@h-ai/iam 0.1.0-alpha.59 → 0.1.0-alpha.61

package/dist/index.js

@@ -7,12 +7,13 @@ import { randomBytes } from 'crypto';
 import { audit } from '@h-ai/audit';
 
 // src/iam-config.ts
+var WebUrlSchema = z.url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol));
 var AuthStrategyTypeSchema = z.enum(["password", "otp", "ldap", "apikey"]);
 var PasswordConfigSchema = z.object({
   /** 最小长度（默认 8） */
   minLength: z.number().int().min(1).default(8),
   /** 最大长度（默认 128） */
-  maxLength: z.number().int().max(256).default(128),
+  maxLength: z.number().int().min(1).max(256).default(128),
   /** 需要大写字母 */
   requireUppercase: z.boolean().default(true),
   /** 需要小写字母 */
@@ -23,8 +24,11 @@ var PasswordConfigSchema = z.object({
   requireSpecialChar: z.boolean().default(false),
   /** 密码过期天数（0 表示不过期） */
   expirationDays: z.number().int().min(0).default(0)
-});
+}).refine((config) => config.maxLength >= config.minLength, { message: "maxLength must be >= minLength", path: ["maxLength"] });
 var OtpConfigSchema = z.object({
+  /** 分别启用邮件、短信验证码 */
+  email: z.boolean().default(true),
+  sms: z.boolean().default(true),
   /** 验证码长度（默认 6） */
   length: z.number().int().min(4).max(8).default(6),
   /** 验证码过期时间（秒，默认 300） */
@@ -35,6 +39,12 @@ var OtpConfigSchema = z.object({
   resendInterval: z.number().int().min(30).default(60)
 });
 var PasswordResetConfigSchema = z.object({
+  /** 重置通知渠道，phone 使用 password_reset_sms 模板。 */
+  mode: z.enum(["email", "phone"]).default("email"),
+  /** 重置页面的绝对地址，通知模板可使用 resetUrl。 */
+  resetUrl: WebUrlSchema.optional(),
+  /** 是否启用密码重置 */
+  enabled: z.boolean().default(true),
   /** 重置令牌有效期（秒，默认 3600 = 1小时） */
   tokenExpiresIn: z.number().int().min(300).default(3600),
   /** 最大验证尝试次数（默认 3） */
@@ -42,7 +52,7 @@ var PasswordResetConfigSchema = z.object({
 });
 var LdapConfigSchema = z.object({
   /** LDAP 服务器 URL */
-  url: z.string().url(),
+  url: z.url().refine((value) => ["ldap:", "ldaps:"].includes(new URL(value).protocol)),
   /** 绑定 DN */
   bindDn: z.string(),
   /** 绑定密码 */
@@ -75,8 +85,8 @@ var LoginConfigSchema = z.object({
   password: z.boolean().default(true),
   /** 是否启用 OTP 登录 */
   otp: z.boolean().default(true),
-  /** 是否启用 LDAP 登录 */
-  ldap: z.boolean().default(true),
+  /** 是否启用 LDAP 登录；需要显式开启并提供 ldap 配置。 */
+  ldap: z.boolean().default(false),
   /** 是否启用 API Key 登录 */
   apikey: z.boolean().default(false)
 });
@@ -93,15 +103,29 @@ var SecurityConfigSchema = z.object({
   lockoutDuration: z.number().int().min(60).default(900)
 });
 var AgreementConfigSchema = z.object({
+  /** 用户协议 Markdown 正文；同时配置 URL 时优先显示正文。 */
+  userAgreementMarkdown: z.string().min(1).optional(),
+  /** 隐私协议 Markdown 正文；YAML 使用 | 保留段落和换行。 */
+  privacyPolicyMarkdown: z.string().min(1).optional(),
   /** 用户协议 URL */
-  userAgreementUrl: z.url().optional(),
+  userAgreementUrl: WebUrlSchema.optional(),
   /** 隐私协议 URL */
-  privacyPolicyUrl: z.url().optional(),
+  privacyPolicyUrl: WebUrlSchema.optional(),
   /** 注册时展示协议 */
   showOnRegister: z.boolean().default(true),
   /** 登录时展示协议 */
   showOnLogin: z.boolean().default(false)
 });
+var AuthImageSchema = z.string().refine((value) => /^https?:\/\//.test(value) || value.startsWith("/") && !value.startsWith("//"));
+var AuthUiConfigSchema = z.object({
+  variant: z.enum(["card", "split"]).default("card"),
+  title: z.string().optional(),
+  subtitle: z.string().optional(),
+  brandTitle: z.string().optional(),
+  brandText: z.string().optional(),
+  logoUrl: AuthImageSchema.optional(),
+  illustrationUrl: AuthImageSchema.optional()
+});
 var SessionConfigSchema = z.object({
   /** 会话超时时间（秒，默认 86400 = 24小时） */
   maxAge: z.number().int().min(60).default(86400),
@@ -121,6 +145,8 @@ var RbacConfigSchema = z.object({
   defaultRole: z.string().default("user")
 });
 var IamConfigSchema = z.object({
+  /** 认证页外观 */
+  ui: AuthUiConfigSchema.optional(),
   // ─── 认证策略配置 ───
   /** 密码配置 */
   password: PasswordConfigSchema.optional(),
@@ -136,7 +162,7 @@ var IamConfigSchema = z.object({
   login: LoginConfigSchema.default({
     password: true,
     otp: true,
-    ldap: true,
+    ldap: false,
     apikey: false
   }),
   /** 注册配置 */
@@ -159,7 +185,7 @@ var IamConfigSchema = z.object({
   session: SessionConfigSchema.optional(),
   // ─── 授权配置 ───
   /** RBAC 配置 */
-  rbac: RbacConfigSchema.optional(),
+  rbac: RbacConfigSchema.default(() => RbacConfigSchema.parse({})),
   // ─── 运行时选项 ───
   /** 是否初始化默认角色和权限（默认 true） */
   seedDefaultData: z.boolean().default(true)
@@ -168,6 +194,10 @@ var IamConfigSchema = z.object({
 // messages/en-US.json
 var en_US_default = {
   $schema: "https://inlang.com/schema/inlang-message-format",
+  iam_securityStateFailed: "Unable to update authentication security state. Please try again later.",
+  iam_securityBusy: "Too many authentication requests. Please try again later.",
+  iam_passwordResetDisabled: "Password reset is disabled or delivery is not configured.",
+  iam_passwordResetDeliveryFailed: "Unable to deliver the reset notification. Please try again later.",
   iam_passwordMinLength: "Password must be at least {minLength} characters",
   iam_passwordMaxLength: "Password cannot exceed {maxLength} characters",
   iam_passwordNeedUppercase: "Password must contain uppercase letters",
@@ -290,7 +320,7 @@ var en_US_default = {
   iam_queryOtpFailed: "Failed to query OTP: {message}",
   iam_updateOtpAttemptsFailed: "Failed to update OTP attempts: {message}",
   iam_deleteOtpFailed: "Failed to delete OTP: {message}",
-  iam_otpSendFailed: "Failed to send OTP: {message}",
+  iam_otpSendFailed: "Failed to send verification code. Please try again later.",
   iam_resetTokenInvalid: "Invalid or expired password reset token",
   iam_resetTokenMaxAttempts: "Too many verification attempts, please request a new reset token",
   iam_saveResetTokenFailed: "Failed to save password reset token: {message}",
@@ -351,6 +381,10 @@ var en_US_default = {
 // messages/zh-CN.json
 var zh_CN_default = {
   $schema: "https://inlang.com/schema/inlang-message-format",
+  iam_securityStateFailed: "\u65E0\u6CD5\u66F4\u65B0\u8BA4\u8BC1\u5B89\u5168\u72B6\u6001\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  iam_securityBusy: "\u8BA4\u8BC1\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  iam_passwordResetDisabled: "\u5BC6\u7801\u91CD\u7F6E\u672A\u542F\u7528\u6216\u901A\u77E5\u6E20\u9053\u672A\u914D\u7F6E",
+  iam_passwordResetDeliveryFailed: "\u91CD\u7F6E\u901A\u77E5\u53D1\u9001\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
   iam_passwordMinLength: "\u5BC6\u7801\u957F\u5EA6\u81F3\u5C11\u4E3A {minLength} \u4E2A\u5B57\u7B26",
   iam_passwordMaxLength: "\u5BC6\u7801\u957F\u5EA6\u4E0D\u80FD\u8D85\u8FC7 {maxLength} \u4E2A\u5B57\u7B26",
   iam_passwordNeedUppercase: "\u5BC6\u7801\u5FC5\u987B\u5305\u542B\u5927\u5199\u5B57\u6BCD",
@@ -473,7 +507,7 @@ var zh_CN_default = {
   iam_queryOtpFailed: "\u67E5\u8BE2 OTP \u5931\u8D25: {message}",
   iam_updateOtpAttemptsFailed: "\u66F4\u65B0 OTP \u5C1D\u8BD5\u6B21\u6570\u5931\u8D25: {message}",
   iam_deleteOtpFailed: "\u5220\u9664 OTP \u5931\u8D25: {message}",
-  iam_otpSendFailed: "\u9A8C\u8BC1\u7801\u53D1\u9001\u5931\u8D25: {message}",
+  iam_otpSendFailed: "\u9A8C\u8BC1\u7801\u53D1\u9001\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
   iam_resetTokenInvalid: "\u5BC6\u7801\u91CD\u7F6E\u4EE4\u724C\u65E0\u6548\u6216\u5DF2\u8FC7\u671F",
   iam_resetTokenMaxAttempts: "\u9A8C\u8BC1\u6B21\u6570\u8FC7\u591A\uFF0C\u8BF7\u91CD\u65B0\u7533\u8BF7\u91CD\u7F6E\u4EE4\u724C",
   iam_saveResetTokenFailed: "\u4FDD\u5B58\u5BC6\u7801\u91CD\u7F6E\u4EE4\u724C\u5931\u8D25: {message}",
@@ -559,6 +593,8 @@ var IamErrorInfo = {
   RESET_TOKEN_EXPIRED: "020:400",
   RESET_TOKEN_MAX_ATTEMPTS: "021:429",
   OTP_EXPIRED: "022:400",
+  SECURITY_BUSY: "023:429",
+  PASSWORD_RESET_DISABLED: "024:403",
   SESSION_NOT_FOUND: "101:401",
   SESSION_EXPIRED: "102:401",
   SESSION_INVALID: "103:401",
