0

package/dist/index.cjs

@@ -62,6 +62,7 @@ __export(exports_src, {
   ProjectService: () => ProjectService,
   Project: () => Project,
   ProgressType: () => ProgressType,
+  PendingInviteSummary: () => PendingInviteSummary,
   ParticipantType: () => ParticipantType,
   PageableC3Type: () => PageableC3Type,
   PageC3Type: () => PageC3Type,
@@ -73,13 +74,13 @@ __export(exports_src, {
   NamedQueriesDefinitionService: () => NamedQueriesDefinitionService,
   NamedQueriesDefinition: () => NamedQueriesDefinition,
   MigrationService: () => MigrationService,
+  MemberService: () => MemberService,
   LoggersDescriptor: () => LoggersDescriptor,
   LoggerLevelsDescriptor: () => LoggerLevelsDescriptor,
   LogManager: () => LogManager,
   LogLevel: () => LogLevel,
   KinoticProjectConfig: () => KinoticProjectConfig,
   IdDecorator: () => IdDecorator,
-  IamUserService: () => IamUserService,
   IamUser: () => IamUser,
   GroupLoggerLevelsDescriptor: () => GroupLoggerLevelsDescriptor,
   GitHubToken: () => GitHubToken,
@@ -282,6 +283,7 @@ class Application {
   id;
   organizationId;
   description;
+  tenantPerUser = false;
   updated = null;
   constructor(id, description) {
     this.id = id;
@@ -460,6 +462,16 @@ class IamUser {
   created = null;
   updated = null;
 }
+// packages/os-api/src/api/model/iam/PendingInviteSummary.ts
+class PendingInviteSummary {
+  id = null;
+  email = "";
+  displayName = null;
+  applicationId = null;
+  invitedByName = null;
+  created = null;
+  expiresAt = null;
+}
 // packages/os-api/src/api/model/github/GitHubAppInstallation.ts
 class GitHubAppInstallation {
   id = null;
@@ -512,8 +524,7 @@ function isSystemParticipant(participant) {
   return scopeType(participant) === "system" /* SYSTEM */;
 }
 function isOrganizationParticipant(participant) {
-  const type = scopeType(participant);
-  return type === "organization" /* ORGANIZATION */ || type === "application" /* APPLICATION */;
+  return scopeType(participant) === "organization" /* ORGANIZATION */;
 }
 function isApplicationParticipant(participant) {
   return scopeType(participant) === "application" /* APPLICATION */;
@@ -734,27 +745,43 @@ class WorkloadServiceProxy extends import_core7.CrudServiceProxy {
     return this.serviceProxy.invoke("syncIndex", []);
   }
 }
-// packages/os-api/src/api/services/IIamUserService.ts
+// packages/os-api/src/api/services/IMemberService.ts
 var import_core8 = require("@kinotic-ai/core");
 
-class IamUserService extends import_core8.CrudServiceProxy {
+class MemberService {
+  serviceProxy;
   constructor(kinotic) {
-    super(kinotic.serviceProxy("org.kinotic.domain.api.services.iam.IamUserService"));
+    this.serviceProxy = kinotic.serviceProxy("org.kinotic.os.api.services.iam.MemberService");
+  }
+  async findMembers(applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("findMembers", [applicationId, pageable]);
+    return new import_core8.FunctionalIterablePage(pageable, page, (next) => this.serviceProxy.invoke("findMembers", [applicationId, next]));
+  }
+  async searchMembers(searchText, applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("searchMembers", [searchText, applicationId, pageable]);
+    return new import_core8.FunctionalIterablePage(pageable, page, (next) => this.serviceProxy.invoke("searchMembers", [searchText, applicationId, next]));
   }
-  findByEmail(email, organizationId, applicationId) {
-    return arguments.length >= 3 ? this.serviceProxy.invoke("findByEmail", [email, organizationId, applicationId]) : this.serviceProxy.invoke("findByEmail", [email]);
+  inviteMember(email, displayName, applicationId) {
+    return this.serviceProxy.invoke("inviteMember", [email, displayName, applicationId]);
   }
-  findFirstOrgUserByEmail(email) {
-    return this.serviceProxy.invoke("findFirstOrgUserByEmail", [email]);
+  setMemberEnabled(userId, enabled) {
+    return this.serviceProxy.invoke("setMemberEnabled", [userId, enabled]);
   }
-  findByOidcIdentity(oidcSubject, oidcConfigId, organizationId, applicationId) {
-    return this.serviceProxy.invoke("findByOidcIdentity", [oidcSubject, oidcConfigId, organizationId, applicationId]);
+  removeMember(userId) {
+    return this.serviceProxy.invoke("removeMember", [userId]);
   }
-  findAllByOidcIdentity(oidcSubject, oidcConfigId) {
-    return this.serviceProxy.invoke("findAllByOidcIdentity", [oidcSubject, oidcConfigId]);
+  async findPendingInvites(applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("findPendingInvites", [applicationId, pageable]);
+    return new import_core8.FunctionalIterablePage(pageable, page, (next) => this.serviceProxy.invoke("findPendingInvites", [applicationId, next]));
   }
-  createUser(user, password) {
-    return this.serviceProxy.invoke("createUser", [user, password]);
+  cancelInvite(inviteId) {
+    return this.serviceProxy.invoke("cancelInvite", [inviteId]);
+  }
+  memberDataSource(applicationId) {
+    return {
+      findAll: (pageable) => this.findMembers(applicationId, pageable),
+      search: (searchText, pageable) => this.searchMembers(searchText, applicationId, pageable)
+    };
   }
 }
 // packages/os-api/src/api/services/IDeviceApprovalService.ts
@@ -798,7 +825,7 @@ var OsApiPlugin = {
       dataInsights: new DataInsightsService(kinotic),
       vmNodes: new VmNodeServiceProxy(kinotic),
       workloads: new WorkloadServiceProxy(kinotic),
-      iamUsers: new IamUserService(kinotic),
+      members: new MemberService(kinotic),
       deviceApproval: new DeviceApprovalService(kinotic),
       githubAppInstallations: new GitHubAppInstallationService(kinotic)
     };

package/dist/index.d.cts

@@ -145,6 +145,12 @@ declare class Application implements Identifiable<string> {
 	*/
 	organizationId: string;
 	description: string;
+	/**
+	* When true, every APPLICATION-scope user created for this application receives an
+	* auto-generated unique tenantId, isolating each user's SHARED entity data in its own
+	* tenant. Applies only to users created after it is enabled.
