@h-ai/iam 0.1.0-alpha.67 → 0.1.0-alpha.68

package/dist/index.js

@@ -1,196 +1,12 @@
-import { z } from 'zod';
+import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-VCE74BFW.js';
+export { AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-VCE74BFW.js';
 import { cache } from '@h-ai/cache';
 import { core, err, ok } from '@h-ai/core';
 import { crypto as crypto$1 } from '@h-ai/crypto';
 import { reldb, BaseReldbCrudRepository } from '@h-ai/reldb';
-import { randomBytes } from 'crypto';
+import { createHash, randomBytes } from 'crypto';
 import { audit } from '@h-ai/audit';
 
-// src/iam-config.ts
-var WebUrlSchema = z.url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol));
-var AuthStrategyTypeSchema = z.enum(["password", "otp", "ldap", "apikey"]);
-var PasswordConfigSchema = z.object({
-  /** 最小长度（默认 8） */
-  minLength: z.number().int().min(1).default(8),
-  /** 最大长度（默认 128） */
-  maxLength: z.number().int().min(1).max(256).default(128),
-  /** 需要大写字母 */
-  requireUppercase: z.boolean().default(true),
-  /** 需要小写字母 */
-  requireLowercase: z.boolean().default(true),
-  /** 需要数字 */
-  requireNumber: z.boolean().default(true),
-  /** 需要特殊字符 */
-  requireSpecialChar: z.boolean().default(false),
-  /** 密码过期天数（0 表示不过期） */
-  expirationDays: z.number().int().min(0).default(0)
-}).refine((config) => config.maxLength >= config.minLength, { message: "maxLength must be >= minLength", path: ["maxLength"] });
-var OtpConfigSchema = z.object({
-  /** 分别启用邮件、短信验证码 */
-  email: z.boolean().default(true),
-  sms: z.boolean().default(true),
-  /** 验证码长度（默认 6） */
-  length: z.number().int().min(4).max(8).default(6),
-  /** 验证码过期时间（秒，默认 300） */
-  expiresIn: z.number().int().min(60).default(300),
-  /** 最大重试次数（默认 3） */
-  maxAttempts: z.number().int().min(1).default(3),
-  /** 发送间隔（秒，默认 60） */
-  resendInterval: z.number().int().min(30).default(60)
-});
-var PasswordResetConfigSchema = z.object({
-  /** 重置通知渠道，phone 使用 password_reset_sms 模板。 */
-  mode: z.enum(["email", "phone"]).default("email"),
-  /** 重置页面的绝对地址，通知模板可使用 resetUrl。 */
-  resetUrl: WebUrlSchema.optional(),
-  /** 是否启用密码重置 */
-  enabled: z.boolean().default(true),
-  /** 重置令牌有效期（秒，默认 3600 = 1小时） */
-  tokenExpiresIn: z.number().int().min(300).default(3600),
-  /** 最大验证尝试次数（默认 3） */
-  maxAttempts: z.number().int().min(1).default(3)
-});
-var LdapConfigSchema = z.object({
-  /** LDAP 服务器 URL */
-  url: z.url().refine((value) => ["ldap:", "ldaps:"].includes(new URL(value).protocol)),
-  /** 绑定 DN */
-  bindDn: z.string(),
-  /** 绑定密码 */
-  bindPassword: z.string(),
-  /** 搜索基础 DN */
-  searchBase: z.string(),
-  /** 搜索过滤器（默认使用 uid） */
-  searchFilter: z.string().default("(uid={{username}})"),
-  /** 用户名属性 */
-  usernameAttribute: z.string().default("uid"),
-  /** 邮箱属性 */
-  emailAttribute: z.string().default("mail"),
-  /** 显示名称属性 */
-  displayNameAttribute: z.string().default("cn"),
-  /** 启用 TLS */
-  useTls: z.boolean().default(false),
-  /** 连接超时（毫秒） */
-  connectTimeout: z.number().int().min(1e3).default(5e3)
-});
-var ApiKeyConfigSchema = z.object({
-  /** 单用户最大 API Key 数量（默认 10） */
-  maxKeysPerUser: z.number().int().min(1).default(10),
-  /** API Key 默认有效期（天，0 表示永不过期，默认 0） */
-  defaultExpirationDays: z.number().int().min(0).default(0),
-  /** API Key 前缀（默认 'hai_'） */
-  prefix: z.string().default("hai_")
-});
-var LoginConfigSchema = z.object({
-  /** 是否启用密码登录 */
-  password: z.boolean().default(true),
-  /** 是否启用 OTP 登录 */
-  otp: z.boolean().default(true),
-  /** 是否启用 LDAP 登录；需要显式开启并提供 ldap 配置。 */
-  ldap: z.boolean().default(false),
-  /** 是否启用 API Key 登录 */
-  apikey: z.boolean().default(false)
-});
-var RegisterConfigSchema = z.object({
-  /** 是否启用注册 */
-  enabled: z.boolean().default(true),
-  /** 新注册用户是否默认启用 */
-  defaultEnabled: z.boolean().default(true)
-});
-var SecurityConfigSchema = z.object({
-  /** 最大登录失败次数（默认 5） */
-  maxLoginAttempts: z.number().int().min(1).default(5),
-  /** 锁定时长（秒，默认 900） */
-  lockoutDuration: z.number().int().min(60).default(900)
-});
-var AgreementConfigSchema = z.object({
-  /** 用户协议 Markdown 正文；同时配置 URL 时优先显示正文。 */
-  userAgreementMarkdown: z.string().min(1).optional(),
-  /** 隐私协议 Markdown 正文；YAML 使用 | 保留段落和换行。 */
-  privacyPolicyMarkdown: z.string().min(1).optional(),
-  /** 用户协议 URL */
-  userAgreementUrl: WebUrlSchema.optional(),
-  /** 隐私协议 URL */
-  privacyPolicyUrl: WebUrlSchema.optional(),
-  /** 注册时展示协议 */
-  showOnRegister: z.boolean().default(true),
-  /** 登录时展示协议 */
-  showOnLogin: z.boolean().default(false)
-});
-var AuthImageSchema = z.string().refine((value) => /^https?:\/\//.test(value) || value.startsWith("/") && !value.startsWith("//"));
-var AuthUiConfigSchema = z.object({
-  variant: z.enum(["card", "split"]).default("card"),
-  title: z.string().optional(),
-  subtitle: z.string().optional(),
-  brandTitle: z.string().optional(),
-  brandText: z.string().optional(),
-  logoUrl: AuthImageSchema.optional(),
-  illustrationUrl: AuthImageSchema.optional()
-});
-var SessionConfigSchema = z.object({
-  /** 会话超时时间（秒，默认 86400 = 24小时） */
-  maxAge: z.number().int().min(60).default(86400),
-  /** 是否滑动窗口（每次访问刷新过期时间） */
-  sliding: z.boolean().default(true),
-  /** 单设备登录（踢掉其他设备） */
-  singleDevice: z.boolean().default(false),
-  /** refreshToken 过期时间（秒，默认 604800 = 7天） */
-  refreshTokenMaxAge: z.number().int().min(3600).default(604800)
-});
-var RbacConfigSchema = z.object({
-  /** 是否启用 RBAC */
-  enabled: z.boolean().default(true),
-  /** 超级管理员角色代码 */
-  superAdminRole: z.string().default("super_admin"),
-  /** 默认用户角色 */
-  defaultRole: z.string().default("user")
-});
-var IamConfigSchema = z.object({
-  /** 认证页外观 */
-  ui: AuthUiConfigSchema.optional(),
-  // ─── 认证策略配置 ───
-  /** 密码配置 */
-  password: PasswordConfigSchema.optional(),
-  /** OTP 配置 */
-  otp: OtpConfigSchema.optional(),
-  /** LDAP 配置 */
-  ldap: LdapConfigSchema.optional(),
-  /** API Key 配置 */
-  apikey: ApiKeyConfigSchema.optional(),
-  /** 密码重置配置 */
-  passwordReset: PasswordResetConfigSchema.optional(),
-  /** 登录启用配置 */
-  login: LoginConfigSchema.default({
-    password: true,
-    otp: true,
-    ldap: false,
-    apikey: false
-  }),
-  /** 注册配置 */
-  register: RegisterConfigSchema.default({
-    enabled: true,
-    defaultEnabled: true
-  }),
-  /** 协议展示配置 */
-  agreements: AgreementConfigSchema.default({
-    showOnRegister: true,
-    showOnLogin: false
-  }),
-  /** 安全策略配置 */
-  security: SecurityConfigSchema.default({
-    maxLoginAttempts: 5,
-    lockoutDuration: 900
-  }),
-  // ─── 会话配置 ───
-  /** 会话配置 */
-  session: SessionConfigSchema.optional(),
-  // ─── 授权配置 ───
-  /** RBAC 配置 */
-  rbac: RbacConfigSchema.default(() => RbacConfigSchema.parse({})),
-  // ─── 运行时选项 ───
-  /** 是否初始化默认角色和权限（默认 true） */
-  seedDefaultData: z.boolean().default(true)
-});
-
 // messages/en-US.json
 var en_US_default = {
   iam_batchUserIdsInvalid: "Provide at most 1000 non-empty user IDs",
@@ -376,7 +192,203 @@ var en_US_default = {
   iam_apikeyUpdateFailed: "Failed to update API Key: {message}",
   iam_apikeyDeleteFailed: "Failed to delete API Key: {message}",
   iam_apikeyQueryFailed: "Failed to query API Key: {message}",
-  iam_apikeyStrategyRequired: "API Key authentication requires API Key strategy configuration"
+  iam_apikeyStrategyRequired: "API Key authentication requires API Key strategy configuration",
+  iam_sessionStateFailed: "Shared session state operation failed",
+  iam_sessionStateConflict: "Session state changed; retry the operation",
+  iam_sessionMaxAgeInvalid: "Invalid session lifetime or timestamp",
+  iam_notificationDeliveryUnknown: "Notification delivery is unknown and may have succeeded; do not resend automatically."