@@ -792,9 +828,11 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
 function buildAgreementDisplay(config, enabled) {
   if (!enabled)
     return void 0;
-  if (!config.userAgreementUrl && !config.privacyPolicyUrl)
+  if (!config.userAgreementMarkdown && !config.privacyPolicyMarkdown && !config.userAgreementUrl && !config.privacyPolicyUrl)
     return void 0;
   return {
+    userAgreementMarkdown: config.userAgreementMarkdown,
+    privacyPolicyMarkdown: config.privacyPolicyMarkdown,
     userAgreementUrl: config.userAgreementUrl,
     privacyPolicyUrl: config.privacyPolicyUrl,
     showOnRegister: config.showOnRegister,
@@ -962,6 +1000,40 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
       fields: USER_FIELDS
     });
   }
+  async recordLoginFailure(userId, policy) {
+    const sqlite = reldb.config?.type === "sqlite";
+    const now = sqlite ? Date.now() : /* @__PURE__ */ new Date();
+    const deadline = Date.now() + policy.lockoutDuration * 1e3;
+    const lockedUntil = sqlite ? deadline : new Date(deadline);
+    const expired = await reldb.sql.execute(`UPDATE ${TABLE_NAME2} SET login_failed_count = 0, locked_until = NULL, last_login_failed_at = NULL WHERE id = ? AND locked_until <= ?`, [userId, now]);
+    if (!expired.success)
+      return this.buildQueryError(expired.error, expired.error);
+    const result = await reldb.sql.execute(
+      `UPDATE ${TABLE_NAME2} SET locked_until = CASE WHEN COALESCE(login_failed_count, 0) + 1 >= ? THEN ? ELSE locked_until END, login_failed_count = COALESCE(login_failed_count, 0) + 1, last_login_failed_at = ? WHERE id = ? AND locked_until IS NULL`,
+      [policy.maxLoginAttempts, lockedUntil, now, userId]
+    );
+    if (!result.success)
+      return this.buildQueryError(result.error, result.error);
+    return ok(void 0);
+  }
+  async resetLoginFailures(userId) {
+    const result = await reldb.sql.execute(
+      `UPDATE ${TABLE_NAME2} SET login_failed_count = 0, last_login_failed_at = NULL, locked_until = NULL WHERE id = ? AND enabled = ? AND (locked_until IS NULL OR locked_until <= ?)`,
+      [userId, reldb.config?.type === "postgresql" ? true : 1, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date()]
+    );
+    if (!result.success)
+      return this.buildQueryError(result.error, result.error);
+    if (result.data.changes === 0) {
+      const user = await this.findById(userId);
+      if (!user.success)
+        return user;
+      if (!user.data?.enabled)
+        return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+      if (user.data.lockedUntil && user.data.lockedUntil > /* @__PURE__ */ new Date())
+        return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
+    }
+    return ok(void 0);
+  }
   /** 根据用户名查找用户 */
   async findByUsername(username, tx) {
     return this.findOneBy("username = ?", [username], tx);
@@ -1064,24 +1136,10 @@ function isAccountLocked(user) {
   return /* @__PURE__ */ new Date() < user.lockedUntil;
 }
 async function recordLoginFailure(userRepository, user, policy) {
-  const failedCount = (user.loginFailedCount || 0) + 1;
-  const updateData = {
-    loginFailedCount: failedCount,
-    lastLoginFailedAt: /* @__PURE__ */ new Date()
-  };
-  if (failedCount >= policy.maxLoginAttempts) {
-    updateData.lockedUntil = new Date(Date.now() + policy.lockoutDuration * 1e3);
-  }
-  await userRepository.updateById(user.id, updateData);
+  return userRepository.recordLoginFailure(user.id, policy);
 }
 async function resetLoginFailures(userRepository, user) {
-  if (user.loginFailedCount && user.loginFailedCount > 0) {
-    await userRepository.updateById(user.id, {
-      loginFailedCount: 0,
-      lastLoginFailedAt: void 0,
-      lockedUntil: void 0
-    });
-  }
+  return userRepository.resetLoginFailures(user.id);
 }
 
 // src/authn/apikey/iam-authn-apikey-strategy.ts
@@ -1228,6 +1286,60 @@ function createApiKeyStrategy(config) {
   };
   return { strategy, apiKeyFunctions };
 }
+async function loadLdapClientFactory() {
+  const { Client } = await import('ldapts');
+  return async (config) => {
+    const client = new Client({ url: config.url, connectTimeout: config.connectTimeout, timeout: config.connectTimeout });
+    try {
+      if (config.useTls && config.url.startsWith("ldap://"))
+        await client.startTLS({ minVersion: "TLSv1.2" });
+      return ok({
+        async bind(dn, password) {
+          if (!password)
+            return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
+          try {
+            await client.bind(dn, password);
+            return ok(void 0);
+          } catch (error) {
+            return err(HaiIamError.LDAP_BIND_FAILED, iamM("iam_passwordWrong"), error);
+          }
+        },
+        async search(base, filter, attributes) {
+          try {
+            const result = await client.search(base, { scope: "sub", filter, attributes });
+            return ok(result.searchEntries.map((entry) => {
+              const values = {};
+              for (const attribute of attributes) {
+                const value = entry[attribute];
+                if (typeof value === "string")
+                  values[attribute] = value;
+                else if (Array.isArray(value))
+                  values[attribute] = value.map((item) => String(item));
+                else if (value !== void 0)
+                  values[attribute] = String(value);
+              }
+              return { dn: entry.dn, attributes: values };
+            }));
+          } catch (error) {
+            return err(HaiIamError.LDAP_SEARCH_FAILED, iamM("iam_ldapSearchFailed"), error);
+          }
+        },
+        async unbind() {
+          try {
+            await client.unbind();
+            return ok(void 0);
+          } catch (error) {
+            return err(HaiIamError.LDAP_CONNECTION_FAILED, iamM("iam_ldapConnectionFailed"), error);
+          }
+        }
+      });
+    } catch (error) {
+      await client.unbind().catch(() => {
+      });
+      return err(HaiIamError.LDAP_CONNECTION_FAILED, iamM("iam_ldapConnectionFailed"), error);
+    }
+  };
+}
 var logger2 = core.logger.child({ module: "iam", scope: "ldap-strategy" });
 function escapeLdapFilterValue(value) {
   return value.replace(/[\\*()/\0]/g, (ch) => {
@@ -1276,6 +1388,8 @@ function createLdapStrategy(config) {
         return credentialResult;
       }
       const { username, password } = credentialResult.data;
+      if (!username.trim() || !password)
+        return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
       const clientResult = await ldapClientFactory(ldapConfig);
       if (!clientResult.success) {
         return err(
@@ -1340,7 +1454,9 @@ function createLdapStrategy(config) {
         const userBindResult = await client.bind(entry.dn, password);
         if (!userBindResult.success) {
           if (storedUser) {
-            await recordLoginFailure(userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+            const failureResult = await recordLoginFailure(userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+            if (!failureResult.success)
+              return failureResult;
           }
           logger2.warn("LDAP authentication failed", { username });
           return err(
@@ -1353,7 +1469,7 @@ function createLdapStrategy(config) {
             username: ldapUsername,
             email: ldapEmail,
             displayName: ldapDisplayName,
-            enabled: true,
+            enabled: config.defaultEnabled ?? true,
             emailVerified: !!ldapEmail,
             metadata: {
               ldapDn: entry.dn,
@@ -1374,7 +1490,11 @@ function createLdapStrategy(config) {
           storedUser = createdResult.data;
           if (storedUser && config.onUserAutoRegistered) {
             try {
-              await config.onUserAutoRegistered(storedUser.id);
+              const assigned = await config.onUserAutoRegistered(storedUser.id);
+              if (!assigned.success) {