+	*/
+	tenantPerUser: boolean;
 	updated: number | null;
 	constructor(id: string, description: string);
 }
@@ -585,12 +591,31 @@ interface CompleteOrgRequest {
 }
 import { Identifiable as Identifiable9 } from "@kinotic-ai/core";
 /**
+* Console view of a pending invitation. Deliberately excludes the accept token — anyone who
+* can list invitations must not be able to redeem them.
+*/
+declare class PendingInviteSummary implements Identifiable9<string> {
+	id: string | null;
+	/** Email the invitation was sent to. */
+	email: string;
+	/** Display name the inviter entered, if any. */
+	displayName: string | null;
+	/** The application the invitee would join; null for an organization-member invite. */
+	applicationId: string | null;
+	/** Display name of the member who sent the invitation. */
+	invitedByName: string | null;
+	created: number | null;
+	/** When the invitation stops being acceptable. */
+	expiresAt: number | null;
+}
+import { Identifiable as Identifiable10 } from "@kinotic-ai/core";
+/**
 * Persisted record of one GitHub App installation that a Kinotic Org has authorised.
 * The durable binding that says "Org X has access to GitHub install Y" — without it,
 * no installation token can be minted on behalf of the org and webhook deliveries
 * can't be matched to a project.
 */
-declare class GitHubAppInstallation implements Identifiable9<string> {
+declare class GitHubAppInstallation implements Identifiable10<string> {
 	id: string | null;
 	organizationId: string;
 	githubInstallationId: number;
@@ -716,27 +741,33 @@ interface ISystemParticipant extends IParticipant {
 }
 import { IParticipant as IParticipant2 } from "@kinotic-ai/core";
 /**
-* A participant authenticated against an Organization. {@link organizationId} is the id of the
-* owning Organization and is never null. {@link IApplicationParticipant} extends this type, so an
-* application-scoped participant also satisfies it. Mirrors the server
-* {@code OrganizationParticipant}.
+* A participant authenticated against an Organization, carrying ORGANIZATION-scope authority over
+* that Organization's resources. {@link organizationId} is the id of the owning Organization and
+* is never null. Mirrors the server {@code OrganizationParticipant}.
 */
 interface IOrganizationParticipant extends IParticipant2 {
-	type: ParticipantType.ORGANIZATION | ParticipantType.APPLICATION;
+	type: ParticipantType.ORGANIZATION;
 	/**
 	* The id of the Organization this participant is authenticated under; never null.
 	*/
 	organizationId: string;
 }
+import { IParticipant as IParticipant3 } from "@kinotic-ai/core";
 /**
-* A participant authenticated against an Application. Extends {@link IOrganizationParticipant}
-* because every Application belongs to an Organization, so an application-scoped session
-* intrinsically carries the owning Organization's id as well. Mirrors the server
-* {@code ApplicationParticipant}.
+* A participant authenticated against an Application, carrying APPLICATION-scope authority over
+* that Application's own resources and end-user data. {@link organizationId} is the id of the
+* Organization that owns the Application; it identifies the owning org for data ownership and
+* routing of the Application's entity definitions and end-user data, and is never null.
+* Mirrors the server {@code ApplicationParticipant}.
 */
-interface IApplicationParticipant extends IOrganizationParticipant {
+interface IApplicationParticipant extends IParticipant3 {
 	type: ParticipantType.APPLICATION;
 	/**
+	* The id of the Organization that owns the Application this participant is authenticated
+	* under; never null.
+	*/
+	organizationId: string;
+	/**
 	* The id of the Application this participant is authenticated under; never null.