+};
+
+// messages/ja-JP.json
+var ja_JP_default = {
+  iam_batchUserIdsInvalid: "\u7A7A\u3067\u306A\u3044\u30E6\u30FC\u30B6\u30FCID\u30921000\u4EF6\u4EE5\u5185\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044",
+  $schema: "https://inlang.com/schema/inlang-message-format",
+  iam_securityStateFailed: "\u8A8D\u8A3C\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u72B6\u614B\u3092\u66F4\u65B0\u3067\u304D\u307E\u305B\u3093\u3002\u3057\u3070\u3089\u304F\u3057\u3066\u304B\u3089\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_securityBusy: "\u8A8D\u8A3C\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u591A\u3059\u304E\u307E\u3059\u3002\u3057\u3070\u3089\u304F\u3057\u3066\u304B\u3089\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_passwordResetDisabled: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306E\u30EA\u30BB\u30C3\u30C8\u304C\u7121\u52B9\u304B\u3001\u914D\u4FE1\u304C\u8A2D\u5B9A\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002",
+  iam_passwordResetDeliveryFailed: "\u30EA\u30BB\u30C3\u30C8\u901A\u77E5\u3092\u914D\u4FE1\u3067\u304D\u307E\u305B\u3093\u3002\u3057\u3070\u3089\u304F\u3057\u3066\u304B\u3089\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_passwordMinLength: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306F{minLength}\u6587\u5B57\u4EE5\u4E0A\u3067\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_passwordMaxLength: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306F{maxLength}\u6587\u5B57\u4EE5\u5185\u3067\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_passwordNeedUppercase: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306B\u306F\u82F1\u5927\u6587\u5B57\u3092\u542B\u3081\u3066\u304F\u3060\u3055\u3044",
+  iam_passwordNeedLowercase: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306B\u306F\u82F1\u5C0F\u6587\u5B57\u3092\u542B\u3081\u3066\u304F\u3060\u3055\u3044",
+  iam_passwordNeedNumber: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306B\u306F\u6570\u5B57\u3092\u542B\u3081\u3066\u304F\u3060\u3055\u3044",
+  iam_passwordNeedSpecialChar: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306B\u306F\u7279\u6B8A\u6587\u5B57\u3092\u542B\u3081\u3066\u304F\u3060\u3055\u3044",
+  iam_credentialTypeMismatch: "\u8A8D\u8A3C\u60C5\u5831\u306E\u7A2E\u985E\u304C\u4E00\u81F4\u3057\u307E\u305B\u3093",
+  iam_userNotExist: "\u30E6\u30FC\u30B6\u30FC\u304C\u5B58\u5728\u3057\u307E\u305B\u3093",
+  iam_accountDisabled: "\u30A2\u30AB\u30A6\u30F3\u30C8\u304C\u7121\u52B9\u3067\u3059",
+  iam_accountLocked: "\u30A2\u30AB\u30A6\u30F3\u30C8\u304C\u30ED\u30C3\u30AF\u3055\u308C\u3066\u3044\u307E\u3059\u3002\u3057\u3070\u3089\u304F\u3057\u3066\u304B\u3089\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_accountNoPassword: "\u30D1\u30B9\u30EF\u30FC\u30C9\u304C\u8A2D\u5B9A\u3055\u308C\u3066\u3044\u307E\u305B\u3093",
+  iam_passwordWrong: "\u30D1\u30B9\u30EF\u30FC\u30C9\u304C\u6B63\u3057\u304F\u3042\u308A\u307E\u305B\u3093",
+  iam_passwordExpired: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059\u3002\u5909\u66F4\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_otpNotExistOrExpired: "\u8A8D\u8A3C\u30B3\u30FC\u30C9\u304C\u5B58\u5728\u3057\u306A\u3044\u304B\u3001\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059",
+  iam_otpInvalid: "\u8A8D\u8A3C\u30B3\u30FC\u30C9\u304C\u7121\u52B9\u3067\u3059\u3002\u65B0\u3057\u3044\u30B3\u30FC\u30C9\u3092\u53D6\u5F97\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_otpWrong: "\u8A8D\u8A3C\u30B3\u30FC\u30C9\u304C\u6B63\u3057\u304F\u3042\u308A\u307E\u305B\u3093",
+  iam_otpResendTooFast: "\u6B21\u306E\u30B3\u30FC\u30C9\u3092\u53D6\u5F97\u3059\u308B\u307E\u3067{seconds}\u79D2\u304A\u5F85\u3061\u304F\u3060\u3055\u3044",
+  iam_identifierTypeNotSupported: "\u672A\u5BFE\u5FDC\u306E\u8B58\u5225\u5B50\u306E\u7A2E\u985E\u304B\u3001\u914D\u4FE1\u65B9\u6CD5\u304C\u8A2D\u5B9A\u3055\u308C\u3066\u3044\u307E\u305B\u3093",
+  iam_loginDisabled: "{type}\u306B\u3088\u308B\u30ED\u30B0\u30A4\u30F3\u306F\u7121\u52B9\u3067\u3059",
+  iam_registerDisabled: "\u30E6\u30FC\u30B6\u30FC\u767B\u9332\u306F\u7121\u52B9\u3067\u3059",
+  iam_otpStrategyRequired: "OTP\u8A8D\u8A3C\u306B\u306FOTP\u6226\u7565\u306E\u8A2D\u5B9A\u304C\u5FC5\u8981\u3067\u3059",
+  iam_otpStrategyRequiredForSend: "OTP\u306B\u306FOTP\u6226\u7565\u306E\u8A2D\u5B9A\u304C\u5FC5\u8981\u3067\u3059",
+  iam_userNotExistNoAutoRegister: "\u30E6\u30FC\u30B6\u30FC\u304C\u5B58\u5728\u305B\u305A\u3001\u81EA\u52D5\u767B\u9332\u3082\u6709\u52B9\u3067\u306F\u3042\u308A\u307E\u305B\u3093",
+  iam_refreshTokenFailed: "\u30C8\u30FC\u30AF\u30F3\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_refreshTokenExpired: "\u66F4\u65B0\u30C8\u30FC\u30AF\u30F3\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059",
+  iam_refreshTokenRequestFailed: "\u30C8\u30FC\u30AF\u30F3\u66F4\u65B0\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_ldapConnectionFailed: "LDAP\u30B5\u30FC\u30D0\u30FC\u306B\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093",
+  iam_ldapAdminBindFailed: "LDAP\u7BA1\u7406\u8005\u306E\u30D0\u30A4\u30F3\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_ldapSearchFailed: "LDAP\u691C\u7D22\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_ldapStrategyRequired: "LDAP\u8A8D\u8A3C\u306B\u306FLDAP\u6226\u7565\u306E\u8A2D\u5B9A\u304C\u5FC5\u8981\u3067\u3059",
+  iam_tokenExpired: "\u30C8\u30FC\u30AF\u30F3\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059",
+  iam_tokenInvalid: "\u30C8\u30FC\u30AF\u30F3\u304C\u7121\u52B9\u3067\u3059",
+  iam_ticketInvalid: "\u30C1\u30B1\u30C3\u30C8\u304C\u7121\u52B9\u3001\u4F7F\u7528\u6E08\u307F\u3001\u307E\u305F\u306F\u4E0D\u660E\u3067\u3059",
+  iam_ticketExpired: "\u30C1\u30B1\u30C3\u30C8\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059",
+  iam_ticketIssueFailed: "\u30C1\u30B1\u30C3\u30C8\u306E\u767A\u884C\u307E\u305F\u306F\u8AAD\u307F\u53D6\u308A\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_createSessionFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_sessionExpired: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059",
+  iam_invalidRefreshToken: "\u66F4\u65B0\u30C8\u30FC\u30AF\u30F3\u304C\u7121\u52B9\u3067\u3059",
+  iam_sessionNotExist: "\u30BB\u30C3\u30B7\u30E7\u30F3\u304C\u5B58\u5728\u3057\u307E\u305B\u3093",
+  iam_usernameAlreadyExist: "\u30E6\u30FC\u30B6\u30FC\u540D\u306F\u65E2\u306B\u5B58\u5728\u3057\u307E\u3059",
+  iam_emailAlreadyUsed: "\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9\u306F\u65E2\u306B\u4F7F\u7528\u3055\u308C\u3066\u3044\u307E\u3059",
+  iam_originalPasswordWrong: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9\u304C\u6B63\u3057\u304F\u3042\u308A\u307E\u305B\u3093",
+  iam_featureNotImplemented: "\u3053\u306E\u6A5F\u80FD\u306F\u5B9F\u88C5\u3055\u308C\u3066\u3044\u307E\u305B\u3093",
+  iam_userAlreadyExist: "\u30E6\u30FC\u30B6\u30FC\u306F\u65E2\u306B\u5B58\u5728\u3057\u307E\u3059",
+  iam_parseSessionDataFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u30C7\u30FC\u30BF\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_roleAlreadyExist: "\u30ED\u30FC\u30EB\u306F\u65E2\u306B\u5B58\u5728\u3057\u307E\u3059",
+  iam_roleNotExist: "\u30ED\u30FC\u30EB\u304C\u5B58\u5728\u3057\u307E\u305B\u3093",
+  iam_cannotDeleteSystemRole: "\u30B7\u30B9\u30C6\u30E0\u30ED\u30FC\u30EB\u306F\u524A\u9664\u3067\u304D\u307E\u305B\u3093",
+  iam_permissionAlreadyExist: "\u6A29\u9650\u306F\u65E2\u306B\u5B58\u5728\u3057\u307E\u3059",
+  iam_permissionNotExist: "\u6A29\u9650\u304C\u5B58\u5728\u3057\u307E\u305B\u3093",
