@h-ai/iam 0.1.0-alpha.36 → 0.1.0-alpha.37

package/README.md

@@ -4,14 +4,15 @@
 
 ## 功能特性
 
-| 功能           | 说明                                                   |
-| -------------- | ------------------------------------------------------ |
-| **认证**       | 密码、OTP（邮箱/短信验证码）、LDAP、API Key 多策略认证 |
-| **会话**       | 有状态会话（随机访问令牌 + 缓存，滑动续期可选）        |
-| **授权**       | RBAC 角色与权限管理（DB + 缓存，通配符权限匹配）       |
-| **用户管理**   | 注册、查询、更新、密码重置、管理员重置密码             |
-| **API Key**    | API Key 创建、吊销、验证，支持 scope 与过期时间        |
-| **前端客户端** | HTTP API 契约定义，支持独立前端使用                    |
+| 功能           | 说明                                                                                   |
+| -------------- | -------------------------------------------------------------------------------------- |
+| **认证**       | 密码、OTP（邮箱/短信验证码）、LDAP、API Key 多策略认证                                 |
+| **会话**       | 有状态会话（随机访问令牌 + 缓存，滑动续期可选）                                        |
+| **授权**       | RBAC 角色与权限管理（DB + 缓存，通配符权限匹配）                                       |
+| **用户管理**   | 注册、查询、更新、密码重置、管理员重置密码                                             |
+| **API Key**    | API Key 创建、吊销、验证，支持 scope 与过期时间                                        |
+| **一次性票据** | 短期、一次性能力票据（签发 / 原子消费），用于 WebSocket 等无法携带 Bearer Token 的通道 |
+| **前端客户端** | HTTP API 契约定义，支持独立前端使用                                                    |
 
 ## 安装
 
@@ -488,6 +489,30 @@ const result = await iam.user.confirmPasswordReset(token, 'NewPassword456')
 await iam.user.adminResetPassword(userId, 'TempPassword123')
 ```
 
+## 一次性票据 — `iam.ticket`
+
+短期、一次性能力票据。用于无法携带 Bearer Token 的通道（如 WebSocket URL）：由已认证的 HTTP 请求签发一个绑定主体、用途与操作的票据，服务端在首次校验时**原子消费**（单次有效）。
+
+```ts
+// 签发（已登录 HTTP 请求内）：绑定主体、用途与本次操作，30 秒过期
+const issued = await iam.ticket.issue({
+  subjectId: session.userId,
+  purpose: 'ai-audio',
+  grant: { operation: 'transcribe', model: 'whisper-1' },
+  ttlMs: 30_000,
+})
+// issued.data.ticket 交给客户端，用于建立 WebSocket 连接
+
+// 消费（服务端建连时）：原子单次，返回主体 + 用途 + grant
+const consumed = await iam.ticket.consume(ticket, { purpose: 'ai-audio' })
+if (consumed.success) {
+  const { subjectId, grant } = consumed.data
+  // 用 grant.operation / grant.model 交叉校验客户端请求
+}
+```
+
+特性：密码学安全随机值、TTL、原子单次消费（并发消费仅一个成功）、用途绑定（防跨用途重放）。
+
 ## 错误处理
 
 所有操作返回 `HaiResult<T>`，通过 `HaiIamError` 做分支判断：

package/dist/index.d.ts

@@ -1240,6 +1240,99 @@ interface LdapSearchEntry {
  */
 type LdapClientFactory = (config: LdapConfig) => Promise<HaiResult<LdapClient>>;
 
+/**
+ * @h-ai/iam — 一次性票据类型
+ *
+ * 定义通用的短期、一次性能力票据（capability ticket）：由已认证的上下文签发，
+ * 绑定主体、用途与授权信息，在无法携带 Bearer Token 的通道（如 WebSocket URL）中
+ * 用作一次性入场凭证。典型用途：AI 语音 WebSocket 接入。
+ * @module ticket/iam-ticket-types
+ */
+
+/**
+ * 票据授权绑定信息
+ *
+ * 消费时原样返回，供服务端确认本次操作、模型、会话等参数与签发时一致。
+ * 除固定字段外允许应用自定义键值。
+ */
+interface TicketGrant {
+    /** 操作类型（如 `'transcribe'` | `'synthesize'` 或应用自定义） */
+    operation?: string;
+    /** 模型 ID */
+    model?: string;
+    /** 会话 ID */
+    sessionId?: string;
+    /** 应用自定义绑定字段 */
+    [key: string]: unknown;
+}
+/**
+ * 签发一次性票据的选项
+ */
+interface IssueTicketOptions {
+    /** 主体 ID（票据绑定的用户 / 主体，消费时原样返回） */
+    subjectId: string;
+    /** 票据用途（如 `'ai-audio'`），消费时校验一致 */
+    purpose: string;
+    /** 授权绑定信息（操作 / 模型 / 会话等，消费时原样返回） */
+    grant?: TicketGrant;
+    /** 有效期（毫秒，默认 30000） */
+    ttlMs?: number;
+}
+/**
+ * 签发结果
+ */
+interface IssuedTicket {
+    /** 一次性票据值（密码学安全随机，base64url） */
+    ticket: string;
+    /** 过期时间（Unix 毫秒） */
+    expiresAt: number;
+}
+/**
+ * 消费票据的选项
+ */
+interface ConsumeTicketOptions {
+    /** 期望用途；与签发用途不一致时返回 `TICKET_INVALID`（防止跨用途重放） */
+    purpose?: string;
+}
+/**
+ * 消费结果（校验通过并原子消费后返回）
+ */
+interface ConsumedTicket {
+    /** 票据绑定的主体 ID */
+    subjectId: string;
+    /** 票据用途 */
+    purpose: string;