 	*/
 	applicationId: string;
@@ -746,23 +777,22 @@ interface IApplicationParticipant extends IOrganizationParticipant {
 	*/
 	tenantId?: string | null;
 }
-import { IParticipant as IParticipant3 } from "@kinotic-ai/core";
+import { IParticipant as IParticipant4 } from "@kinotic-ai/core";
 /**
 * @return true if the participant authenticated against the platform SYSTEM scope
 */
-declare function isSystemParticipant(participant: IParticipant3): participant is ISystemParticipant;
+declare function isSystemParticipant(participant: IParticipant4): participant is ISystemParticipant;
 /**
-* Narrows to an {@link IOrganizationParticipant}, which carries an {@code organizationId}. An
-* application-scoped participant satisfies this too, since every Application is owned by an
-* Organization.
+* Narrows to an {@link IOrganizationParticipant}, which carries an {@code organizationId} and
+* ORGANIZATION-scope authority.
 *
-* @return true if the participant authenticated against an Organization or an Application
+* @return true if the participant authenticated against an Organization
 */
-declare function isOrganizationParticipant(participant: IParticipant3): participant is IOrganizationParticipant;
+declare function isOrganizationParticipant(participant: IParticipant4): participant is IOrganizationParticipant;
 /**
 * @return true if the participant authenticated against an Application
 */
-declare function isApplicationParticipant(participant: IParticipant3): participant is IApplicationParticipant;
+declare function isApplicationParticipant(participant: IParticipant4): participant is IApplicationParticipant;
 import { IKinotic } from "@kinotic-ai/core";
 import { CrudServiceProxy, ICrudServiceProxy } from "@kinotic-ai/core";
 interface IApplicationService extends ICrudServiceProxy<Application> {
@@ -1082,46 +1112,55 @@ declare class WorkloadServiceProxy extends CrudServiceProxy7<Workload> implement
 	countForNode(nodeId: string): Promise<number>;
 	syncIndex(): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+import { IDataSource, IKinotic as IKinotic11, IterablePage as IterablePage4, Pageable as Pageable4 } from "@kinotic-ai/core";
 /**
-* Client proxy for the server's {@code IamUserService}; method shapes mirror the Java interface.
-*
-* NOTE: the server interface now lives in {@code kinotic-domain} and is not currently
-* {@code @Publish}-annotated, so this proxy is not callable over RPC until the backend publishes
-* the service. The shape here is kept in sync so it is ready once that happens; confirm the
-* published namespace before relying on it.
+* Member management for the caller's organization and its applications. Scope is selected
+* with applicationId — null addresses org members, set addresses that application's
+* members — and the backend derives the organization from the authenticated participant,
+* so it is never a parameter.
 */
-interface IIamUserService extends ICrudServiceProxy8<IamUser> {
-	/** Finds the first user with the given email across all scopes, or null. */
-	findByEmail(email: string): Promise<IamUser | null>;
+interface IMemberService {
+	/** Lists the members of the scope. */
+	findMembers(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	/**
+	* Searches the scope's members by free text over email and display name. Blank
+	* searchText is equivalent to {@link findMembers}.
+	*/
+	searchMembers(searchText: string, applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
 	/**
-	* Finds the user with the given email within a scope identified structurally by
-	* (organizationId, applicationId): both null → SYSTEM, organizationId only → ORGANIZATION,
-	* both set → APPLICATION.
+	* Invites someone into the scope by email. Sends the invitation email and returns the
+	* pending invitation. Rejects when the email already has an account in the scope or an
+	* invitation is already pending for it.
 	*/
-	findByEmail(email: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	inviteMember(email: string, displayName: string | null, applicationId: string | null): Promise<PendingInviteSummary>;
 	/**
-	* Finds the first ORGANIZATION-scope user with the given email across all organizations.
-	* Used by sign-up to enforce one user per email before the new org's id exists.
+	* Enables or disables a member of the caller's organization. Disabling gates future
+	* logins; established sessions last until they expire. Callers cannot disable themselves.
 	*/
-	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
+	setMemberEnabled(userId: string, enabled: boolean): Promise<void>;
 	/**
-	* Finds the user (if any) with the given OIDC identity within a specific scope, using the
-	* same (organizationId, applicationId) null conventions as {@link findByEmail}.
+	* Permanently removes a member of the caller's organization, including any stored
+	* credential. Callers cannot remove themselves.