+  iam_notInitialized: "\u521D\u671F\u5316\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u5148\u306Biam.init()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_initFailed: "\u521D\u671F\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_depsNotInitialized: "\u4F9D\u5B58\u30E2\u30B8\u30E5\u30FC\u30EB{dep}\u304C\u521D\u671F\u5316\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002iam.init()\u306E\u524D\u306B{dep}.init()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_initInProgress: "IAM\u306E\u521D\u671F\u5316\u306F\u65E2\u306B\u5B9F\u884C\u4E2D\u3067\u3059",
+  iam_cacheRequired: "\u30BB\u30C3\u30B7\u30E7\u30F3\u7BA1\u7406\u306B\u306F\u30AD\u30E3\u30C3\u30B7\u30E5\u30B5\u30FC\u30D3\u30B9\u304C\u5FC5\u8981\u3067\u3059",
+  iam_initComponentFailed: "\u30B3\u30F3\u30DD\u30FC\u30CD\u30F3\u30C8\u306E\u521D\u671F\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_initSeedDataFailed: "\u521D\u671F\u30C7\u30FC\u30BF\u306E\u8A2D\u5B9A\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_createUserTableFailed: "\u30E6\u30FC\u30B6\u30FC\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryUserFailed: "\u30E6\u30FC\u30B6\u30FC\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createUserFailed: "\u30E6\u30FC\u30B6\u30FC\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryUserListFailed: "\u30E6\u30FC\u30B6\u30FC\u4E00\u89A7\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_updateUserFailed: "\u30E6\u30FC\u30B6\u30FC\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteUserFailed: "\u30E6\u30FC\u30B6\u30FC\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createSessionTableFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createSessionIndexFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createSessionRecordFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u30EC\u30B3\u30FC\u30C9\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_querySessionFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_updateSessionFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteSessionFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_cleanupSessionFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createSessionStoreTableFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u30B9\u30C8\u30A2\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createTokenMappingTableFailed: "\u30C8\u30FC\u30AF\u30F3\u5BFE\u5FDC\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createUserSessionTableFailed: "\u30E6\u30FC\u30B6\u30FC\u30BB\u30C3\u30B7\u30E7\u30F3\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createSessionStoreIndexFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_saveSessionFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryTokenMappingFailed: "\u30C8\u30FC\u30AF\u30F3\u5BFE\u5FDC\u60C5\u5831\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_saveTokenMappingFailed: "\u30C8\u30FC\u30AF\u30F3\u5BFE\u5FDC\u60C5\u5831\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteTokenMappingFailed: "\u30C8\u30FC\u30AF\u30F3\u5BFE\u5FDC\u60C5\u5831\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteUserSessionMappingFailed: "\u30E6\u30FC\u30B6\u30FC\u30BB\u30C3\u30B7\u30E7\u30F3\u5BFE\u5FDC\u60C5\u5831\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryUserSessionFailed: "\u30E6\u30FC\u30B6\u30FC\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_addUserSessionMappingFailed: "\u30E6\u30FC\u30B6\u30FC\u30BB\u30C3\u30B7\u30E7\u30F3\u5BFE\u5FDC\u60C5\u5831\u306E\u8FFD\u52A0\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createRoleTableFailed: "\u30ED\u30FC\u30EB\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryRoleFailed: "\u30ED\u30FC\u30EB\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryRoleListFailed: "\u30ED\u30FC\u30EB\u4E00\u89A7\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createRoleFailed: "\u30ED\u30FC\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_updateRoleFailed: "\u30ED\u30FC\u30EB\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteRoleFailed: "\u30ED\u30FC\u30EB\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createRolePermissionTableFailed: "\u30ED\u30FC\u30EB\u6A29\u9650\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createRolePermissionIndexFailed: "\u30ED\u30FC\u30EB\u6A29\u9650\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_assignPermissionFailed: "\u6A29\u9650\u306E\u5272\u308A\u5F53\u3066\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_removePermissionFailed: "\u6A29\u9650\u306E\u89E3\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createUserRoleTableFailed: "\u30E6\u30FC\u30B6\u30FC\u30ED\u30FC\u30EB\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createUserRoleIndexFailed: "\u30E6\u30FC\u30B6\u30FC\u30ED\u30FC\u30EB\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_assignRoleFailed: "\u30ED\u30FC\u30EB\u306E\u5272\u308A\u5F53\u3066\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_removeRoleFailed: "\u30ED\u30FC\u30EB\u306E\u89E3\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_syncRolesFailed: "\u30ED\u30FC\u30EB\u306E\u540C\u671F\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createPermissionTableFailed: "\u6A29\u9650\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createPermissionFailed: "\u6A29\u9650\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryPermissionFailed: "\u6A29\u9650\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryPermissionListFailed: "\u6A29\u9650\u4E00\u89A7\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deletePermissionFailed: "\u6A29\u9650\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryPermissionCacheFailed: "\u6A29\u9650\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_setPermissionCacheFailed: "\u6A29\u9650\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_clearPermissionCacheFailed: "\u6A29\u9650\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u30AF\u30EA\u30A2\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryOtpCacheFailed: "OTP\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_saveOtpCacheFailed: "OTP\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_updateOtpCacheFailed: "OTP\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteOtpCacheFailed: "OTP\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_querySessionMappingCacheFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u5BFE\u5FDC\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_saveSessionMappingCacheFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u5BFE\u5FDC\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteSessionMappingCacheFailed: "\u30BB\u30C3\u30B7\u30E7\u30F3\u5BFE\u5FDC\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryTokenMappingCacheFailed: "\u30C8\u30FC\u30AF\u30F3\u5BFE\u5FDC\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_saveTokenMappingCacheFailed: "\u30C8\u30FC\u30AF\u30F3\u5BFE\u5FDC\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteTokenMappingCacheFailed: "\u30C8\u30FC\u30AF\u30F3\u5BFE\u5FDC\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryUserSessionCacheFailed: "\u30E6\u30FC\u30B6\u30FC\u30BB\u30C3\u30B7\u30E7\u30F3\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_saveUserSessionCacheFailed: "\u30E6\u30FC\u30B6\u30FC\u30BB\u30C3\u30B7\u30E7\u30F3\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteUserSessionCacheFailed: "\u30E6\u30FC\u30B6\u30FC\u30BB\u30C3\u30B7\u30E7\u30F3\u30AD\u30E3\u30C3\u30B7\u30E5\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_createOtpTableFailed: "OTP\u30C6\u30FC\u30D6\u30EB\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_saveOtpFailed: "OTP\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryOtpFailed: "OTP\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_updateOtpAttemptsFailed: "OTP\u8A66\u884C\u56DE\u6570\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_deleteOtpFailed: "OTP\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_otpSendFailed: "\u8A8D\u8A3C\u30B3\u30FC\u30C9\u306E\u9001\u4FE1\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u3057\u3070\u3089\u304F\u3057\u3066\u304B\u3089\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_resetTokenInvalid: "\u30D1\u30B9\u30EF\u30FC\u30C9\u30EA\u30BB\u30C3\u30C8\u7528\u30C8\u30FC\u30AF\u30F3\u304C\u7121\u52B9\u304B\u3001\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059",