+    /** 授权绑定信息 */
+    grant: TicketGrant;
+}
+/**
+ * 一次性票据操作接口（通过 `iam.ticket` 访问）
+ *
+ * 提供密码学安全、带 TTL、原子单次消费的能力票据签发与消费。
+ */
+interface TicketOperations {
+    /**
+     * 签发一次性票据
+     *
+     * 生成密码学安全随机值，绑定主体 / 用途 / 授权信息并按 TTL 存入 cache。
+     *
+     * @param options - 签发选项
+     * @returns 票据值与过期时间
+     */
+    issue: (options: IssueTicketOptions) => Promise<HaiResult<IssuedTicket>>;
+    /**
+     * 原子消费一次性票据
+     *
+     * 单次有效：并发消费同一票据时只有一个成功，其余返回 `TICKET_INVALID`。
+     * 票据不存在 / 已过期 / 已消费 / 用途不匹配时返回错误。
+     *
+     * @param ticket - 票据值
+     * @param options - 消费选项（可校验用途）
+     * @returns 主体 + 用途 + 授权信息
+     */
+    consume: (ticket: string, options?: ConsumeTicketOptions) => Promise<HaiResult<ConsumedTicket>>;
+}
+
 declare const HaiIamError: {
     readonly AUTH_FAILED: _h_ai_core.HaiErrorDef;
     readonly INVALID_CREDENTIALS: _h_ai_core.HaiErrorDef;
@@ -1278,6 +1371,9 @@ declare const HaiIamError: {
     readonly LDAP_CONNECTION_FAILED: _h_ai_core.HaiErrorDef;
     readonly LDAP_BIND_FAILED: _h_ai_core.HaiErrorDef;
     readonly LDAP_SEARCH_FAILED: _h_ai_core.HaiErrorDef;
+    readonly TICKET_INVALID: _h_ai_core.HaiErrorDef;
+    readonly TICKET_EXPIRED: _h_ai_core.HaiErrorDef;
+    readonly TICKET_ISSUE_FAILED: _h_ai_core.HaiErrorDef;
     readonly REPOSITORY_ERROR: _h_ai_core.HaiErrorDef;
     readonly NOT_FOUND: _h_ai_core.HaiErrorDef;
     readonly CONFLICT: _h_ai_core.HaiErrorDef;
@@ -1380,6 +1476,8 @@ interface IamFunctions {
     readonly session: SessionOperations;
     /** API Key 管理（创建、列表、吐销、验证），未启用 apikey 登录时返回未初始化代理 */
     readonly apiKey: ApiKeyOperations;
+    /** 一次性能力票据（签发 / 原子消费短期票据，用于 WebSocket 等无法携带 Bearer Token 的通道） */
+    readonly ticket: TicketOperations;
 }
 
 /**
@@ -1391,4 +1489,4 @@ interface IamFunctions {
 
 declare const iam: IamFunctions;
 
-export { type AgreementConfig, AgreementConfigSchema, type AgreementDisplay, type ApiKey, type ApiKeyConfig, ApiKeyConfigSchema, type ApiKeyCredentials, type ApiKeyOperations, type AuthResult, type AuthStrategy, type AuthStrategyType, AuthStrategyTypeSchema, type AuthnOperations, type AuthzOperations, type CreateApiKeyOptions, type CreateApiKeyResult, type CreateSessionOptions, type Credentials, HaiIamError, type IamConfig, type IamConfigInput, IamConfigSchema, type IamConfigSettingsInput, type IamFunctions, type LdapClientFactory, type LdapConfig, LdapConfigSchema, type LdapCredentials, type ListUsersOptions, type LoginConfig, LoginConfigSchema, type OtpConfig, OtpConfigSchema, type OtpCredentials, type PasswordConfig, PasswordConfigSchema, type PasswordCredentials, type PasswordResetConfig, PasswordResetConfigSchema, type Permission, type PermissionQueryOptions, type PermissionType, type RbacConfig, RbacConfigSchema, type RegisterConfig, RegisterConfigSchema, type RegisterOptions, type RegisterResult, type Role, type SecurityConfig, SecurityConfigSchema, type Session, type SessionConfig, SessionConfigSchema, type SessionData, type SessionFieldUpdates, type SessionOperations, type StoredUser, type TokenPair, type UpdateCurrentUserInput, type User, type UserOperations, iam };
+export { type AgreementConfig, AgreementConfigSchema, type AgreementDisplay, type ApiKey, type ApiKeyConfig, ApiKeyConfigSchema, type ApiKeyCredentials, type ApiKeyOperations, type AuthResult, type AuthStrategy, type AuthStrategyType, AuthStrategyTypeSchema, type AuthnOperations, type AuthzOperations, type ConsumeTicketOptions, type ConsumedTicket, type CreateApiKeyOptions, type CreateApiKeyResult, type CreateSessionOptions, type Credentials, HaiIamError, type IamConfig, type IamConfigInput, IamConfigSchema, type IamConfigSettingsInput, type IamFunctions, type IssueTicketOptions, type IssuedTicket, type LdapClientFactory, type LdapConfig, LdapConfigSchema, type LdapCredentials, type