 	*/
-	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
-	/** Finds every user across scopes for a given OIDC identity — e.g. the orgs it can access. */
-	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
-	/** Creates a user and, if a password is provided, the matching credential. */
-	createUser(user: IamUser, password: string | null): Promise<IamUser>;
+	removeMember(userId: string): Promise<void>;
+	/** Lists the scope's live (unexpired) pending invitations. */
+	findPendingInvites(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<PendingInviteSummary>>;
+	/** Cancels a pending invitation belonging to the caller's organization. */
+	cancelInvite(inviteId: string): Promise<void>;
+	/** An {@link IDataSource} over the scope's members, for table components. */
+	memberDataSource(applicationId: string | null): IDataSource<IamUser>;
 }
-declare class IamUserService extends CrudServiceProxy8<IamUser> implements IIamUserService {
+declare class MemberService implements IMemberService {
+	private readonly serviceProxy;
 	constructor(kinotic: IKinotic11);
-	findByEmail(email: string, organizationId?: string | null, applicationId?: string | null): Promise<IamUser | null>;
-	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
-	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
-	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
-	createUser(user: IamUser, password: string | null): Promise<IamUser>;
+	findMembers(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	searchMembers(searchText: string, applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	inviteMember(email: string, displayName: string | null, applicationId: string | null): Promise<PendingInviteSummary>;
+	setMemberEnabled(userId: string, enabled: boolean): Promise<void>;
+	removeMember(userId: string): Promise<void>;
+	findPendingInvites(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<PendingInviteSummary>>;
+	cancelInvite(inviteId: string): Promise<void>;
+	memberDataSource(applicationId: string | null): IDataSource<IamUser>;
 }
 import { IKinotic as IKinotic12 } from "@kinotic-ai/core";
 /**
@@ -1141,8 +1180,8 @@ declare class DeviceApprovalService implements IDeviceApprovalService {
 	constructor(kinotic: IKinotic12);
 	approve(userCode: string): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy9, IKinotic as IKinotic13, ICrudServiceProxy as ICrudServiceProxy9 } from "@kinotic-ai/core";
-interface IGitHubAppInstallationService extends ICrudServiceProxy9<GitHubAppInstallation> {
+import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic13, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+interface IGitHubAppInstallationService extends ICrudServiceProxy8<GitHubAppInstallation> {
 	/**
 	* Stages a single-use state token bound to the caller's organization plus the
 	* supplied returnTo, then returns the GitHub install URL with that state
@@ -1167,7 +1206,7 @@ interface IGitHubAppInstallationService extends ICrudServiceProxy9<GitHubAppInst
 	*/
 	findForCurrentOrg(): Promise<GitHubAppInstallation | null>;
 }
-declare class GitHubAppInstallationService extends CrudServiceProxy9<GitHubAppInstallation> implements IGitHubAppInstallationService {
+declare class GitHubAppInstallationService extends CrudServiceProxy8<GitHubAppInstallation> implements IGitHubAppInstallationService {
 	constructor(kinotic: IKinotic13);
 	startInstall(returnTo: string | null): Promise<string>;
 	completeInstall(installationId: number, state: string): Promise<GitHubInstallCompletion>;
@@ -1185,7 +1224,7 @@ interface IOsApiExtension {
 	dataInsights: IDataInsightsService;
 	vmNodes: IVmNodeService;
 	workloads: IWorkloadService;
-	iamUsers: IIamUserService;
+	members: IMemberService;
 	deviceApproval: IDeviceApprovalService;
 	githubAppInstallations: IGitHubAppInstallationService;
 }
@@ -1193,4 +1232,4 @@ declare const OsApiPlugin: KinoticPlugin<IOsApiExtension>;
 declare module "@kinotic-ai/core" {
 	interface KinoticSingleton extends IOsApiExtension {}
 }
-export { isSystemParticipant, isOrganizationParticipant, isApplicationParticipant, WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, ParticipantType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, ISystemParticipant, IProjectService, IOsApiExtension, IOrganizationService, IOrganizationParticipant, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, IApplicationParticipant, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };
+export { isSystemParticipant, isOrganizationParticipant, isApplicationParticipant, WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PendingInviteSummary, ParticipantType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, MemberService, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUser, IWorkloadService, IVmNodeService, ISystemParticipant, IProjectService, IOsApiExtension, IOrganizationService, IOrganizationParticipant, INamedQueriesDefinitionService, IMigrationService, IMemberService, ILogManager, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, IApplicationParticipant, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };

package/dist/index.d.ts

@@ -145,6 +145,12 @@ declare class Application implements Identifiable<string> {
 	*/
 	organizationId: string;
 	description: string;
+	/**
+	* When true, every APPLICATION-scope user created for this application receives an
+	* auto-generated unique tenantId, isolating each user's SHARED entity data in its own
+	* tenant. Applies only to users created after it is enabled.
+	*/
+	tenantPerUser: boolean;
 	updated: number | null;
 	constructor(id: string, description: string);
 }
@@ -585,12 +591,31 @@ interface CompleteOrgRequest {
 }
 import { Identifiable as Identifiable9 } from "@kinotic-ai/core";
 /**
+* Console view of a pending invitation. Deliberately excludes the accept token — anyone who
+* can list invitations must not be able to redeem them.
+*/
+declare class PendingInviteSummary implements Identifiable9<string> {
+	id: string | null;
+	/** Email the invitation was sent to. */
+	email: string;
+	/** Display name the inviter entered, if any. */
+	displayName: string | null;
+	/** The application the invitee would join; null for an organization-member invite. */
+	applicationId: string | null;
+	/** Display name of the member who sent the invitation. */
+	invitedByName: string | null;
+	created: number | null;
+	/** When the invitation stops being acceptable. */
+	expiresAt: number | null;
+}
+import { Identifiable as Identifiable10 } from "@kinotic-ai/core";
+/**
 * Persisted record of one GitHub App installation that a Kinotic Org has authorised.