+  iam_resetTokenMaxAttempts: "\u8A8D\u8A3C\u306E\u8A66\u884C\u56DE\u6570\u304C\u591A\u3059\u304E\u307E\u3059\u3002\u65B0\u3057\u3044\u30EA\u30BB\u30C3\u30C8\u30C8\u30FC\u30AF\u30F3\u3092\u53D6\u5F97\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_saveResetTokenFailed: "\u30D1\u30B9\u30EF\u30FC\u30C9\u30EA\u30BB\u30C3\u30C8\u7528\u30C8\u30FC\u30AF\u30F3\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_hashResetTokenFailed: "\u30EA\u30BB\u30C3\u30C8\u30C8\u30FC\u30AF\u30F3\u306E\u30CF\u30C3\u30B7\u30E5\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_queryResetTokenFailed: "\u30D1\u30B9\u30EF\u30FC\u30C9\u30EA\u30BB\u30C3\u30C8\u7528\u30C8\u30FC\u30AF\u30F3\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_passwordResetNotConfigured: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306E\u30EA\u30BB\u30C3\u30C8\u304C\u8A2D\u5B9A\u3055\u308C\u3066\u3044\u307E\u305B\u3093",
+  iam_clientFetchNotAvailable: "\u73FE\u5728\u306E\u74B0\u5883\u3067\u306FFetch\u3092\u5229\u7528\u3067\u304D\u307E\u305B\u3093",
+  iam_clientRequestFailed: "\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {status}",
+  iam_clientNetworkError: "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_clientNetworkErrorWithDetail: "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_seedRoleAdminName: "\u7BA1\u7406\u8005",
+  iam_seedRoleAdminDesc: "\u3059\u3079\u3066\u306E\u6A29\u9650\u3092\u6301\u3064\u30B7\u30B9\u30C6\u30E0\u7BA1\u7406\u8005",
+  iam_seedRoleUserName: "\u30E6\u30FC\u30B6\u30FC",
+  iam_seedRoleUserDesc: "\u4E00\u822C\u30E6\u30FC\u30B6\u30FC",
+  iam_seedRoleGuestName: "\u30B2\u30B9\u30C8",
+  iam_seedRoleGuestDesc: "\u8AAD\u307F\u53D6\u308A\u5C02\u7528\u306E\u30B2\u30B9\u30C8",
+  iam_seedPermUserRead: "\u30E6\u30FC\u30B6\u30FC\u306E\u95B2\u89A7",
+  iam_seedPermUserCreate: "\u30E6\u30FC\u30B6\u30FC\u306E\u4F5C\u6210",
+  iam_seedPermUserUpdate: "\u30E6\u30FC\u30B6\u30FC\u306E\u66F4\u65B0",
+  iam_seedPermUserDelete: "\u30E6\u30FC\u30B6\u30FC\u306E\u524A\u9664",
+  iam_seedPermUserList: "\u30E6\u30FC\u30B6\u30FC\u4E00\u89A7API",
+  iam_seedPermUserApiCreate: "\u30E6\u30FC\u30B6\u30FC\u4F5C\u6210API",
+  iam_seedPermUserApiUpdate: "\u30E6\u30FC\u30B6\u30FC\u66F4\u65B0API",
+  iam_seedPermUserApiDelete: "\u30E6\u30FC\u30B6\u30FC\u524A\u9664API",
+  iam_seedPermRoleRead: "\u30ED\u30FC\u30EB\u306E\u95B2\u89A7",
+  iam_seedPermRoleCreate: "\u30ED\u30FC\u30EB\u306E\u4F5C\u6210",
+  iam_seedPermRoleUpdate: "\u30ED\u30FC\u30EB\u306E\u66F4\u65B0",
+  iam_seedPermRoleDelete: "\u30ED\u30FC\u30EB\u306E\u524A\u9664",
+  iam_seedPermRoleList: "\u30ED\u30FC\u30EB\u4E00\u89A7API",
+  iam_seedPermRoleApiCreate: "\u30ED\u30FC\u30EB\u4F5C\u6210API",
+  iam_seedPermRoleApiUpdate: "\u30ED\u30FC\u30EB\u66F4\u65B0API",
+  iam_seedPermRoleApiDelete: "\u30ED\u30FC\u30EB\u524A\u9664API",
+  iam_seedPermPermRead: "\u6A29\u9650\u306E\u95B2\u89A7",
+  iam_seedPermPermManage: "\u6A29\u9650\u306E\u7BA1\u7406",
+  iam_seedPermPermCreate: "\u6A29\u9650\u306E\u4F5C\u6210",
+  iam_seedPermPermDelete: "\u6A29\u9650\u306E\u524A\u9664",
+  iam_seedPermPermList: "\u6A29\u9650\u4E00\u89A7API",
+  iam_seedPermPermApiCreate: "\u6A29\u9650\u4F5C\u6210API",
+  iam_seedPermPermApiDelete: "\u6A29\u9650\u524A\u9664API",
+  iam_seedPermSystemSettings: "\u30B7\u30B9\u30C6\u30E0\u8A2D\u5B9A",
+  iam_seedPermSystemLogs: "\u30ED\u30B0\u306E\u95B2\u89A7",
+  iam_seedPermSystemModules: "\u30E2\u30B8\u30E5\u30FC\u30EB\u7BA1\u7406",
+  iam_seedPermDashboardView: "\u30C0\u30C3\u30B7\u30E5\u30DC\u30FC\u30C9",
+  iam_seedPermProfileRead: "\u30D7\u30ED\u30D5\u30A3\u30FC\u30EB",
+  iam_seedPermAuditRead: "\u76E3\u67FB\u30ED\u30B0",
+  iam_configError: "IAM\u8A2D\u5B9A\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  iam_apikeyInvalid: "API\u30AD\u30FC\u304C\u7121\u52B9\u3067\u3059",
+  iam_apikeyExpired: "API\u30AD\u30FC\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059",
+  iam_apikeyDisabled: "API\u30AD\u30FC\u304C\u7121\u52B9\u5316\u3055\u308C\u3066\u3044\u307E\u3059",
+  iam_apikeyMaxKeysReached: "API\u30AD\u30FC\u306E\u4E0A\u9650\uFF08{max}\u4EF6\uFF09\u306B\u9054\u3057\u307E\u3057\u305F",
+  iam_apikeyCreateFailed: "API\u30AD\u30FC\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_apikeyUpdateFailed: "API\u30AD\u30FC\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_apikeyDeleteFailed: "API\u30AD\u30FC\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_apikeyQueryFailed: "API\u30AD\u30FC\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {message}",
+  iam_apikeyStrategyRequired: "API\u30AD\u30FC\u8A8D\u8A3C\u306B\u306FAPI\u30AD\u30FC\u6226\u7565\u306E\u8A2D\u5B9A\u304C\u5FC5\u8981\u3067\u3059",
+  iam_sessionStateFailed: "\u5171\u6709\u30BB\u30C3\u30B7\u30E7\u30F3\u72B6\u614B\u306E\u64CD\u4F5C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  iam_sessionStateConflict: "\u30BB\u30C3\u30B7\u30E7\u30F3\u72B6\u614B\u304C\u5909\u66F4\u3055\u308C\u307E\u3057\u305F\u3002\u64CD\u4F5C\u3092\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_sessionMaxAgeInvalid: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u6709\u52B9\u671F\u9593\u307E\u305F\u306F\u30BF\u30A4\u30E0\u30B9\u30BF\u30F3\u30D7\u304C\u7121\u52B9\u3067\u3059",
+  iam_notificationDeliveryUnknown: "\u901A\u77E5\u306E\u914D\u4FE1\u7D50\u679C\u306F\u4E0D\u660E\u3067\u3001\u6210\u529F\u3057\u305F\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002\u81EA\u52D5\u3067\u518D\u9001\u3057\u306A\u3044\u3067\u304F\u3060\u3055\u3044\u3002"
 };
 
 // messages/zh-CN.json
@@ -564,66 +576,19 @@ var zh_CN_default = {
   iam_apikeyUpdateFailed: "\u66F4\u65B0 API Key \u5931\u8D25\uFF1A{message}",
   iam_apikeyDeleteFailed: "\u5220\u9664 API Key \u5931\u8D25\uFF1A{message}",
   iam_apikeyQueryFailed: "\u67E5\u8BE2 API Key \u5931\u8D25\uFF1A{message}",
-  iam_apikeyStrategyRequired: "API Key \u8BA4\u8BC1\u9700\u8981 API Key \u7B56\u7565\u914D\u7F6E"
+  iam_apikeyStrategyRequired: "API Key \u8BA4\u8BC1\u9700\u8981 API Key \u7B56\u7565\u914D\u7F6E",
+  iam_sessionStateFailed: "\u4F1A\u8BDD\u5171\u4EAB\u72B6\u6001\u64CD\u4F5C\u5931\u8D25",
+  iam_sessionStateConflict: "\u4F1A\u8BDD\u72B6\u6001\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u8BD5",
+  iam_sessionMaxAgeInvalid: "\u4F1A\u8BDD\u6709\u6548\u671F\u6216\u65F6\u95F4\u5B57\u6BB5\u65E0\u6548",
+  iam_notificationDeliveryUnknown: "\u901A\u77E5\u53EF\u80FD\u5DF2\u9001\u8FBE\uFF0C\u7ED3\u679C\u672A\u77E5\uFF1B\u8BF7\u52FF\u81EA\u52A8\u91CD\u53D1\u3002"
 };
 
 // src/iam-i18n.ts
 var iamM = core.i18n.createMessageGetter({
   "zh-CN": zh_CN_default,
-  "en-US": en_US_default
+  "en-US": en_US_default,
+  "ja-JP": ja_JP_default
 });
-var IamErrorInfo = {
-  AUTH_FAILED: "001:401",
-  INVALID_CREDENTIALS: "002:401",
-  USER_NOT_FOUND: "003:404",
-  USER_DISABLED: "004:403",
-  USER_LOCKED: "005:403",
-  USER_ALREADY_EXISTS: "006:409",
-  PASSWORD_EXPIRED: "007:401",
-  PASSWORD_POLICY_VIOLATION: "008:400",
-  OTP_INVALID: "009:400",
-  NOT_INITIALIZED: "010:500",
-  OTP_RESEND_TOO_FAST: "011:429",
-  LOGIN_DISABLED: "012:400",
-  REGISTER_DISABLED: "013:403",
-  STRATEGY_NOT_SUPPORTED: "014:400",