ListUsersOptions, type LoginConfig, LoginConfigSchema, type OtpConfig, OtpConfigSchema, type OtpCredentials, type PasswordConfig, PasswordConfigSchema, type PasswordCredentials, type PasswordResetConfig, PasswordResetConfigSchema, type Permission, type PermissionQueryOptions, type PermissionType, type RbacConfig, RbacConfigSchema, type RegisterConfig, RegisterConfigSchema, type RegisterOptions, type RegisterResult, type Role, type SecurityConfig, SecurityConfigSchema, type Session, type SessionConfig, SessionConfigSchema, type SessionData, type SessionFieldUpdates, type SessionOperations, type StoredUser, type TicketGrant, type TicketOperations, type TokenPair, type UpdateCurrentUserInput, type User, type UserOperations, iam };

package/dist/index.js

@@ -200,6 +200,9 @@ var en_US_default = {
   iam_ldapStrategyRequired: "LDAP authentication requires LDAP strategy configuration",
   iam_tokenExpired: "Token has expired",
   iam_tokenInvalid: "Invalid token",
+  iam_ticketInvalid: "Invalid, already used, or unknown ticket",
+  iam_ticketExpired: "Ticket has expired",
+  iam_ticketIssueFailed: "Failed to issue or read ticket",
   iam_createSessionFailed: "Failed to create session",
   iam_sessionExpired: "Session has expired",
   iam_invalidRefreshToken: "Invalid refresh token",
@@ -380,6 +383,9 @@ var zh_CN_default = {
   iam_ldapStrategyRequired: "LDAP \u8BA4\u8BC1\u9700\u8981\u914D\u7F6E LDAP \u7B56\u7565",
   iam_tokenExpired: "\u4EE4\u724C\u5DF2\u8FC7\u671F",
   iam_tokenInvalid: "\u4EE4\u724C\u65E0\u6548",
+  iam_ticketInvalid: "\u7968\u636E\u65E0\u6548\u3001\u5DF2\u4F7F\u7528\u6216\u4E0D\u5B58\u5728",
+  iam_ticketExpired: "\u7968\u636E\u5DF2\u8FC7\u671F",
+  iam_ticketIssueFailed: "\u7968\u636E\u7B7E\u53D1\u6216\u8BFB\u53D6\u5931\u8D25",
   iam_createSessionFailed: "\u521B\u5EFA\u4F1A\u8BDD\u5931\u8D25",
   iam_sessionExpired: "\u4F1A\u8BDD\u5DF2\u5931\u6548",
   iam_invalidRefreshToken: "\u65E0\u6548\u7684\u5237\u65B0\u4EE4\u724C",
@@ -568,6 +574,9 @@ var IamErrorInfo = {
   LDAP_CONNECTION_FAILED: "301:500",
   LDAP_BIND_FAILED: "302:401",
   LDAP_SEARCH_FAILED: "303:500",
+  TICKET_INVALID: "110:401",
+  TICKET_EXPIRED: "111:401",
+  TICKET_ISSUE_FAILED: "112:500",
   REPOSITORY_ERROR: "401:500",
   NOT_FOUND: "402:404",
   CONFLICT: "403:409",
@@ -685,7 +694,7 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     });
   }
   async insert(data, tx) {
-    const result = await this.create(data, tx);
+    const result = await this.create({ ...data }, tx);
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
@@ -724,7 +733,7 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     return ok(result.data);
   }
   async updateFields(id, data, tx) {
-    const result = await this.updateById(id, data, tx);
+    const result = await this.updateById(id, { ...data }, tx);
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
@@ -4000,6 +4009,62 @@ function buildSessionFunctions(config) {
     }
   };
 }
+var logger9 = core.logger.child({ module: "iam", scope: "ticket" });
+var TICKET_KEY_PREFIX = "hai:iam:ticket:";
+var DEFAULT_TICKET_TTL_MS = 3e4;
+function buildTicketKey(ticket) {
+  return `${TICKET_KEY_PREFIX}${ticket}`;
+}
+function createTicketOperations() {
+  return {
+    async issue(options) {
+      const ttlMs = options.ttlMs !== void 0 && options.ttlMs > 0 ? options.ttlMs : DEFAULT_TICKET_TTL_MS;
+      const ticket = generateToken();
+      const expiresAt = Date.now() + ttlMs;
+      const record = {
+        subjectId: options.subjectId,
+        purpose: options.purpose,
+        grant: options.grant ?? {},
+        expiresAt
+      };
+      const saved = await cache.kv.set(buildTicketKey(ticket), record, { px: ttlMs, nx: true });
+      if (!saved.success) {
+        logger9.warn("Failed to issue ticket", { purpose: options.purpose });