 * The durable binding that says "Org X has access to GitHub install Y" — without it,
 * no installation token can be minted on behalf of the org and webhook deliveries
 * can't be matched to a project.
 */
-declare class GitHubAppInstallation implements Identifiable9<string> {
+declare class GitHubAppInstallation implements Identifiable10<string> {
 	id: string | null;
 	organizationId: string;
 	githubInstallationId: number;
@@ -716,27 +741,33 @@ interface ISystemParticipant extends IParticipant {
 }
 import { IParticipant as IParticipant2 } from "@kinotic-ai/core";
 /**
-* A participant authenticated against an Organization. {@link organizationId} is the id of the
-* owning Organization and is never null. {@link IApplicationParticipant} extends this type, so an
-* application-scoped participant also satisfies it. Mirrors the server
-* {@code OrganizationParticipant}.
+* A participant authenticated against an Organization, carrying ORGANIZATION-scope authority over
+* that Organization's resources. {@link organizationId} is the id of the owning Organization and
+* is never null. Mirrors the server {@code OrganizationParticipant}.
 */
 interface IOrganizationParticipant extends IParticipant2 {
-	type: ParticipantType.ORGANIZATION | ParticipantType.APPLICATION;
+	type: ParticipantType.ORGANIZATION;
 	/**
 	* The id of the Organization this participant is authenticated under; never null.
 	*/
 	organizationId: string;
 }
+import { IParticipant as IParticipant3 } from "@kinotic-ai/core";
 /**
-* A participant authenticated against an Application. Extends {@link IOrganizationParticipant}
-* because every Application belongs to an Organization, so an application-scoped session
-* intrinsically carries the owning Organization's id as well. Mirrors the server
-* {@code ApplicationParticipant}.
+* A participant authenticated against an Application, carrying APPLICATION-scope authority over
+* that Application's own resources and end-user data. {@link organizationId} is the id of the
+* Organization that owns the Application; it identifies the owning org for data ownership and
+* routing of the Application's entity definitions and end-user data, and is never null.
+* Mirrors the server {@code ApplicationParticipant}.
 */
-interface IApplicationParticipant extends IOrganizationParticipant {
+interface IApplicationParticipant extends IParticipant3 {
 	type: ParticipantType.APPLICATION;
 	/**
+	* The id of the Organization that owns the Application this participant is authenticated
+	* under; never null.
+	*/
+	organizationId: string;
+	/**
 	* The id of the Application this participant is authenticated under; never null.
 	*/
 	applicationId: string;
@@ -746,23 +777,22 @@ interface IApplicationParticipant extends IOrganizationParticipant {
 	*/
 	tenantId?: string | null;
 }
-import { IParticipant as IParticipant3 } from "@kinotic-ai/core";
+import { IParticipant as IParticipant4 } from "@kinotic-ai/core";
 /**
 * @return true if the participant authenticated against the platform SYSTEM scope
 */
-declare function isSystemParticipant(participant: IParticipant3): participant is ISystemParticipant;
+declare function isSystemParticipant(participant: IParticipant4): participant is ISystemParticipant;
 /**
-* Narrows to an {@link IOrganizationParticipant}, which carries an {@code organizationId}. An
-* application-scoped participant satisfies this too, since every Application is owned by an
-* Organization.
+* Narrows to an {@link IOrganizationParticipant}, which carries an {@code organizationId} and
+* ORGANIZATION-scope authority.
 *
-* @return true if the participant authenticated against an Organization or an Application
+* @return true if the participant authenticated against an Organization
 */
-declare function isOrganizationParticipant(participant: IParticipant3): participant is IOrganizationParticipant;
+declare function isOrganizationParticipant(participant: IParticipant4): participant is IOrganizationParticipant;
 /**
 * @return true if the participant authenticated against an Application
 */
-declare function isApplicationParticipant(participant: IParticipant3): participant is IApplicationParticipant;
+declare function isApplicationParticipant(participant: IParticipant4): participant is IApplicationParticipant;
 import { IKinotic } from "@kinotic-ai/core";
 import { CrudServiceProxy, ICrudServiceProxy } from "@kinotic-ai/core";
 interface IApplicationService extends ICrudServiceProxy<Application> {
@@ -1082,46 +1112,55 @@ declare class WorkloadServiceProxy extends CrudServiceProxy7<Workload> implement
 	countForNode(nodeId: string): Promise<number>;
 	syncIndex(): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic11, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+import { IDataSource, IKinotic as IKinotic11, IterablePage as IterablePage4, Pageable as Pageable4 } from "@kinotic-ai/core";
 /**
-* Client proxy for the server's {@code IamUserService}; method shapes mirror the Java interface.
-*
-* NOTE: the server interface now lives in {@code kinotic-domain} and is not currently
-* {@code @Publish}-annotated, so this proxy is not callable over RPC until the backend publishes
-* the service. The shape here is kept in sync so it is ready once that happens; confirm the
-* published namespace before relying on it.
+* Member management for the caller's organization and its applications. Scope is selected
+* with applicationId — null addresses org members, set addresses that application's
+* members — and the backend derives the organization from the authenticated participant,
+* so it is never a parameter.