-  APIKEY_INVALID: "015:401",
-  APIKEY_EXPIRED: "016:401",
-  APIKEY_DISABLED: "017:403",
-  APIKEY_NOT_FOUND: "018:404",
-  RESET_TOKEN_INVALID: "019:400",
-  RESET_TOKEN_EXPIRED: "020:400",
-  RESET_TOKEN_MAX_ATTEMPTS: "021:429",
-  OTP_EXPIRED: "022:400",
-  SECURITY_BUSY: "023:429",
-  PASSWORD_RESET_DISABLED: "024:403",
-  SESSION_NOT_FOUND: "101:401",
-  SESSION_EXPIRED: "102:401",
-  SESSION_INVALID: "103:401",
-  SESSION_CREATE_FAILED: "104:500",
-  TOKEN_EXPIRED: "105:401",
-  TOKEN_INVALID: "106:401",
-  TOKEN_REFRESH_FAILED: "107:401",
-  PERMISSION_DENIED: "201:403",
-  ROLE_NOT_FOUND: "202:404",
-  PERMISSION_NOT_FOUND: "203:404",
-  ROLE_ALREADY_EXISTS: "204:409",
-  PERMISSION_ALREADY_EXISTS: "205:409",
-  LDAP_CONNECTION_FAILED: "301:500",
-  LDAP_BIND_FAILED: "302:401",
-  LDAP_SEARCH_FAILED: "303:500",
-  TICKET_INVALID: "110:401",
-  TICKET_EXPIRED: "111:401",
-  TICKET_ISSUE_FAILED: "112:500",
-  REPOSITORY_ERROR: "401:500",
-  NOT_FOUND: "402:404",
-  CONFLICT: "403:409",
-  FORBIDDEN: "501:403",
-  INVALID_ARGUMENT: "502:400",
-  CONFIG_ERROR: "901:500",
-  INTERNAL_ERROR: "999:500"
-};
-var HaiIamError = core.error.buildHaiErrorsDef("iam", IamErrorInfo);
 
 // src/authn/apikey/iam-authn-apikey-repository.ts
 var TABLE_NAME = "hai_iam_api_keys";
@@ -843,6 +808,11 @@ function buildAgreementDisplay(config, enabled) {
 }
 var TABLE_NAME2 = "hai_iam_users";
 var USER_FIELDS = [
+  { fieldName: "credentialVersion", columnName: "credential_version", def: { type: "TEXT", notNull: true, defaultValue: "" }, select: true, create: false, update: false },
+  { fieldName: "resetVersion", columnName: "reset_version", def: { type: "TEXT", notNull: true, defaultValue: "" }, select: true, create: false, update: false },
+  { fieldName: "resetHash", columnName: "reset_hash", def: { type: "TEXT" }, select: true, create: false, update: false },
+  { fieldName: "resetExpiresAt", columnName: "reset_expires_at", def: { type: "BIGINT" }, select: true, create: false, update: false },
+  { fieldName: "resetAttempts", columnName: "reset_attempts", def: { type: "INTEGER", notNull: true, defaultValue: 0 }, select: true, create: false, update: false },
   {
     fieldName: "id",
     columnName: "id",
@@ -1002,6 +972,64 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
       fields: USER_FIELDS
     });
   }
+  /** 数据库时钟在执行最终 SQL 时核验有效期，暂停进程不能复用旧的 Date.now()。 */
+  databaseNow() {
+    if (reldb.config?.type === "postgresql")
+      return "(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)";
+    if (reldb.config?.type === "mysql")
+      return "(UNIX_TIMESTAMP(CURRENT_TIMESTAMP(3)) * 1000)";
+    return "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)";
+  }
+  /** 改密推进凭据代际；会话存储清理失败也不能让旧凭据恢复授权。 */
+  async setPassword(input) {
+    const result = await reldb.sql.execute(
+      `UPDATE ${TABLE_NAME2} SET password_hash = ?, password_updated_at = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL, reset_attempts = 0 WHERE id = ? AND credential_version = ? AND enabled = ?`,
+      [input.passwordHash, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), crypto.randomUUID(), crypto.randomUUID(), input.userId, input.expectedVersion, reldb.config?.type === "postgresql" ? true : 1]
+    );
+    return result.success ? ok(result.data.changes === 1) : this.buildQueryError(result.error, result.error);
+  }
+  /** 发布只替换读取到的重置代际；旧发送者暂停后不能覆盖接管节点的新令牌。 */
+  async publishPasswordReset(input) {
+    const expiry = input.expiresAt.getTime();
+    if (!Number.isSafeInteger(expiry))
+      return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_resetTokenInvalid"));
+    const result = await reldb.sql.execute(
+      `UPDATE ${TABLE_NAME2} SET reset_hash = ?, reset_expires_at = ?, reset_attempts = 0, reset_version = ? WHERE id = ? AND credential_version = ? AND reset_version = ? AND enabled = ? AND ? > ${this.databaseNow()}`,
+      [input.tokenHash, expiry, crypto.randomUUID(), input.user.id, input.user.credentialVersion ?? "", input.user.resetVersion ?? "", reldb.config?.type === "postgresql" ? true : 1, expiry]
+    );
+    return result.success ? ok(result.data.changes === 1) : this.buildQueryError(result.error, result.error);
+  }
+  /** 条件计次返回新代际；业务策略失败也消耗尝试次数。 */
+  async claimPasswordReset(tokenHash, maxAttempts) {
+    const found = await this.findOneBy("reset_hash = ?", [tokenHash]);
+    if (!found.success)
+      return found;
+    const user = found.data;
+    if (!user)
+      return err(HaiIamError.RESET_TOKEN_INVALID, iamM("iam_resetTokenInvalid"));
+    if (!user.enabled)
+      return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+    if ((user.resetAttempts ?? 0) >= maxAttempts)
+      return err(HaiIamError.RESET_TOKEN_MAX_ATTEMPTS, iamM("iam_resetTokenMaxAttempts"));
+    const version = crypto.randomUUID();
+    const result = await reldb.sql.execute(
+      `UPDATE ${TABLE_NAME2} SET reset_attempts = reset_attempts + 1, reset_version = ? WHERE id = ? AND reset_hash = ? AND reset_version = ? AND credential_version = ? AND reset_attempts < ? AND reset_expires_at > ${this.databaseNow()} AND enabled = ?`,
+      [version, user.id, tokenHash, user.resetVersion ?? "", user.credentialVersion ?? "", maxAttempts, reldb.config?.type === "postgresql" ? true : 1]
+    );
+    if (!result.success)
+      return this.buildQueryError(result.error, result.error);
+    if (result.data.changes !== 1)
+      return err(HaiIamError.RESET_TOKEN_INVALID, iamM("iam_resetTokenInvalid"));
+    return ok({ ...user, resetVersion: version, resetAttempts: (user.resetAttempts ?? 0) + 1 });
+  }
+  /** 密码与令牌消费同一行原子提交，禁止先消费 Redis 凭据再无条件写数据库。 */
+  async commitPasswordReset(input) {
+    const result = await reldb.sql.execute(
+      `UPDATE ${TABLE_NAME2} SET password_hash = ?, password_updated_at = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL, reset_attempts = 0, login_failed_count = 0, locked_until = NULL, last_login_failed_at = NULL WHERE id = ? AND reset_hash = ? AND reset_version = ? AND credential_version = ? AND reset_expires_at > ${this.databaseNow()} AND enabled = ?`,
+      [input.passwordHash, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), crypto.randomUUID(), crypto.randomUUID(), input.user.id, input.tokenHash, input.user.resetVersion ?? "", input.user.credentialVersion ?? "", reldb.config?.type === "postgresql" ? true : 1]
+    );
+    return result.success ? ok(result.data.changes === 1) : this.buildQueryError(result.error, result.error);
+  }
   async recordLoginFailure(userId, policy) {
     const sqlite = reldb.config?.type === "sqlite";
     const now = sqlite ? Date.now() : /* @__PURE__ */ new Date();
@@ -1018,10 +1046,10 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
       return this.buildQueryError(result.error, result.error);
     return ok(void 0);
   }
-  async resetLoginFailures(userId) {
+  async resetLoginFailures(userId, expectedCredentialVersion) {
     const result = await reldb.sql.execute(
-      `UPDATE ${TABLE_NAME2} SET login_failed_count = 0, last_login_failed_at = NULL, locked_until = NULL WHERE id = ? AND enabled = ? AND (locked_until IS NULL OR locked_until <= ?)`,
-      [userId, reldb.config?.type === "postgresql" ? true : 1, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date()]
+      `UPDATE ${TABLE_NAME2} SET login_failed_count = 0, last_login_failed_at = NULL, locked_until = NULL WHERE id = ? AND credential_version = ? AND enabled = ? AND (locked_until IS NULL OR locked_until <= ?)`,
+      [userId, expectedCredentialVersion, reldb.config?.type === "postgresql" ? true : 1, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date()]