+                await userRepository.deleteById(storedUser.id);
+                return assigned;
+              }
             } catch (callbackError) {
               logger2.warn("onUserAutoRegistered callback failed", { userId: storedUser?.id, error: callbackError });
             }
@@ -1400,7 +1520,9 @@ function createLdapStrategy(config) {
           const ldapUser = buildLdapUser(entry, ldapUsername, ldapEmail, ldapDisplayName);
           return ok(ldapUser);
         }
-        await resetLoginFailures(userRepository, storedUser);
+        const resetResult = await resetLoginFailures(userRepository, storedUser);
+        if (!resetResult.success)
+          return resetResult;
         logger2.info("LDAP authentication succeeded", { userId: storedUser.id });
         return ok(toUser(storedUser));
       } finally {
@@ -1455,7 +1577,9 @@ function createCacheOtpRepository() {
           result.error
         );
       }
-      await cache.kv.del(buildOtpAttemptsKey(identifier));
+      const reset = await cache.kv.del(buildOtpAttemptsKey(identifier));
+      if (!reset.success)
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), reset.error);
       return ok(void 0);
     },
     async fetchOtp(identifier) {
@@ -1471,6 +1595,8 @@ function createCacheOtpRepository() {
         return ok(null);
       }
       const attemptsResult = await cache.kv.get(buildOtpAttemptsKey(identifier));
+      if (!attemptsResult.success)
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), attemptsResult.error);
       const attempts = attemptsResult.success && typeof attemptsResult.data === "number" ? attemptsResult.data : 0;
       const restored = restoreOtpDates(result.data);
       return ok({ ...restored, attempts });
@@ -1498,8 +1624,12 @@ function createCacheOtpRepository() {
         );
       }
       const ttlResult = await cache.kv.ttl(otpKey);
+      if (!ttlResult.success)
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), ttlResult.error);
       const ttl = ttlResult.success && ttlResult.data > 0 ? ttlResult.data : 1;
-      await cache.kv.expire(attemptsKey, ttl);
+      const expire = await cache.kv.expire(attemptsKey, ttl);
+      if (!expire.success)
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), expire.error);
       return ok(incrResult.data);
     },
     async removeOtp(identifier) {
@@ -1511,13 +1641,108 @@ function createCacheOtpRepository() {
           result.error
         );
       }
-      await cache.kv.del(buildOtpAttemptsKey(identifier));
+      const removed = await cache.kv.del(buildOtpAttemptsKey(identifier));
+      if (!removed.success)
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), removed.error);
       return ok(void 0);
     }
   };
   otpRepoInstance = repo;
   return repo;
 }
+
+// src/session/iam-session-utils.ts
+var BASE64_PLUS_REGEX = /\+/g;
+var BASE64_SLASH_REGEX = /\//g;
+var BASE64_TRAILING_PADDING_REGEX = /=+$/;
+function generateToken() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const base64 = btoa(String.fromCharCode(...bytes));
+  return base64.replace(BASE64_PLUS_REGEX, "-").replace(BASE64_SLASH_REGEX, "_").replace(BASE64_TRAILING_PADDING_REGEX, "");
+}
+function buildSession(options, now, sessionTtl, accessToken) {
+  return {
+    userId: options.userId,
+    username: options.username,
+    displayName: options.displayName,
+    avatarUrl: options.avatarUrl,
+    roles: options.roles ?? [],
+    permissions: options.permissions ?? [],
+    source: options.source,
+    accessToken,
+    createdAt: now,
+    lastActiveAt: now,
+    expiresAt: new Date(now.getTime() + sessionTtl * 1e3),
+    data: options.data
+  };
+}
+function getSessionTtl(session, now = Date.now()) {
+  return Math.max(0, Math.floor((session.expiresAt.getTime() - now) / 1e3));
+}
+function applySessionPatch(session, patch) {
+  const nextSession = { ...session };
+  if (patch.data !== void 0) {
+    nextSession.data = { ...nextSession.data, ...patch.data };
+  }
+  if (patch.roles !== void 0) {
+    nextSession.roles = patch.roles;
+  }
+  if (patch.permissions !== void 0) {
+    nextSession.permissions = patch.permissions;
+  }
+  if (patch.username !== void 0) {
+    nextSession.username = patch.username;
+  }
+  if (patch.displayName !== void 0) {
+    nextSession.displayName = patch.displayName;
+  }
+  if (patch.avatarUrl !== void 0) {
+    nextSession.avatarUrl = patch.avatarUrl;
+  }
+  if (patch.source !== void 0) {
+    nextSession.source = patch.source;
+  }
+  nextSession.lastActiveAt = /* @__PURE__ */ new Date();
+  return nextSession;
+}
+
+// src/iam-security.ts
+async function withIamLock(key, operation) {
+  const owner = generateToken();
+  const lockKey = `hai:iam:security:${key}`;
+  for (let attempt = 0; attempt < 500; attempt++) {
+    const acquired = await cache.lock.acquire(lockKey, { owner, ttl: 30 });
+    if (!acquired.success)
+      return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), acquired.error);
+    if (acquired.data) {
+      let leaseValid = true;
+      const renewal = setInterval(() => {
+        void cache.lock.extend(lockKey, 30, owner).then((result) => {
+          if (!result.success || !result.data)
+            leaseValid = false;
+        }).catch(() => {
+          leaseValid = false;
+        });
+      }, 1e4);
+      try {
+        const result = await operation();
+        if (!leaseValid)
+          return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"));
+        return result;
+      } catch (error) {
+        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_securityStateFailed"), error);
+      } finally {
+        clearInterval(renewal);
+        await cache.lock.release(lockKey, owner);
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  return err(HaiIamError.SECURITY_BUSY, iamM("iam_securityBusy"));
+}
+
+// src/authn/otp/iam-authn-otp-strategy.ts
 var logger3 = core.logger.child({ module: "iam", scope: "otp-strategy" });
 var PHONE_IDENTIFIER_REGEX = /^\+?\d{8,}$/;
 var PHONE_SEPARATOR_REGEX = /[\s-]/g;
@@ -1559,98 +1784,136 @@ function createOtpStrategy(config) {
       if (!credentialResult.success) {
         return credentialResult;
       }
-      const { identifier, code } = credentialResult.data;
-      const userResult = await config.userRepository.findByIdentifier(identifier);
-      if (!userResult.success) {
-        return userResult;
-      }
-      let storedUser = userResult.data;
-      if (storedUser) {
-        if (!storedUser.enabled) {
-          return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-        }
-        if (isAccountLocked(storedUser)) {
-          return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
+      const identifier = normalizeOtpIdentifier(credentialResult.data.identifier);
+      const { code } = credentialResult.data;
+      if (!isChannelEnabled(identifier))
+        return err(HaiIamError.LOGIN_DISABLED, iamM("iam_identifierTypeNotSupported"));
+      return withIamLock(`otp:${identifier}`, async () => {
+        const userResult = await config.userRepository.findByIdentifier(identifier);
+        if (!userResult.success) {
+          return userResult;
         }
-      }
-      const storedOtpResult = await config.otpRepository.fetchOtp(identifier);
-      if (!storedOtpResult.success) {
-        return storedOtpResult;
-      }
-      const storedOtp = storedOtpResult.data;
-      if (!storedOtp) {
-        return err(HaiIamError.OTP_INVALID, iamM("iam_otpNotExistOrExpired"));
-      }
-      if (storedOtp.attempts >= otpConfig.maxAttempts) {
-        await config.otpRepository.removeOtp(identifier);
+        let storedUser = userResult.data;
         if (storedUser) {
-          await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+          if (!storedUser.enabled) {
+            return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+          }
+          if (isAccountLocked(storedUser)) {