+        return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
+      }
+      return ok({ ticket, expiresAt });
+    },
+    async consume(ticket, options) {
+      if (!ticket) {
+        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
+      }
+      const key = buildTicketKey(ticket);
+      const found = await cache.kv.get(key);
+      if (!found.success) {
+        return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
+      }
+      const record = found.data;
+      if (!record) {
+        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
+      }
+      const removed = await cache.kv.del(key);
+      if (!removed.success || removed.data !== 1) {
+        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
+      }
+      if (record.expiresAt <= Date.now()) {
+        return err(HaiIamError.TICKET_EXPIRED, iamM("iam_ticketExpired"));
+      }
+      if (options?.purpose !== void 0 && options.purpose !== record.purpose) {
+        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
+      }
+      return ok({
+        subjectId: record.subjectId,
+        purpose: record.purpose,
+        grant: record.grant
+      });
+    }
+  };
+}
 function hashResetToken(token) {
   const result = crypto$1.hash.hash(token);
   if (!result.success) {
@@ -4181,7 +4246,7 @@ function createCacheResetTokenRepository() {
 }
 
 // src/user/iam-user-functions.ts
-var logger9 = core.logger.child({ module: "iam", scope: "user" });
+var logger10 = core.logger.child({ module: "iam", scope: "user" });
 async function createUserOperations(deps) {
   try {
     const { config, passwordStrategyResult, sessionFunctions, authzFunctions, onPasswordResetRequest } = deps;
@@ -4196,10 +4261,10 @@ async function createUserOperations(deps) {
       config,
       onPasswordResetRequest
     });
-    logger9.info("User sub-feature initialized");
+    logger10.info("User sub-feature initialized");
     return ok(functions);
   } catch (error) {
-    logger9.error("User sub-feature initialization failed", { error });
+    logger10.error("User sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -4345,7 +4410,7 @@ function buildRegistrationOps(ctx) {
       }
       const createdUser = createdUserResult.data;
       await assignDefaultRole(createdUser.id);
-      logger9.info("User registered", { userId: createdUser.id, username: options.username });
+      logger10.info("User registered", { userId: createdUser.id, username: options.username });
       return ok({
         user: toUser(createdUser),
         agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnRegister)
@@ -4540,7 +4605,7 @@ function buildUserMutationOps(ctx) {
       return ok(toUser(updatedResult.data));
     },
     async deleteUser(userId) {
-      logger9.debug("Deleting user", { userId });
+      logger10.debug("Deleting user", { userId });
       const userResult = await userRepository.findById(userId);
       if (!userResult.success) {
         return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
@@ -4580,7 +4645,7 @@ function buildUserMutationOps(ctx) {
         );
       }
       await sessionFunctions.deleteByUserId(userId);
-      logger9.info("User deleted", { userId });
+      logger10.info("User deleted", { userId });
       return ok(void 0);
     }
   };
@@ -4590,7 +4655,7 @@ function buildPasswordChangeOps(ctx) {
   const { validatePassword, hashPassword } = ctx;
   return {
     async adminResetPassword(userId, newPassword) {
-      logger9.debug("Admin resetting user password", { userId });
+      logger10.debug("Admin resetting user password", { userId });
       const userResult = await userRepository.findById(userId);
       if (!userResult.success) {
         return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