     );
     if (!result.success)
       return this.buildQueryError(result.error, result.error);
@@ -1031,6 +1059,8 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
         return user;
       if (!user.data?.enabled)
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+      if ((user.data.credentialVersion ?? "") !== expectedCredentialVersion)
+        return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
       if (user.data.lockedUntil && user.data.lockedUntil > /* @__PURE__ */ new Date())
         return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
     }
@@ -1158,7 +1188,7 @@ async function recordLoginFailure(userRepository, user, policy) {
   return userRepository.recordLoginFailure(user.id, policy);
 }
 async function resetLoginFailures(userRepository, user) {
-  return userRepository.resetLoginFailures(user.id);
+  return userRepository.resetLoginFailures(user.id, user.credentialVersion ?? "");
 }
 
 // src/authn/apikey/iam-authn-apikey-strategy.ts
@@ -1203,7 +1233,7 @@ function createApiKeyStrategy(config) {
       if (!candidate.enabled) {
         return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
       }
-      if (candidate.expiresAt && /* @__PURE__ */ new Date() > candidate.expiresAt) {
+      if (candidate.expiresAt && /* @__PURE__ */ new Date() >= candidate.expiresAt) {
         return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
       }
       apiKeyRepository.updateFields(candidate.id, { lastUsedAt: /* @__PURE__ */ new Date() }).catch(() => {
@@ -1238,7 +1268,7 @@ function createApiKeyStrategy(config) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       }
       logger.info("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
-      return ok({ user: toUser(userResult.data), apiKey });
+      return ok({ user: { ...toUser(userResult.data), credentialVersion: userResult.data.credentialVersion ?? "" }, apiKey });
     }
   };
   const apiKeyFunctions = {
@@ -1382,22 +1412,6 @@ function createLdapStrategy(config) {
     }
     return value;
   }
-  function buildLdapUser(entry, ldapUsername, ldapEmail, ldapDisplayName) {
-    const now = /* @__PURE__ */ new Date();
-    return {
-      id: entry.dn,
-      username: ldapUsername,
-      email: ldapEmail,
-      displayName: ldapDisplayName,
-      enabled: true,
-      createdAt: now,
-      updatedAt: now,
-      metadata: {
-        ldapDn: entry.dn,
-        authSource: "ldap"
-      }
-    };
-  }
   return {
     type: "ldap",
     name: "ldap-strategy",
@@ -1535,41 +1549,22 @@ function createLdapStrategy(config) {
             }
           }
         }
-        if (!storedUser) {
-          const ldapUser = buildLdapUser(entry, ldapUsername, ldapEmail, ldapDisplayName);
-          return ok(ldapUser);
-        }
+        if (!storedUser)
+          return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
         const resetResult = await resetLoginFailures(userRepository, storedUser);
         if (!resetResult.success)
           return resetResult;
         logger2.info("LDAP authentication succeeded", { userId: storedUser.id });
-        return ok(toUser(storedUser));
+        return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
       } finally {
         await client.unbind();
       }
     }
   };
 }
-var OTP_KEY_PREFIX = "hai:iam:otp:";
-var OTP_ATTEMPTS_KEY_PREFIX = "hai:iam:otp:attempts:";
 function normalizeOtpIdentifier(identifier) {
   const trimmed = identifier.trim();
-  if (trimmed.includes("@"))
-    return trimmed.toLowerCase();
-  return trimmed.replace(/[\s-]/g, "");
-}
-function buildOtpKey(identifier) {
-  return `${OTP_KEY_PREFIX}${normalizeOtpIdentifier(identifier)}`;
-}
-function buildOtpAttemptsKey(identifier) {
-  return `${OTP_ATTEMPTS_KEY_PREFIX}${normalizeOtpIdentifier(identifier)}`;
-}
-function restoreOtpDates(record) {
-  return {
-    ...record,
-    expiresAt: record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt),
-    createdAt: record.createdAt instanceof Date ? record.createdAt : new Date(record.createdAt)
-  };
+  return trimmed.includes("@") ? trimmed.toLowerCase() : trimmed.replace(/[\s-]/g, "");
 }
 var otpRepoInstance = null;
 function resetOtpRepoSingleton() {
@@ -1578,192 +1573,65 @@ function resetOtpRepoSingleton() {
 function createCacheOtpRepository() {
   if (otpRepoInstance)
     return otpRepoInstance;
-  const repo = {
-    async saveOtp(identifier, code, expiresIn) {
+  const keyFor = (identifier) => `hai:iam:otp:${normalizeOtpIdentifier(identifier)}`;
+  const failure = () => err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"));
+  const invalid = () => err(HaiIamError.OTP_INVALID, iamM("iam_otpNotExistOrExpired"));
+  otpRepoInstance = {
+    async issueOtp(input) {
       const now = Date.now();
-      const record = {
-        identifier: normalizeOtpIdentifier(identifier),
-        code,
-        expiresAt: new Date(now + expiresIn * 1e3),
+      const state = {
+        version: crypto.randomUUID(),
+        code: input.code,
         attempts: 0,
-        createdAt: new Date(now)
+        expiresAt: now + input.expiresIn * 1e3,
+        cooldownUntil: now + input.resendInterval * 1e3
       };
-      const result = await cache.kv.set(buildOtpKey(identifier), record, { ex: expiresIn });
-      if (!result.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveOtpFailed", { params: { message: result.error.message } }),
-          result.error
-        );
-      }
-      const reset = await cache.kv.del(buildOtpAttemptsKey(identifier));
-      if (!reset.success)
-        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), reset.error);
-      return ok(void 0);
-    },
-    async fetchOtp(identifier) {
-      const result = await cache.kv.get(buildOtpKey(identifier));
-      if (!result.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryOtpFailed", { params: { message: result.error.message } }),
-          result.error
-        );
-      }
-      if (!result.data) {
-        return ok(null);
-      }
-      const attemptsResult = await cache.kv.get(buildOtpAttemptsKey(identifier));
-      if (!attemptsResult.success)
-        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), attemptsResult.error);
-      const attempts = attemptsResult.success && typeof attemptsResult.data === "number" ? attemptsResult.data : 0;
-      const restored = restoreOtpDates(result.data);
-      return ok({ ...restored, attempts });
-    },
-    async incrementOtpAttempts(identifier) {
-      const otpKey = buildOtpKey(identifier);
-      const attemptsKey = buildOtpAttemptsKey(identifier);
-      const current = await cache.kv.get(otpKey);
-      if (!current.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryOtpFailed", { params: { message: current.error.message } }),
-          current.error
-        );
-      }
-      if (!current.data) {
-        return ok(0);
-      }
-      const incrResult = await cache.kv.incr(attemptsKey);
-      if (!incrResult.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_updateOtpAttemptsFailed", { params: { message: incrResult.error.message } }),
-          incrResult.error
-        );
-      }
-      const ttlResult = await cache.kv.ttl(otpKey);
-      if (!ttlResult.success)
-        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), ttlResult.error);
-      const ttl = ttlResult.success && ttlResult.data > 0 ? ttlResult.data : 1;
-      const expire = await cache.kv.expire(attemptsKey, ttl);
-      if (!expire.success)
-        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), expire.error);
-      return ok(incrResult.data);
+      const key = keyFor(input.identifier);