+            return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
+          }
         }
-        return err(HaiIamError.OTP_INVALID, iamM("iam_otpInvalid"));
-      }
-      if (!core.string.constantTimeEqual(storedOtp.code, code)) {
-        await config.otpRepository.incrementOtpAttempts(identifier);
-        if (storedUser) {
-          await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+        const storedOtpResult = await config.otpRepository.fetchOtp(identifier);
+        if (!storedOtpResult.success) {
+          return storedOtpResult;
         }
-        return err(HaiIamError.OTP_INVALID, iamM("iam_otpWrong"));
-      }
-      await config.otpRepository.removeOtp(identifier);
-      if (!storedUser && allowAutoRegister) {
-        const type = identifierType(identifier);
-        const createResult = await config.userRepository.create({
-          username: identifier,
-          email: type === "email" ? identifier : void 0,
-          phone: type === "phone" ? identifier : void 0,
-          enabled: defaultEnabled,
-          emailVerified: type === "email",
-          phoneVerified: type === "phone"
-        });
-        if (!createResult.success) {
-          return err(
-            HaiIamError.REPOSITORY_ERROR,
-            iamM("iam_createUserFailed", { params: { message: createResult.error.message } }),
-            createResult.error
-          );
+        const storedOtp = storedOtpResult.data;
+        if (!storedOtp) {
+          return err(HaiIamError.OTP_INVALID, iamM("iam_otpNotExistOrExpired"));
         }
-        const createdResult = await config.userRepository.findByIdentifier(identifier);
-        if (!createdResult.success) {
-          return createdResult;
+        if (storedOtp.attempts >= otpConfig.maxAttempts) {
+          const removed2 = await config.otpRepository.removeOtp(identifier);
+          if (!removed2.success)
+            return removed2;
+          if (storedUser) {
+            const failureResult = await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+            if (!failureResult.success)
+              return failureResult;
+          }
+          return err(HaiIamError.OTP_INVALID, iamM("iam_otpInvalid"));
         }
-        storedUser = createdResult.data;
-        if (storedUser && config.onUserAutoRegistered) {
-          try {
-            await config.onUserAutoRegistered(storedUser.id);
-          } catch (callbackError) {
-            logger3.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
+        if (!core.string.constantTimeEqual(storedOtp.code, code)) {
+          const attemptResult = await config.otpRepository.incrementOtpAttempts(identifier);
+          if (!attemptResult.success)
+            return attemptResult;
+          if (attemptResult.data >= otpConfig.maxAttempts) {
+            const removed2 = await config.otpRepository.removeOtp(identifier);
+            if (!removed2.success)
+              return removed2;
+          }
+          if (storedUser) {
+            const failureResult = await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+            if (!failureResult.success)
+              return failureResult;
           }
+          return err(HaiIamError.OTP_INVALID, iamM("iam_otpWrong"));
         }
-      }
-      if (!storedUser) {
-        return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
-      }
-      await resetLoginFailures(config.userRepository, storedUser);
-      logger3.info("OTP authentication succeeded", { userId: storedUser.id });
-      return ok(toUser(storedUser));
+        const removed = await config.otpRepository.removeOtp(identifier);
+        if (!removed.success)
+          return removed;
+        if (!storedUser && allowAutoRegister) {
+          const type = identifierType(identifier);
+          const createResult = await config.userRepository.create({
+            username: identifier,
+            email: type === "email" ? identifier : void 0,
+            phone: type === "phone" ? identifier : void 0,
+            enabled: defaultEnabled,
+            emailVerified: type === "email",
+            phoneVerified: type === "phone"
+          });
+          if (!createResult.success) {
+            return err(
+              HaiIamError.REPOSITORY_ERROR,
+              iamM("iam_createUserFailed", { params: { message: createResult.error.message } }),
+              createResult.error
+            );
+          }
+          const createdResult = await config.userRepository.findByIdentifier(identifier);
+          if (!createdResult.success) {
+            return createdResult;
+          }
+          storedUser = createdResult.data;
+          if (storedUser && config.onUserAutoRegistered) {
+            try {
+              const assigned = await config.onUserAutoRegistered(storedUser.id);
+              if (!assigned.success) {
+                await config.userRepository.deleteById(storedUser.id);
+                return assigned;
+              }
+            } catch (callbackError) {
+              logger3.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
+            }
+          }
+        }
+        if (!storedUser) {
+          return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
+        }
+        if (!storedUser.enabled)
+          return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+        const resetResult = await resetLoginFailures(config.userRepository, storedUser);
+        if (!resetResult.success)
+          return resetResult;
+        logger3.info("OTP authentication succeeded", { userId: storedUser.id });
+        return ok(toUser(storedUser));
+      });
     }
   };
+  function isChannelEnabled(identifier) {
+    const type = identifierType(identifier);
+    return type === "email" && otpConfig.email && !!config.onOtpSendEmail || type === "phone" && otpConfig.sms && !!config.onOtpSendSms;
+  }
   async function challenge(identifier) {
-    const existingResult = await config.otpRepository.fetchOtp(identifier);
-    if (existingResult.success && existingResult.data) {
-      const elapsedSeconds = Math.floor((Date.now() - existingResult.data.createdAt.getTime()) / 1e3);
-      if (elapsedSeconds < otpConfig.resendInterval) {
-        return err(
-          HaiIamError.OTP_RESEND_TOO_FAST,
-          iamM("iam_otpResendTooFast", { params: { seconds: otpConfig.resendInterval - elapsedSeconds } })
-        );
-      }
-    }
+    identifier = normalizeOtpIdentifier(identifier);
+    if (!isChannelEnabled(identifier))
+      return err(HaiIamError.LOGIN_DISABLED, iamM("iam_identifierTypeNotSupported"));
     const code = generateOtpCode(otpConfig.length);
     const expiresAt = new Date(Date.now() + otpConfig.expiresIn * 1e3);
-    const storeResult = await config.otpRepository.saveOtp(identifier, code, otpConfig.expiresIn);
-    if (!storeResult.success) {
-      return storeResult;
-    }
+    const saved = await withIamLock(`otp:${identifier}`, async () => {
+      const cooldownKey = `hai:iam:otp:cooldown:${identifier}`;
+      const cooldown = await cache.kv.get(cooldownKey);
+      if (!cooldown.success)
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), cooldown.error);
+      if (cooldown.data && cooldown.data > Date.now())
+        return err(HaiIamError.OTP_RESEND_TOO_FAST, iamM("iam_otpResendTooFast", { params: { seconds: Math.ceil((cooldown.data - Date.now()) / 1e3) } }));
+      const storeResult = await config.otpRepository.saveOtp(identifier, code, otpConfig.expiresIn);
+      if (!storeResult.success)
+        return storeResult;
+      const limited = await cache.kv.set(cooldownKey, Date.now() + otpConfig.resendInterval * 1e3, { ex: otpConfig.resendInterval });
+      if (!limited.success)
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), limited.error);
+      return ok(void 0);
+    });
+    if (!saved.success)
+      return saved;
     const type = identifierType(identifier);