@@ -4615,7 +4680,7 @@ function buildPasswordChangeOps(ctx) {
         return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
       }
       await sessionFunctions.deleteByUserId(userId);
-      logger9.info("Admin reset password", { userId });
+      logger10.info("Admin reset password", { userId });
       return ok(void 0);
     },
     async changePassword(userId, oldPassword, newPassword) {
@@ -4668,7 +4733,7 @@ function buildPasswordChangeOps(ctx) {
         return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
       }
       await sessionFunctions.deleteByUserId(userId);
-      logger9.info("Password changed", { userId });
+      logger10.info("Password changed", { userId });
       return ok(void 0);
     },
     /**
@@ -4693,15 +4758,15 @@ function buildPasswordResetOps(ctx) {
   const { validatePassword, hashPassword } = ctx;
   return {
     async requestPasswordReset(identifier) {
-      logger9.debug("Password reset requested", { identifier });
+      logger10.debug("Password reset requested", { identifier });
       const resetConfig = ctx.resetConfig;
       const userResult = await userRepository.findByIdentifier(identifier);
       if (!userResult.success) {
-        logger9.warn("Failed to look up user for password reset", { identifier });
+        logger10.warn("Failed to look up user for password reset", { identifier });
         return ok(void 0);
       }
       if (!userResult.data) {
-        logger9.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
+        logger10.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
         return ok(void 0);
       }
       const user = toUser(userResult.data);
@@ -4715,16 +4780,16 @@ function buildPasswordResetOps(ctx) {
         try {
           await onPasswordResetRequest(user, token, expiresAt);
         } catch (callbackError) {
-          logger9.error("Password reset callback failed", { userId: user.id, error: callbackError });
+          logger10.error("Password reset callback failed", { userId: user.id, error: callbackError });
         }
       } else {
-        logger9.warn("No password reset callback configured, token will not be delivered to user", { userId: user.id });
+        logger10.warn("No password reset callback configured, token will not be delivered to user", { userId: user.id });
       }
-      logger9.info("Password reset token generated", { userId: user.id });
+      logger10.info("Password reset token generated", { userId: user.id });
       return ok(void 0);
     },
     async confirmPasswordReset(token, newPassword) {
-      logger9.debug("Confirming password reset");
+      logger10.debug("Confirming password reset");
       const resetConfig = ctx.resetConfig;
       const validateResult = validatePassword(newPassword);
       if (!validateResult.success)
@@ -4756,7 +4821,7 @@ function buildPasswordResetOps(ctx) {
       }
       await resetTokenRepository.removeToken(token);
       await sessionFunctions.deleteByUserId(userId);
-      logger9.info("Password reset confirmed", { userId });
+      logger10.info("Password reset confirmed", { userId });
       return ok(void 0);
     }
   };
@@ -4782,7 +4847,7 @@ function buildUserFunctions(deps) {
 }
 
 // src/iam-main.ts
-var logger10 = core.logger.child({ module: "iam", scope: "main" });
+var logger11 = core.logger.child({ module: "iam", scope: "main" });
 var initInProgress = false;
 var currentConfig = null;
 var currentAuth = null;
@@ -4790,6 +4855,7 @@ var currentUser = null;
 var currentAuthz = null;
 var currentSession = null;
 var currentApiKey = null;
+var currentTicket = null;
 var notInitialized = core.module.createNotInitializedKit(
   HaiIamError.NOT_INITIALIZED,
   () => iamM("iam_notInitialized")
@@ -4798,6 +4864,7 @@ var notInitializedAuth = notInitialized.proxy();
 var notInitializedAuthz = notInitialized.proxy();