+      const current = await cache.kv.get(key);
+      if (!current.success)
+        return failure();
+      if (current.data && current.data.cooldownUntil > Date.now()) {
+        return err(HaiIamError.OTP_RESEND_TOO_FAST, iamM("iam_otpResendTooFast", { params: { seconds: Math.ceil((current.data.cooldownUntil - Date.now()) / 1e3) } }));
+      }
+      if (Date.now() >= state.expiresAt)
+        return invalid();
+      const published = await cache.kv.compareAndSwap(key, current.data ?? void 0, state, { px: Math.max(state.expiresAt, state.cooldownUntil) - Date.now() });
+      if (!published.success)
+        return failure();
+      if (!published.data)
+        return err(HaiIamError.SECURITY_BUSY, iamM("iam_securityBusy"));
+      if (Date.now() >= state.expiresAt)
+        return invalid();
+      return ok({ idempotencyKey: `iam-otp:${state.version}`, expiresAt: new Date(state.expiresAt) });
     },
-    async removeOtp(identifier) {
-      const result = await cache.kv.del(buildOtpKey(identifier));
-      if (!result.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_deleteOtpFailed", { params: { message: result.error.message } }),
-          result.error
-        );
+    async consumeOtp(identifier, code, maxAttempts) {
+      const key = keyFor(identifier);
+      let version;
+      for (let attempt = 0; attempt < 16; attempt++) {
+        const current = await cache.kv.get(key);
+        if (!current.success)
+          return failure();
+        const state = current.data;
+        if (!state || state.code === null || state.expiresAt <= Date.now() || state.attempts >= maxAttempts || version && state.version !== version)
+          return invalid();
+        version = state.version;
+        const correct = core.string.constantTimeEqual(state.code, code);
+        const attempts = state.attempts + 1;
+        const next = { ...state, attempts, code: correct || attempts >= maxAttempts ? null : state.code };
+        const committed = await cache.kv.compareAndSwap(key, state, next, { keepTtl: true });
+        if (!committed.success)
+          return failure();
+        if (!committed.data)
+          continue;
+        if (!correct || state.expiresAt <= Date.now())
+          return err(HaiIamError.OTP_INVALID, iamM("iam_otpWrong"));
+        return ok(void 0);
       }
-      const removed = await cache.kv.del(buildOtpAttemptsKey(identifier));
-      if (!removed.success)
-        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), removed.error);
-      return ok(void 0);
+      return err(HaiIamError.SECURITY_BUSY, iamM("iam_securityBusy"));
     }
   };
-  otpRepoInstance = repo;
-  return repo;
-}
-
-// src/session/iam-session-utils.ts
-var BASE64_PLUS_REGEX = /\+/g;
-var BASE64_SLASH_REGEX = /\//g;
-var BASE64_TRAILING_PADDING_REGEX = /=+$/;
-function generateToken() {
-  const bytes = new Uint8Array(32);
-  crypto.getRandomValues(bytes);
-  const base64 = btoa(String.fromCharCode(...bytes));
-  return base64.replace(BASE64_PLUS_REGEX, "-").replace(BASE64_SLASH_REGEX, "_").replace(BASE64_TRAILING_PADDING_REGEX, "");
-}
-function buildSession(options, now, sessionTtl, accessToken) {
-  return {
-    apiKeyId: options.apiKeyId,
-    apiKeyScopes: options.apiKeyScopes,
-    userId: options.userId,
-    username: options.username,
-    displayName: options.displayName,
-    avatarUrl: options.avatarUrl,
-    roles: options.roles ?? [],
-    permissions: options.permissions ?? [],
-    source: options.source,
-    accessToken,
-    createdAt: now,
-    lastActiveAt: now,
-    expiresAt: new Date(now.getTime() + sessionTtl * 1e3),
-    data: options.data
-  };
-}
-function getSessionTtl(session, now = Date.now()) {
-  return Math.max(0, Math.floor((session.expiresAt.getTime() - now) / 1e3));
-}
-function applySessionPatch(session, patch) {
-  const nextSession = { ...session };
-  if (patch.data !== void 0) {
-    nextSession.data = { ...nextSession.data, ...patch.data };
-  }
-  if (patch.roles !== void 0) {
-    nextSession.roles = patch.roles;
-  }
-  if (patch.permissions !== void 0) {
-    nextSession.permissions = patch.permissions;
-  }
-  if (patch.username !== void 0) {
-    nextSession.username = patch.username;
-  }
-  if (patch.displayName !== void 0) {
-    nextSession.displayName = patch.displayName;
-  }
-  if (patch.avatarUrl !== void 0) {
-    nextSession.avatarUrl = patch.avatarUrl;
-  }
-  if (patch.source !== void 0) {
-    nextSession.source = patch.source;
-  }
-  nextSession.lastActiveAt = /* @__PURE__ */ new Date();
-  return nextSession;
-}
-
-// src/iam-security.ts
-async function withIamLock(key, operation) {
-  const owner = generateToken();
-  const lockKey = `hai:iam:security:${key}`;
-  for (let attempt = 0; attempt < 500; attempt++) {
-    const acquired = await cache.lock.acquire(lockKey, { owner, ttl: 30 });
-    if (!acquired.success)
-      return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), acquired.error);
-    if (acquired.data) {
-      let leaseValid = true;
-      const renewal = setInterval(() => {
-        void cache.lock.extend(lockKey, 30, owner).then((result) => {
-          if (!result.success || !result.data)
-            leaseValid = false;
-        }).catch(() => {
-          leaseValid = false;
-        });
-      }, 1e4);
-      try {
-        const result = await operation();
-        if (!leaseValid)
-          return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"));
-        return result;
-      } catch (error) {
-        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_securityStateFailed"), error);
-      } finally {
-        clearInterval(renewal);
-        await cache.lock.release(lockKey, owner);
-      }
-    }
-    await new Promise((resolve) => setTimeout(resolve, 10));
-  }
-  return err(HaiIamError.SECURITY_BUSY, iamM("iam_securityBusy"));
+  return otpRepoInstance;
 }
-
-// src/authn/otp/iam-authn-otp-strategy.ts
 var logger3 = core.logger.child({ module: "iam", scope: "otp-strategy" });
 var PHONE_IDENTIFIER_REGEX = /^\+?\d{8,}$/;
 var PHONE_SEPARATOR_REGEX = /[\s-]/g;
@@ -1809,103 +1677,72 @@ function createOtpStrategy(config) {
       const { code } = credentialResult.data;
       if (!isChannelEnabled(identifier))
         return err(HaiIamError.LOGIN_DISABLED, iamM("iam_identifierTypeNotSupported"));
-      return withIamLock(`otp:${identifier}`, async () => {
-        const userResult = await config.userRepository.findByIdentifier(identifier);
-        if (!userResult.success) {
-          return userResult;
-        }
-        let storedUser = userResult.data;
-        if (storedUser) {
-          if (!storedUser.enabled) {
-            return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-          }
-          if (isAccountLocked(storedUser)) {
-            return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
-          }
+      const userResult = await config.userRepository.findByIdentifier(identifier);
+      if (!userResult.success) {
+        return userResult;
+      }
+      let storedUser = userResult.data;
+      if (storedUser) {
+        if (!storedUser.enabled) {
+          return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
         }
-        const storedOtpResult = await config.otpRepository.fetchOtp(identifier);
-        if (!storedOtpResult.success) {
-          return storedOtpResult;
+        if (isAccountLocked(storedUser)) {
+          return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
         }
-        const storedOtp = storedOtpResult.data;
-        if (!storedOtp) {
-          return err(HaiIamError.OTP_INVALID, iamM("iam_otpNotExistOrExpired"));