 */
-interface IIamUserService extends ICrudServiceProxy8<IamUser> {
-	/** Finds the first user with the given email across all scopes, or null. */
-	findByEmail(email: string): Promise<IamUser | null>;
+interface IMemberService {
+	/** Lists the members of the scope. */
+	findMembers(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	/**
+	* Searches the scope's members by free text over email and display name. Blank
+	* searchText is equivalent to {@link findMembers}.
+	*/
+	searchMembers(searchText: string, applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
 	/**
-	* Finds the user with the given email within a scope identified structurally by
-	* (organizationId, applicationId): both null → SYSTEM, organizationId only → ORGANIZATION,
-	* both set → APPLICATION.
+	* Invites someone into the scope by email. Sends the invitation email and returns the
+	* pending invitation. Rejects when the email already has an account in the scope or an
+	* invitation is already pending for it.
 	*/
-	findByEmail(email: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
+	inviteMember(email: string, displayName: string | null, applicationId: string | null): Promise<PendingInviteSummary>;
 	/**
-	* Finds the first ORGANIZATION-scope user with the given email across all organizations.
-	* Used by sign-up to enforce one user per email before the new org's id exists.
+	* Enables or disables a member of the caller's organization. Disabling gates future
+	* logins; established sessions last until they expire. Callers cannot disable themselves.
 	*/
-	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
+	setMemberEnabled(userId: string, enabled: boolean): Promise<void>;
 	/**
-	* Finds the user (if any) with the given OIDC identity within a specific scope, using the
-	* same (organizationId, applicationId) null conventions as {@link findByEmail}.
+	* Permanently removes a member of the caller's organization, including any stored
+	* credential. Callers cannot remove themselves.
 	*/
-	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
-	/** Finds every user across scopes for a given OIDC identity — e.g. the orgs it can access. */
-	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
-	/** Creates a user and, if a password is provided, the matching credential. */
-	createUser(user: IamUser, password: string | null): Promise<IamUser>;
+	removeMember(userId: string): Promise<void>;
+	/** Lists the scope's live (unexpired) pending invitations. */
+	findPendingInvites(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<PendingInviteSummary>>;
+	/** Cancels a pending invitation belonging to the caller's organization. */
+	cancelInvite(inviteId: string): Promise<void>;
+	/** An {@link IDataSource} over the scope's members, for table components. */
+	memberDataSource(applicationId: string | null): IDataSource<IamUser>;
 }
-declare class IamUserService extends CrudServiceProxy8<IamUser> implements IIamUserService {
+declare class MemberService implements IMemberService {
+	private readonly serviceProxy;
 	constructor(kinotic: IKinotic11);
-	findByEmail(email: string, organizationId?: string | null, applicationId?: string | null): Promise<IamUser | null>;
-	findFirstOrgUserByEmail(email: string): Promise<IamUser | null>;
-	findByOidcIdentity(oidcSubject: string, oidcConfigId: string, organizationId: string | null, applicationId: string | null): Promise<IamUser | null>;
-	findAllByOidcIdentity(oidcSubject: string, oidcConfigId: string): Promise<IamUser[]>;
-	createUser(user: IamUser, password: string | null): Promise<IamUser>;
+	findMembers(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	searchMembers(searchText: string, applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<IamUser>>;
+	inviteMember(email: string, displayName: string | null, applicationId: string | null): Promise<PendingInviteSummary>;
+	setMemberEnabled(userId: string, enabled: boolean): Promise<void>;
+	removeMember(userId: string): Promise<void>;
+	findPendingInvites(applicationId: string | null, pageable: Pageable4): Promise<IterablePage4<PendingInviteSummary>>;
+	cancelInvite(inviteId: string): Promise<void>;
+	memberDataSource(applicationId: string | null): IDataSource<IamUser>;
 }
 import { IKinotic as IKinotic12 } from "@kinotic-ai/core";
 /**
@@ -1141,8 +1180,8 @@ declare class DeviceApprovalService implements IDeviceApprovalService {
 	constructor(kinotic: IKinotic12);
 	approve(userCode: string): Promise<void>;
 }
-import { CrudServiceProxy as CrudServiceProxy9, IKinotic as IKinotic13, ICrudServiceProxy as ICrudServiceProxy9 } from "@kinotic-ai/core";
-interface IGitHubAppInstallationService extends ICrudServiceProxy9<GitHubAppInstallation> {
+import { CrudServiceProxy as CrudServiceProxy8, IKinotic as IKinotic13, ICrudServiceProxy as ICrudServiceProxy8 } from "@kinotic-ai/core";