     if (type === "email" && config.onOtpSendEmail) {
       try {
@@ -1658,7 +1921,7 @@ function createOtpStrategy(config) {
       } catch (error) {
         return err(
           HaiIamError.INTERNAL_ERROR,
-          iamM("iam_otpSendFailed", { params: { message: String(error) } }),
+          iamM("iam_otpSendFailed"),
           error
         );
       }
@@ -1668,7 +1931,7 @@ function createOtpStrategy(config) {
       } catch (error) {
         return err(
           HaiIamError.INTERNAL_ERROR,
-          iamM("iam_otpSendFailed", { params: { message: String(error) } }),
+          iamM("iam_otpSendFailed"),
           error
         );
       }
@@ -1765,7 +2028,9 @@ function createPasswordStrategy(config) {
       return mapPasswordError(verifyResult.error.message);
     }
     if (!verifyResult.data) {
-      await recordLoginFailure(config.userRepository, user, { maxLoginAttempts, lockoutDuration });
+      const failureResult = await recordLoginFailure(config.userRepository, user, { maxLoginAttempts, lockoutDuration });
+      if (!failureResult.success)
+        return failureResult;
       logger4.warn("Password verification failed", { userId: user.id });
       return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
     }
@@ -1797,7 +2062,9 @@ function createPasswordStrategy(config) {
       if (isPasswordExpired(storedUser)) {
         return err(HaiIamError.PASSWORD_EXPIRED, iamM("iam_passwordExpired"));
       }
-      await resetLoginFailures(config.userRepository, storedUser);
+      const resetResult = await resetLoginFailures(config.userRepository, storedUser);
+      if (!resetResult.success)
+        return resetResult;
       logger4.info("Password authentication succeeded", { userId: storedUser.id });
       return ok(toUser(storedUser));
     }
@@ -1826,12 +2093,14 @@ async function createAuthnOperations(deps) {
     const securityConfig = SecurityConfigSchema.parse(config.security ?? {});
     const loginConfig = LoginConfigSchema.parse(config.login ?? {});
     async function onUserAutoRegistered(userId) {
-      if (!config.rbac?.defaultRole)
-        return;
+      if (!config.rbac?.enabled || !config.rbac.defaultRole)
+        return ok(void 0);
       const roleResult = await authzFunctions.getRoleByCode(config.rbac.defaultRole);
-      if (roleResult.success && roleResult.data) {
-        await authzFunctions.assignRole(userId, roleResult.data.id);
-      }
+      if (!roleResult.success)
+        return roleResult;
+      if (!roleResult.data)
+        return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+      return authzFunctions.assignRole(userId, roleResult.data.id);
     }
     const passwordResult = createPasswordStrategy({
       passwordConfig: config.password,
@@ -1857,12 +2126,14 @@ async function createAuthnOperations(deps) {
       });
     }
     let ldapStrategy;
-    if (loginConfig.ldap && config.ldap && ldapClientFactory) {
+    if (loginConfig.ldap && config.ldap) {
+      const clientFactory = ldapClientFactory ?? await loadLdapClientFactory();
       ldapStrategy = createLdapStrategy({
         ldapConfig: config.ldap,
         userRepository,
-        ldapClientFactory,
+        ldapClientFactory: clientFactory,
         syncUser: ldapSyncUser ?? true,
+        defaultEnabled: config.register.defaultEnabled,
         maxLoginAttempts: securityConfig.maxLoginAttempts,
         lockoutDuration: securityConfig.lockoutDuration,
         onUserAutoRegistered
@@ -1892,7 +2163,7 @@ async function createAuthnOperations(deps) {
       config
     });
     logger5.info("Authn sub-feature initialized");
-    return ok({ authn: operations, passwordStrategyResult: passwordResult, apiKeyFunctions });
+    return ok({ authn: operations.authn, loginRegisteredUser: operations.loginRegisteredUser, passwordStrategyResult: passwordResult, apiKeyFunctions });
   } catch (error) {
     logger5.error("Authn sub-feature initialization failed", { error });
     return err(
@@ -1960,6 +2231,8 @@ function buildAuthnOperations(deps) {
     );
   }
   async function buildAuthResult(user) {
+    if (!user.enabled)
+      return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
     const [roleCodesResult, permCodesResult] = await Promise.all([
       resolveUserRoleCodes(user.id),
       resolveUserPermissionCodes(user.id)
@@ -2015,7 +2288,7 @@ function buildAuthnOperations(deps) {
     }
     return result;
   }
-  return {
+  return { loginRegisteredUser: buildAuthResult, authn: {
     async login(credentials) {
       return loginWithStrategy("password", credentials, passwordStrategy);
     },
@@ -2056,7 +2329,7 @@ function buildAuthnOperations(deps) {
       }
       return otpChallenge(identifier);
     }
-  };
+  } };
 }
 var TABLE_NAME3 = "hai_iam_permissions";
 var PERMISSION_FIELDS = [
@@ -3461,6 +3734,62 @@ function createRbacManager(config) {
     }
   };
 }
+
+// src/iam-notifications.ts
+async function resolveIamNotifications(input) {
+  const callbacks = { onOtpSendEmail: input.onOtpSendEmail, onOtpSendSms: input.onOtpSendSms, onPasswordResetRequest: input.onPasswordResetRequest };
+  const reach = input.reach;
+  if (!reach?.isInitialized)
+    return callbacks;
+  const needsEmail = input.login?.otp !== false && !!input.otp && input.otp.email !== false && !callbacks.onOtpSendEmail;
+  const needsSms = input.login?.otp !== false && !!input.otp && input.otp.sms !== false && !callbacks.onOtpSendSms;
+  const needsReset = input.passwordReset?.enabled !== false && !callbacks.onPasswordResetRequest;
+  if (!needsEmail && !needsSms && !needsReset)
+    return callbacks;
+  const templates = await reach.template.list();
+  if (!templates.success)
+    throw new Error(iamM("iam_securityStateFailed"));
+  const configured = new Map(templates.data.map((template) => [template.name, template.provider]));
+  async function send(template, to, vars) {
+    const provider = configured.get(template);
+    if (!reach?.isInitialized || !provider || !to)
+      throw new Error(iamM("iam_passwordResetDeliveryFailed"));
+    const result = await reach.send({ provider, to, template, vars });
+    if (!result.success || !result.data.success)
+      throw new Error(iamM("iam_passwordResetDeliveryFailed"));
+  }
+  if (needsEmail && configured.has("otp_email"))
+    callbacks.onOtpSendEmail = (email, code) => send("otp_email", email, { code });
+  if (needsSms && configured.has("otp_sms"))
+    callbacks.onOtpSendSms = (phone, code) => send("otp_sms", phone, { code });
+  const resetTemplate = input.passwordReset?.mode === "phone" ? "password_reset_sms" : "password_reset";
+  if (needsReset && configured.has(resetTemplate)) {
+    callbacks.onPasswordResetRequest = (user, token, expiresAt) => {
+      const url = input.passwordReset?.resetUrl ? new URL(input.passwordReset.resetUrl) : null;
+      url?.searchParams.set("token", token);
+      const vars = { token, expiresAt: expiresAt.toISOString(), resetUrl: url?.toString() ?? token };
+      return send(resetTemplate, input.passwordReset?.mode === "phone" ? user.phone ?? "" : user.email ?? "", vars);
+    };
+  }
+  return callbacks;
+}
+
+// src/iam-public-config.ts
+function buildIamPublicConfig(config, runtime) {
+  const otp = OtpConfigSchema.parse(config.otp ?? {});
+  const email = config.login.otp && !!config.otp && otp.email && !!runtime.onOtpSendEmail;
+  const sms = config.login.otp && !!config.otp && otp.sms && !!runtime.onOtpSendSms;
+  return {
+    password: PasswordConfigSchema.parse(config.password ?? {}),
+    register: { enabled: config.register.enabled },
+    login: { password: config.login.password, otp: email || sms, ldap: config.login.ldap && !!config.ldap, email, sms },
+    passwordReset: { enabled: config.passwordReset?.enabled !== false && !!runtime.onPasswordResetRequest, mode: config.passwordReset?.mode ?? "email" },
+    otp: { length: otp.length, resendInterval: otp.resendInterval },
+    agreements: { ...config.agreements },