 var notInitializedSession = notInitialized.proxy();
 var notInitializedApiKey = notInitialized.proxy();
+var notInitializedTicket = notInitialized.proxy();
 var syncUserProxy = notInitialized.proxy("sync");
 var asyncUserProxy = notInitialized.proxy();
 var notInitializedUser = new Proxy({}, {
@@ -4808,7 +4875,7 @@ var notInitializedUser = new Proxy({}, {
 var iam = {
   async init(config) {
     if (initInProgress) {
-      logger10.warn("IAM init already in progress, skipping concurrent call");
+      logger11.warn("IAM init already in progress, skipping concurrent call");
       return err(
         HaiIamError.CONFIG_ERROR,
         iamM("iam_initInProgress")
@@ -4817,11 +4884,11 @@ var iam = {
     initInProgress = true;
     try {
       if (currentConfig !== null) {
-        logger10.warn("IAM module is already initialized, reinitializing");
+        logger11.warn("IAM module is already initialized, reinitializing");
         await iam.close();
       }
       const { ldapClientFactory, ldapSyncUser, onPasswordResetRequest, onOtpSendEmail, onOtpSendSms, ...settingsInput } = config;
-      logger10.info("Initializing IAM module");
+      logger11.info("Initializing IAM module");
       if (!reldb.isInitialized) {
         return err(
           HaiIamError.CONFIG_ERROR,
@@ -4846,7 +4913,7 @@ var iam = {
       }
       const parseResult = IamConfigSchema.safeParse(settingsInput);
       if (!parseResult.success) {
-        logger10.error("IAM config validation failed", { error: parseResult.error.message });
+        logger11.error("IAM config validation failed", { error: parseResult.error.message });
         return err(
           HaiIamError.CONFIG_ERROR,
           iamM("iam_configError", { params: { error: parseResult.error.message } }),
@@ -4895,6 +4962,7 @@ var iam = {
       currentUser = userResult.data;
       currentConfig = parsed;
       currentApiKey = authnResult.data.apiKeyFunctions;
+      currentTicket = createTicketOperations();
       const authn = authnResult.data.authn;
       currentAuth = {
         ...authn,
@@ -4906,10 +4974,10 @@ var iam = {
           return authn.login({ identifier: options.username, password: options.password });
         }
       };
-      logger10.info("IAM module initialized");
+      logger11.info("IAM module initialized");
       return ok(void 0);
     } catch (error) {
-      logger10.error("IAM module initialization failed", { error });
+      logger11.error("IAM module initialization failed", { error });
       return err(
         HaiIamError.CONFIG_ERROR,
         iamM("iam_initFailed"),
@@ -4934,6 +5002,9 @@ var iam = {
   get apiKey() {
     return currentApiKey ?? notInitializedApiKey;
   },
+  get ticket() {
+    return currentTicket ?? notInitializedTicket;
+  },
   get config() {
     return currentConfig ? core.sanitize.sanitizeSensitiveFields(currentConfig) : null;
   },
@@ -4945,15 +5016,16 @@ var iam = {
   },
   async close() {
     if (currentConfig === null && currentAuth === null && currentUser === null && currentAuthz === null && currentSession === null) {
-      logger10.info("IAM module already closed, skipping");
+      logger11.info("IAM module already closed, skipping");
       return;
     }
-    logger10.info("Closing IAM module");
+    logger11.info("Closing IAM module");
     currentAuth = null;
     currentUser = null;
     currentAuthz = null;
     currentSession = null;
     currentApiKey = null;
+    currentTicket = null;
     currentConfig = null;
     resetApiKeyRepoSingleton();
     resetOtpRepoSingleton();
@@ -4961,7 +5033,7 @@ var iam = {
     resetResetTokenRepoSingleton();
     resetRoleRepoSingleton();
     resetPermissionRepoSingleton();
-    logger10.info("IAM module closed");
+    logger11.info("IAM module closed");
   }
 };