+interface IGitHubAppInstallationService extends ICrudServiceProxy8<GitHubAppInstallation> {
 	/**
 	* Stages a single-use state token bound to the caller's organization plus the
 	* supplied returnTo, then returns the GitHub install URL with that state
@@ -1167,7 +1206,7 @@ interface IGitHubAppInstallationService extends ICrudServiceProxy9<GitHubAppInst
 	*/
 	findForCurrentOrg(): Promise<GitHubAppInstallation | null>;
 }
-declare class GitHubAppInstallationService extends CrudServiceProxy9<GitHubAppInstallation> implements IGitHubAppInstallationService {
+declare class GitHubAppInstallationService extends CrudServiceProxy8<GitHubAppInstallation> implements IGitHubAppInstallationService {
 	constructor(kinotic: IKinotic13);
 	startInstall(returnTo: string | null): Promise<string>;
 	completeInstall(installationId: number, state: string): Promise<GitHubInstallCompletion>;
@@ -1185,7 +1224,7 @@ interface IOsApiExtension {
 	dataInsights: IDataInsightsService;
 	vmNodes: IVmNodeService;
 	workloads: IWorkloadService;
-	iamUsers: IIamUserService;
+	members: IMemberService;
 	deviceApproval: IDeviceApprovalService;
 	githubAppInstallations: IGitHubAppInstallationService;
 }
@@ -1193,4 +1232,4 @@ declare const OsApiPlugin: KinoticPlugin<IOsApiExtension>;
 declare module "@kinotic-ai/core" {
 	interface KinoticSingleton extends IOsApiExtension {}
 }
-export { isSystemParticipant, isOrganizationParticipant, isApplicationParticipant, WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, ParticipantType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUserService, IamUser, IWorkloadService, IVmNodeService, ISystemParticipant, IProjectService, IOsApiExtension, IOrganizationService, IOrganizationParticipant, INamedQueriesDefinitionService, IMigrationService, ILogManager, IIamUserService, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, IApplicationParticipant, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };
+export { isSystemParticipant, isOrganizationParticipant, isApplicationParticipant, WorkloadStatus, WorkloadServiceProxy, Workload, VmProviderType, VmNodeStatus, VmNodeServiceProxy, VmNode, VersionDecorator, TimeReferenceDecorator, TextDecorator, TenantSelectionC3Type, TenantIdDecorator, SingleLoggerLevelsDescriptor, SignUpRequest, SignUpCompleteRequest, QueryOptionsC3Type, QueryDecorator, ProjectType, ProjectService, Project, ProgressType, PendingInviteSummary, ParticipantType, PageableC3Type, PageC3Type, OsApiPlugin, OrganizationService, Organization, NotIndexedDecorator, NestedDecorator, NamedQueriesDefinitionService, NamedQueriesDefinition, MigrationService, MigrationResult, MigrationRequest, MigrationDefinition, MemberService, LoggersDescriptor, LoggerLevelsDescriptor, LogManager, LogLevel, KinoticProjectConfig, InsightRequest, InsightProgress, IdDecorator, IamUser, IWorkloadService, IVmNodeService, ISystemParticipant, IProjectService, IOsApiExtension, IOrganizationService, IOrganizationParticipant, INamedQueriesDefinitionService, IMigrationService, IMemberService, ILogManager, IGitHubAppInstallationService, IEntityDefinitionService, IDeviceApprovalService, IDataInsightsService, IApplicationService, IApplicationParticipant, GroupLoggerLevelsDescriptor, GitHubToken, GitHubRepoToken, GitHubInstallCompletion, GitHubAppInstallationService, GitHubAppInstallation, FlattenedDecorator, EsIndexConfigurationDecorator, EntityDefinitionService, EntityDefinition, EntityDecorator, EntitiesPathConfig, DiscriminatorDecorator, DeviceApprovalService, DataInsightsService, DataInsightsComponent, CompleteOrgRequest, AutoGeneratedIdDecorator, AuthType, ApplicationService, Application };

package/dist/index.js

@@ -178,6 +178,7 @@ class Application {
   id;
   organizationId;
   description;
+  tenantPerUser = false;
   updated = null;
   constructor(id, description) {
     this.id = id;
@@ -356,6 +357,16 @@ class IamUser {
   created = null;
   updated = null;
 }
+// packages/os-api/src/api/model/iam/PendingInviteSummary.ts
+class PendingInviteSummary {
+  id = null;
+  email = "";
+  displayName = null;
+  applicationId = null;
+  invitedByName = null;
+  created = null;
+  expiresAt = null;
+}
 // packages/os-api/src/api/model/github/GitHubAppInstallation.ts
 class GitHubAppInstallation {
   id = null;
@@ -408,8 +419,7 @@ function isSystemParticipant(participant) {
   return scopeType(participant) === "system" /* SYSTEM */;
 }
 function isOrganizationParticipant(participant) {
-  const type = scopeType(participant);
-  return type === "organization" /* ORGANIZATION */ || type === "application" /* APPLICATION */;
+  return scopeType(participant) === "organization" /* ORGANIZATION */;
 }
 function isApplicationParticipant(participant) {
   return scopeType(participant) === "application" /* APPLICATION */;
@@ -630,27 +640,45 @@ class WorkloadServiceProxy extends CrudServiceProxy7 {
     return this.serviceProxy.invoke("syncIndex", []);