+    ui: AuthUiConfigSchema.parse(config.ui ?? {}),
+    session: { maxAge: SessionConfigSchema.parse(config.session ?? {}).maxAge }
+  };
+}
 var logger7 = core.logger.child({ module: "iam", scope: "seed" });
 var DEFAULT_ROLES = [
   { code: "admin", name: () => iamM("iam_seedRoleAdminName"), description: () => iamM("iam_seedRoleAdminDesc"), isSystem: true },
@@ -3572,64 +3901,6 @@ async function seedIamData(authz) {
     );
   }
 }
-
-// src/session/iam-session-utils.ts
-var BASE64_PLUS_REGEX = /\+/g;
-var BASE64_SLASH_REGEX = /\//g;
-var BASE64_TRAILING_PADDING_REGEX = /=+$/;
-function generateToken() {
-  const bytes = new Uint8Array(32);
-  crypto.getRandomValues(bytes);
-  const base64 = btoa(String.fromCharCode(...bytes));
-  return base64.replace(BASE64_PLUS_REGEX, "-").replace(BASE64_SLASH_REGEX, "_").replace(BASE64_TRAILING_PADDING_REGEX, "");
-}
-function buildSession(options, now, sessionTtl, accessToken) {
-  return {
-    userId: options.userId,
-    username: options.username,
-    displayName: options.displayName,
-    avatarUrl: options.avatarUrl,
-    roles: options.roles ?? [],
-    permissions: options.permissions ?? [],
-    source: options.source,
-    accessToken,
-    createdAt: now,
-    lastActiveAt: now,
-    expiresAt: new Date(now.getTime() + sessionTtl * 1e3),
-    data: options.data
-  };
-}
-function getSessionTtl(session, now = Date.now()) {
-  return Math.max(0, Math.floor((session.expiresAt.getTime() - now) / 1e3));
-}
-function applySessionPatch(session, patch) {
-  const nextSession = { ...session };
-  if (patch.data !== void 0) {
-    nextSession.data = { ...nextSession.data, ...patch.data };
-  }
-  if (patch.roles !== void 0) {
-    nextSession.roles = patch.roles;
-  }
-  if (patch.permissions !== void 0) {
-    nextSession.permissions = patch.permissions;
-  }
-  if (patch.username !== void 0) {
-    nextSession.username = patch.username;
-  }
-  if (patch.displayName !== void 0) {
-    nextSession.displayName = patch.displayName;
-  }
-  if (patch.avatarUrl !== void 0) {
-    nextSession.avatarUrl = patch.avatarUrl;
-  }
-  if (patch.source !== void 0) {
-    nextSession.source = patch.source;
-  }
-  nextSession.lastActiveAt = /* @__PURE__ */ new Date();
-  return nextSession;
-}
-
-// src/session/iam-session-repository-cache.ts
 var TOKEN_KEY_PREFIX = "hai:iam:token:";
 var USER_TOKENS_KEY_PREFIX = "hai:iam:user:";
 var REFRESH_TOKEN_PREFIX = "hai:iam:refresh:";
@@ -4203,61 +4474,82 @@ function createCacheResetTokenRepository() {
   }
   const repo = {
     async saveToken(token, userId, expiresAt) {
-      const hashResult = hashResetToken(token);
-      if (!hashResult.success) {
-        return hashResult;
-      }
-      const hashedToken = hashResult.data;
-      const ttlSeconds = Math.max(1, Math.ceil((expiresAt.getTime() - Date.now()) / 1e3));
-      const userTokenKey = buildUserTokenKey(userId);
-      const existingTokenResult = await cache.kv.get(userTokenKey);
-      if (!existingTokenResult.success) {
-        return buildResetTokenRepositoryError(
-          "iam_queryResetTokenFailed",
-          existingTokenResult.error.message,
-          existingTokenResult.error
-        );
-      }
-      if (existingTokenResult.data && existingTokenResult.data !== hashedToken) {
-        const removeExistingTokenResult = await cache.kv.del(buildResetTokenKey(existingTokenResult.data));
-        if (!removeExistingTokenResult.success) {
+      return withIamLock(`reset:${userId}`, async () => {
+        const hashResult = hashResetToken(token);
+        if (!hashResult.success) {
+          return hashResult;
+        }
+        const hashedToken = hashResult.data;
+        const ttlSeconds = Math.max(1, Math.ceil((expiresAt.getTime() - Date.now()) / 1e3));
+        const userTokenKey = buildUserTokenKey(userId);
+        const existingTokenResult = await cache.kv.get(userTokenKey);
+        if (!existingTokenResult.success) {
+          return buildResetTokenRepositoryError(
+            "iam_queryResetTokenFailed",
+            existingTokenResult.error.message,
+            existingTokenResult.error
+          );
+        }
+        if (existingTokenResult.data && existingTokenResult.data !== hashedToken) {
+          const removeExistingTokenResult = await cache.kv.del(buildResetTokenKey(existingTokenResult.data));
+          if (!removeExistingTokenResult.success) {
+            return buildResetTokenRepositoryError(
+              "iam_saveResetTokenFailed",
+              removeExistingTokenResult.error.message,
+              removeExistingTokenResult.error
+            );
+          }
+        }
+        const setResult = await cache.kv.set(buildResetTokenKey(hashedToken), userId, { ex: ttlSeconds });
+        if (!setResult.success) {
+          return err(
+            HaiIamError.REPOSITORY_ERROR,
+            iamM("iam_saveResetTokenFailed", { params: { message: setResult.error.message } }),
+            setResult.error
+          );
+        }
+        const saveUserTokenResult = await cache.kv.set(userTokenKey, hashedToken, { ex: ttlSeconds });
+        if (!saveUserTokenResult.success) {
+          await cache.kv.del(buildResetTokenKey(hashedToken));
           return buildResetTokenRepositoryError(
             "iam_saveResetTokenFailed",
-            removeExistingTokenResult.error.message,
-            removeExistingTokenResult.error
+            saveUserTokenResult.error.message,
+            saveUserTokenResult.error
           );
         }
-      }
-      const setResult = await cache.kv.set(buildResetTokenKey(hashedToken), userId, { ex: ttlSeconds });
-      if (!setResult.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveResetTokenFailed", { params: { message: setResult.error.message } }),
-          setResult.error
-        );
-      }
-      const saveUserTokenResult = await cache.kv.set(userTokenKey, hashedToken, { ex: ttlSeconds });
-      if (!saveUserTokenResult.success) {
-        await cache.kv.del(buildResetTokenKey(hashedToken));
-        return buildResetTokenRepositoryError(
-          "iam_saveResetTokenFailed",
-          saveUserTokenResult.error.message,
-          saveUserTokenResult.error
-        );
-      }
-      const attemptsResult = await cache.kv.set(buildAttemptsKey(userId), 0, { ex: ttlSeconds });
-      if (!attemptsResult.success) {
-        await Promise.all([
-          cache.kv.del(buildResetTokenKey(hashedToken)),
-          cache.kv.del(userTokenKey)
-        ]);
-        return buildResetTokenRepositoryError(
-          "iam_saveResetTokenFailed",
-          attemptsResult.error.message,
-          attemptsResult.error
-        );
-      }
-      return ok(void 0);
+        const attemptsResult = await cache.kv.set(buildAttemptsKey(userId), 0, { ex: ttlSeconds });
+        if (!attemptsResult.success) {
+          await Promise.all([
+            cache.kv.del(buildResetTokenKey(hashedToken)),
+            cache.kv.del(userTokenKey)
+          ]);
+          return buildResetTokenRepositoryError(
+            "iam_saveResetTokenFailed",
+            attemptsResult.error.message,
+            attemptsResult.error
+          );
+        }
+        return ok(void 0);
+      });
+    },
+    async useToken(token, maxAttempts, operation) {
+      const hash = hashResetToken(token);
+      if (!hash.success)
+        return hash;
+      const user = await cache.kv.get(buildResetTokenKey(hash.data));
+      if (!user.success)
+        return buildResetTokenRepositoryError("iam_queryResetTokenFailed", user.error.message, user.error);
+      if (!user.data)
+        return err(HaiIamError.RESET_TOKEN_INVALID, iamM("iam_resetTokenInvalid"));
+      return withIamLock(`reset:${user.data}`, async () => {
+        const verified = await repo.tryGetUserByToken(token, maxAttempts);
+        if (!verified.success)
+          return verified;
+        const result = await operation(verified.data);
+        if (!result.success)