   }
 }
-// packages/os-api/src/api/services/IIamUserService.ts
-import { CrudServiceProxy as CrudServiceProxy8 } from "@kinotic-ai/core";
+// packages/os-api/src/api/services/IMemberService.ts
+import {
+  FunctionalIterablePage as FunctionalIterablePage4
+} from "@kinotic-ai/core";
 
-class IamUserService extends CrudServiceProxy8 {
+class MemberService {
+  serviceProxy;
   constructor(kinotic) {
-    super(kinotic.serviceProxy("org.kinotic.domain.api.services.iam.IamUserService"));
+    this.serviceProxy = kinotic.serviceProxy("org.kinotic.os.api.services.iam.MemberService");
+  }
+  async findMembers(applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("findMembers", [applicationId, pageable]);
+    return new FunctionalIterablePage4(pageable, page, (next) => this.serviceProxy.invoke("findMembers", [applicationId, next]));
   }
-  findByEmail(email, organizationId, applicationId) {
-    return arguments.length >= 3 ? this.serviceProxy.invoke("findByEmail", [email, organizationId, applicationId]) : this.serviceProxy.invoke("findByEmail", [email]);
+  async searchMembers(searchText, applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("searchMembers", [searchText, applicationId, pageable]);
+    return new FunctionalIterablePage4(pageable, page, (next) => this.serviceProxy.invoke("searchMembers", [searchText, applicationId, next]));
   }
-  findFirstOrgUserByEmail(email) {
-    return this.serviceProxy.invoke("findFirstOrgUserByEmail", [email]);
+  inviteMember(email, displayName, applicationId) {
+    return this.serviceProxy.invoke("inviteMember", [email, displayName, applicationId]);
   }
-  findByOidcIdentity(oidcSubject, oidcConfigId, organizationId, applicationId) {
-    return this.serviceProxy.invoke("findByOidcIdentity", [oidcSubject, oidcConfigId, organizationId, applicationId]);
+  setMemberEnabled(userId, enabled) {
+    return this.serviceProxy.invoke("setMemberEnabled", [userId, enabled]);
   }
-  findAllByOidcIdentity(oidcSubject, oidcConfigId) {
-    return this.serviceProxy.invoke("findAllByOidcIdentity", [oidcSubject, oidcConfigId]);
+  removeMember(userId) {
+    return this.serviceProxy.invoke("removeMember", [userId]);
   }
-  createUser(user, password) {
-    return this.serviceProxy.invoke("createUser", [user, password]);
+  async findPendingInvites(applicationId, pageable) {
+    const page = await this.serviceProxy.invoke("findPendingInvites", [applicationId, pageable]);
+    return new FunctionalIterablePage4(pageable, page, (next) => this.serviceProxy.invoke("findPendingInvites", [applicationId, next]));
+  }
+  cancelInvite(inviteId) {
+    return this.serviceProxy.invoke("cancelInvite", [inviteId]);
+  }
+  memberDataSource(applicationId) {
+    return {
+      findAll: (pageable) => this.findMembers(applicationId, pageable),
+      search: (searchText, pageable) => this.searchMembers(searchText, applicationId, pageable)
+    };
   }
 }
 // packages/os-api/src/api/services/IDeviceApprovalService.ts
@@ -664,9 +692,9 @@ class DeviceApprovalService {
   }
 }
 // packages/os-api/src/api/services/IGitHubAppInstallationService.ts
-import { CrudServiceProxy as CrudServiceProxy9 } from "@kinotic-ai/core";
+import { CrudServiceProxy as CrudServiceProxy8 } from "@kinotic-ai/core";
 
-class GitHubAppInstallationService extends CrudServiceProxy9 {
+class GitHubAppInstallationService extends CrudServiceProxy8 {
   constructor(kinotic) {
     super(kinotic.serviceProxy("org.kinotic.github.api.services.GitHubAppInstallationService"));
   }
@@ -694,7 +722,7 @@ var OsApiPlugin = {
       dataInsights: new DataInsightsService(kinotic),
       vmNodes: new VmNodeServiceProxy(kinotic),
       workloads: new WorkloadServiceProxy(kinotic),
-      iamUsers: new IamUserService(kinotic),
+      members: new MemberService(kinotic),
       deviceApproval: new DeviceApprovalService(kinotic),
       githubAppInstallations: new GitHubAppInstallationService(kinotic)
     };
@@ -723,6 +751,7 @@ export {
   ProjectService,
   Project,
   ProgressType,
+  PendingInviteSummary,
   ParticipantType,
   PageableC3Type,
   PageC3Type,
@@ -734,13 +763,13 @@ export {
   NamedQueriesDefinitionService,
   NamedQueriesDefinition,
   MigrationService,
+  MemberService,
   LoggersDescriptor,
   LoggerLevelsDescriptor,
   LogManager,
   LogLevel,
   KinoticProjectConfig,
   IdDecorator,
-  IamUserService,
   IamUser,
   GroupLoggerLevelsDescriptor,
   GitHubToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinotic-ai/os-api",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "type": "module",
   "files": [
     "dist"
@@ -41,7 +41,7 @@
     "rxjs": "^7.8.2"
   },
   "devDependencies": {
-    "@kinotic-ai/core": "1.6.0",
+    "@kinotic-ai/core": "1.6.2",
     "@types/node": "^25.3.2",
     "@vitest/coverage-v8": "^4.0.18",
     "@vitest/runner": "^4.0.18",