+          return result;
+        return repo.removeToken(token);
+      });
     },
     async tryGetUserByToken(token, maxAttempts) {
       const hashResult = hashResetToken(token);
@@ -4281,6 +4573,11 @@ function createCacheResetTokenRepository() {
         );
       }
       const userId = result.data;
+      const current = await cache.kv.get(buildUserTokenKey(userId));
+      if (!current.success)
+        return buildResetTokenRepositoryError("iam_queryResetTokenFailed", current.error.message, current.error);
+      if (current.data !== hashedToken)
+        return err(HaiIamError.RESET_TOKEN_INVALID, iamM("iam_resetTokenInvalid"));
       const attemptsKey = buildAttemptsKey(userId);
       const incrResult = await cache.kv.incr(attemptsKey);
       if (!incrResult.success) {
@@ -4427,16 +4724,12 @@ function buildRegistrationOps(ctx) {
   const { userRepository, authzFunctions, config, registerConfig, agreementConfig } = ctx;
   const { validatePassword, hashPassword } = ctx;
   async function validateRegisterPreconditions(options) {
-    if (!registerConfig.enabled) {
-      return err(
-        HaiIamError.REGISTER_DISABLED,
-        iamM("iam_registerDisabled")
-      );
-    }
     const validateResult = validatePassword(options.password);
     if (!validateResult.success)
       return validateResult;
     const existsResult = await userRepository.existsByUsername(options.username);
+    if (!existsResult.success)
+      return existsResult;
     if (existsResult.success && existsResult.data) {
       return err(
         HaiIamError.USER_ALREADY_EXISTS,
@@ -4445,6 +4738,8 @@ function buildRegistrationOps(ctx) {
     }
     if (options.email) {
       const emailExistsResult = await userRepository.existsByEmail(options.email);
+      if (!emailExistsResult.success)
+        return emailExistsResult;
       if (emailExistsResult.success && emailExistsResult.data) {
         return err(
           HaiIamError.USER_ALREADY_EXISTS,
@@ -4455,61 +4750,74 @@ function buildRegistrationOps(ctx) {
     return ok(void 0);
   }
   async function assignDefaultRole(userId) {
-    if (!config.rbac?.defaultRole)
-      return;
+    if (!config.rbac?.enabled || !config.rbac.defaultRole)
+      return ok(void 0);
     const roleResult = await authzFunctions.getRoleByCode(config.rbac.defaultRole);
-    if (roleResult.success && roleResult.data) {
-      await authzFunctions.assignRole(userId, roleResult.data.id);
+    if (!roleResult.success)
+      return roleResult;
+    if (!roleResult.data)
+      return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+    return authzFunctions.assignRole(userId, roleResult.data.id);
+  }
+  async function createUser(options, enabled) {
+    const preResult = await validateRegisterPreconditions(options);
+    if (!preResult.success)
+      return preResult;
+    const hashResult = hashPassword(options.password);
+    if (!hashResult.success)
+      return hashResult;
+    const txResult = await reldb.tx.begin();
+    if (!txResult.success) {
+      return mapRepositoryError("iam_createUserFailed", txResult.error.message);
     }
+    const tx = txResult.data;
+    const createResult = await userRepository.create({
+      username: options.username,
+      email: options.email,
+      phone: options.phone,
+      displayName: options.displayName,
+      enabled,
+      emailVerified: false,
+      phoneVerified: false,
+      passwordHash: hashResult.data,
+      passwordUpdatedAt: /* @__PURE__ */ new Date(),
+      metadata: options.metadata
+    }, tx);
+    if (!createResult.success) {
+      await tx.rollback();
+      return mapUpdateErrorAsDomainError(createResult.error.message);
+    }
+    const createdUserResult = await userRepository.findByUsername(options.username, tx);
+    if (!createdUserResult.success || !createdUserResult.data) {
+      await tx.rollback();
+      return err(
+        HaiIamError.USER_NOT_FOUND,
+        iamM("iam_userNotExist")
+      );
+    }
+    const commitResult = await tx.commit();
+    if (!commitResult.success) {
+      return mapRepositoryError("iam_createUserFailed", commitResult.error.message);
+    }
+    const createdUser = createdUserResult.data;
+    const assigned = await assignDefaultRole(createdUser.id);
+    if (!assigned.success) {
+      await authzFunctions.syncRoles(createdUser.id, []);
+      await userRepository.deleteById(createdUser.id);
+      return assigned;
+    }
+    logger10.info("User registered", { userId: createdUser.id, username: options.username });
+    return ok({
+      user: toUser(createdUser),
+      agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnRegister)
+    });
   }
   return {
-    async register(options) {
-      const preResult = await validateRegisterPreconditions(options);
-      if (!preResult.success)
-        return preResult;
-      const hashResult = hashPassword(options.password);
-      if (!hashResult.success)
-        return hashResult;
-      const txResult = await reldb.tx.begin();
-      if (!txResult.success) {
-        return mapRepositoryError("iam_createUserFailed", txResult.error.message);
-      }
-      const tx = txResult.data;
-      const createResult = await userRepository.create({
-        username: options.username,
-        email: options.email,
-        phone: options.phone,
-        displayName: options.displayName,
-        enabled: registerConfig.defaultEnabled,
-        emailVerified: false,
-        phoneVerified: false,
-        passwordHash: hashResult.data,
-        passwordUpdatedAt: /* @__PURE__ */ new Date(),
-        metadata: options.metadata
-      }, tx);
-      if (!createResult.success) {
-        await tx.rollback();
-        return mapUpdateErrorAsDomainError(createResult.error.message);
-      }
-      const createdUserResult = await userRepository.findByUsername(options.username, tx);
-      if (!createdUserResult.success || !createdUserResult.data) {
-        await tx.rollback();
-        return err(
-          HaiIamError.USER_NOT_FOUND,
-          iamM("iam_userNotExist")
-        );
-      }
-      const commitResult = await tx.commit();
-      if (!commitResult.success) {
-        return mapRepositoryError("iam_createUserFailed", commitResult.error.message);
-      }
-      const createdUser = createdUserResult.data;
-      await assignDefaultRole(createdUser.id);
-      logger10.info("User registered", { userId: createdUser.id, username: options.username });
-      return ok({
-        user: toUser(createdUser),
-        agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnRegister)
-      });
+    createUser: (options) => createUser(options, true),
+    register(options) {
+      if (!registerConfig.enabled)
+        return Promise.resolve(err(HaiIamError.REGISTER_DISABLED, iamM("iam_registerDisabled")));
+      return createUser(options, registerConfig.defaultEnabled);
     },
     validatePassword(password) {
       return validatePassword(password);
@@ -4806,16 +5114,20 @@ function buildPasswordChangeOps(ctx) {
       }
       const verifyResult = crypto$1.password.verify(oldPassword, user.passwordHash);
       if (!verifyResult.success || !verifyResult.data) {
-        await recordLoginFailure(userRepository, user, {
+        const failureResult = await recordLoginFailure(userRepository, user, {
           maxLoginAttempts: ctx.loginConfig.maxLoginAttempts,
           lockoutDuration: ctx.loginConfig.lockoutDuration
         });
+        if (!failureResult.success)
+          return failureResult;
         return err(
           HaiIamError.INVALID_CREDENTIALS,
           iamM("iam_originalPasswordWrong")
         );
       }
-      await resetLoginFailures(userRepository, user);
+      const resetResult = await resetLoginFailures(userRepository, user);
+      if (!resetResult.success)
+        return resetResult;
       const validateResult = validatePassword(newPassword);
       if (!validateResult.success)
         return validateResult;
@@ -4857,6 +5169,8 @@ function buildPasswordResetOps(ctx) {
     async requestPasswordReset(identifier) {
       logger10.debug("Password reset requested", { identifier });
       const resetConfig = ctx.resetConfig;
+      if (!resetConfig.enabled || !onPasswordResetRequest)
+        return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
       const userResult = await userRepository.findByIdentifier(identifier);
       if (!userResult.success) {
         logger10.warn("Failed to look up user for password reset", { identifier });
@@ -4867,20 +5181,19 @@ function buildPasswordResetOps(ctx) {
         return ok(void 0);
       }
       const user = toUser(userResult.data);
+      if (!user.enabled)
+        return ok(void 0);
       const token = generateToken();
       const expiresAt = new Date(Date.now() + resetConfig.tokenExpiresIn * 1e3);
       const saveResult = await resetTokenRepository.saveToken(token, user.id, expiresAt);
       if (!saveResult.success) {
         return saveResult;
       }
-      if (onPasswordResetRequest) {
-        try {
-          await onPasswordResetRequest(user, token, expiresAt);
-        } catch (callbackError) {
-          logger10.error("Password reset callback failed", { userId: user.id, error: callbackError });
-        }
-      } else {
-        logger10.warn("No password reset callback configured, token will not be delivered to user", { userId: user.id });
+      try {
+        await onPasswordResetRequest(user, token, expiresAt);
+      } catch {
+        logger10.error("Password reset callback failed", { userId: user.id });
+        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_passwordResetDeliveryFailed"));
       }
       logger10.info("Password reset token generated", { userId: user.id });
       return ok(void 0);
@@ -4888,38 +5201,43 @@ function buildPasswordResetOps(ctx) {
     async confirmPasswordReset(token, newPassword) {
       logger10.debug("Confirming password reset");
       const resetConfig = ctx.resetConfig;
-      const validateResult = validatePassword(newPassword);
-      if (!validateResult.success)
-        return validateResult;
-      const tokenResult = await resetTokenRepository.tryGetUserByToken(token, resetConfig.maxAttempts);
-      if (!tokenResult.success) {
-        return tokenResult;
-      }
-      const userId = tokenResult.data;
-      const userResult = await userRepository.findById(userId);
-      if (!userResult.success) {
-        return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
-      }
-      if (!userResult.data) {
-        return err(
-          HaiIamError.USER_NOT_FOUND,
-          iamM("iam_userNotExist")
-        );
-      }
-      const hashResult = hashPassword(newPassword);
-      if (!hashResult.success)
-        return hashResult;
-      const updateResult = await userRepository.updateById(userId, {
-        passwordHash: hashResult.data,
-        passwordUpdatedAt: /* @__PURE__ */ new Date()
+      if (!resetConfig.enabled)
+        return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
+      return resetTokenRepository.useToken(token, resetConfig.maxAttempts, async (userId) => {
+        const validateResult = validatePassword(newPassword);
+        if (!validateResult.success)
+          return validateResult;
+        const userResult = await userRepository.findById(userId);
+        if (!userResult.success) {
+          return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
+        }
+        if (!userResult.data) {
+          return err(
+            HaiIamError.USER_NOT_FOUND,
+            iamM("iam_userNotExist")
+          );
+        }
+        if (!userResult.data.enabled)
+          return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+        const hashResult = hashPassword(newPassword);
+        if (!hashResult.success)
+          return hashResult;
+        const updateResult = await userRepository.updateById(userId, {
+          passwordHash: hashResult.data,
+          passwordUpdatedAt: /* @__PURE__ */ new Date(),
+          loginFailedCount: 0,
+          lockedUntil: null,
+          lastLoginFailedAt: null
+        });
+        if (!updateResult.success) {
+          return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
+        }
+        const revoked = await sessionFunctions.deleteByUserId(userId);
+        if (!revoked.success)
+          return revoked;
+        logger10.info("Password reset confirmed", { userId });
+        return ok(void 0);
       });
-      if (!updateResult.success) {
-        return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
-      }
-      await resetTokenRepository.removeToken(token);
-      await sessionFunctions.deleteByUserId(userId);
-      logger10.info("Password reset confirmed", { userId });
-      return ok(void 0);
     }
   };
 }
@@ -4947,6 +5265,7 @@ function buildUserFunctions(deps) {
 var logger11 = core.logger.child({ module: "iam", scope: "main" });
 var initInProgress = false;
 var currentConfig = null;
+var currentPublicConfig = null;
 var currentAuth = null;
 var currentUser = null;
 var currentAuthz = null;
@@ -4984,7 +5303,7 @@ var iam = {
         logger11.warn("IAM module is already initialized, reinitializing");
         await iam.close();
       }
-      const { ldapClientFactory, ldapSyncUser, onPasswordResetRequest, onOtpSendEmail, onOtpSendSms, ...settingsInput } = config;
+      const { ldapClientFactory, ldapSyncUser } = config;
       logger11.info("Initializing IAM module");
       if (!reldb.isInitialized) {
         return err(
@@ -5008,7 +5327,7 @@ var iam = {
           );
         }
       }
-      const parseResult = IamConfigSchema.safeParse(settingsInput);
+      const parseResult = IamConfigSchema.safeParse(config);
       if (!parseResult.success) {
         logger11.error("IAM config validation failed", { error: parseResult.error.message });
         return err(
@@ -5018,6 +5337,8 @@ var iam = {
         );
       }
       const parsed = parseResult.data;
+      const { onPasswordResetRequest, onOtpSendEmail, onOtpSendSms } = await resolveIamNotifications(config);
+      logger11.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
       const sessionResult = await createSessionOperations({ config: parsed });
       if (!sessionResult.success) {
         return sessionResult;
@@ -5058,6 +5379,7 @@ var iam = {
       currentAuthz = authzResult.data;
       currentUser = userResult.data;
       currentConfig = parsed;
+      currentPublicConfig = buildIamPublicConfig(parsed, { ...config, onPasswordResetRequest, onOtpSendEmail, onOtpSendSms });
       currentApiKey = authnResult.data.apiKeyFunctions;
       currentTicket = createTicketOperations();
       const authn = authnResult.data.authn;
@@ -5068,7 +5390,7 @@ var iam = {
           if (!regResult.success) {
             return regResult;
           }
-          return authn.login({ identifier: options.username, password: options.password });
+          return authnResult.data.loginRegisteredUser(regResult.data.user);
         }
       };
       logger11.info("IAM module initialized");
@@ -5105,6 +5427,9 @@ var iam = {
   get config() {
     return currentConfig ? core.sanitize.sanitizeSensitiveFields(currentConfig) : null;
   },
+  get publicConfig() {
+    return currentPublicConfig ? structuredClone(currentPublicConfig) : null;
+  },
   get isInitialized() {
     return currentConfig !== null;
   },
@@ -5124,6 +5449,7 @@ var iam = {
     currentApiKey = null;
     currentTicket = null;
     currentConfig = null;
+    currentPublicConfig = null;
     resetApiKeyRepoSingleton();
     resetOtpRepoSingleton();
     resetUserRepoSingleton();
@@ -5134,6 +5460,6 @@ var iam = {
   }
 };
 
-export { AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema, iam };
+export { AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema, iam };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map