+      }
+      const consumed = await config.otpRepository.consumeOtp(identifier, code, otpConfig.maxAttempts);
+      if (!consumed.success) {
+        if (storedUser && consumed.error.code === HaiIamError.OTP_INVALID.code) {
+          const failed = await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+          if (!failed.success)
+            return failed;
         }
-        if (storedOtp.attempts >= otpConfig.maxAttempts) {
-          const removed2 = await config.otpRepository.removeOtp(identifier);
-          if (!removed2.success)
-            return removed2;
-          if (storedUser) {
-            const failureResult = await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
-            if (!failureResult.success)
-              return failureResult;
-          }
-          return err(HaiIamError.OTP_INVALID, iamM("iam_otpInvalid"));
+        return consumed;
+      }
+      if (!storedUser && allowAutoRegister) {
+        const type = identifierType(identifier);
+        const createResult = await config.userRepository.create({
+          username: identifier,
+          email: type === "email" ? identifier : void 0,
+          phone: type === "phone" ? identifier : void 0,
+          enabled: defaultEnabled,
+          emailVerified: type === "email",
+          phoneVerified: type === "phone"
+        });
+        if (!createResult.success) {
+          return err(
+            HaiIamError.REPOSITORY_ERROR,
+            iamM("iam_createUserFailed", { params: { message: createResult.error.message } }),
+            createResult.error
+          );
         }
-        if (!core.string.constantTimeEqual(storedOtp.code, code)) {
-          const attemptResult = await config.otpRepository.incrementOtpAttempts(identifier);
-          if (!attemptResult.success)
-            return attemptResult;
-          if (attemptResult.data >= otpConfig.maxAttempts) {
-            const removed2 = await config.otpRepository.removeOtp(identifier);
-            if (!removed2.success)
-              return removed2;
-          }
-          if (storedUser) {
-            const failureResult = await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
-            if (!failureResult.success)
-              return failureResult;
-          }
-          return err(HaiIamError.OTP_INVALID, iamM("iam_otpWrong"));
+        const createdResult = await config.userRepository.findByIdentifier(identifier);
+        if (!createdResult.success) {
+          return createdResult;
         }
-        const removed = await config.otpRepository.removeOtp(identifier);
-        if (!removed.success)
-          return removed;
-        if (!storedUser && allowAutoRegister) {
-          const type = identifierType(identifier);
-          const createResult = await config.userRepository.create({
-            username: identifier,
-            email: type === "email" ? identifier : void 0,
-            phone: type === "phone" ? identifier : void 0,
-            enabled: defaultEnabled,
-            emailVerified: type === "email",
-            phoneVerified: type === "phone"
-          });
-          if (!createResult.success) {
-            return err(
-              HaiIamError.REPOSITORY_ERROR,
-              iamM("iam_createUserFailed", { params: { message: createResult.error.message } }),
-              createResult.error
-            );
-          }
-          const createdResult = await config.userRepository.findByIdentifier(identifier);
-          if (!createdResult.success) {
-            return createdResult;
-          }
-          storedUser = createdResult.data;
-          if (storedUser && config.onUserAutoRegistered) {
-            try {
-              const assigned = await config.onUserAutoRegistered(storedUser.id);
-              if (!assigned.success) {
-                await config.userRepository.deleteById(storedUser.id);
-                return assigned;
-              }
-            } catch (callbackError) {
-              logger3.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
+        storedUser = createdResult.data;
+        if (storedUser && config.onUserAutoRegistered) {
+          try {
+            const assigned = await config.onUserAutoRegistered(storedUser.id);
+            if (!assigned.success) {
+              await config.userRepository.deleteById(storedUser.id);
+              return assigned;
             }
+          } catch (callbackError) {
+            logger3.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
           }
         }
-        if (!storedUser) {
-          return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
-        }
-        if (!storedUser.enabled)
-          return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-        const resetResult = await resetLoginFailures(config.userRepository, storedUser);
-        if (!resetResult.success)
-          return resetResult;
-        logger3.info("OTP authentication succeeded", { userId: storedUser.id });
-        return ok(toUser(storedUser));
-      });
+      }
+      if (!storedUser) {
+        return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
+      }
+      if (!storedUser.enabled)
+        return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+      const resetResult = await resetLoginFailures(config.userRepository, storedUser);
+      if (!resetResult.success)
+        return resetResult;
+      logger3.info("OTP authentication succeeded", { userId: storedUser.id });
+      return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
   function isChannelEnabled(identifier) {
@@ -1917,43 +1754,28 @@ function createOtpStrategy(config) {
     if (!isChannelEnabled(identifier))
       return err(HaiIamError.LOGIN_DISABLED, iamM("iam_identifierTypeNotSupported"));
     const code = generateOtpCode(otpConfig.length);
-    const expiresAt = new Date(Date.now() + otpConfig.expiresIn * 1e3);
-    const saved = await withIamLock(`otp:${identifier}`, async () => {
-      const cooldownKey = `hai:iam:otp:cooldown:${identifier}`;
-      const cooldown = await cache.kv.get(cooldownKey);
-      if (!cooldown.success)
-        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), cooldown.error);
-      if (cooldown.data && cooldown.data > Date.now())
-        return err(HaiIamError.OTP_RESEND_TOO_FAST, iamM("iam_otpResendTooFast", { params: { seconds: Math.ceil((cooldown.data - Date.now()) / 1e3) } }));
-      const storeResult = await config.otpRepository.saveOtp(identifier, code, otpConfig.expiresIn);
-      if (!storeResult.success)
-        return storeResult;
-      const limited = await cache.kv.set(cooldownKey, Date.now() + otpConfig.resendInterval * 1e3, { ex: otpConfig.resendInterval });
-      if (!limited.success)
-        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"), limited.error);
-      return ok(void 0);
-    });
+    const saved = await config.otpRepository.issueOtp({ identifier, code, expiresIn: otpConfig.expiresIn, resendInterval: otpConfig.resendInterval });
     if (!saved.success)
       return saved;
+    const context = saved.data;
+    const expiresAt = context.expiresAt;
     const type = identifierType(identifier);
     if (type === "email" && config.onOtpSendEmail) {
       try {
-        await config.onOtpSendEmail(identifier, code);
-      } catch (error) {
+        await config.onOtpSendEmail(identifier, code, context);
+      } catch {
         return err(
           HaiIamError.INTERNAL_ERROR,
-          iamM("iam_otpSendFailed"),
-          error
+          iamM("iam_notificationDeliveryUnknown")
         );
       }
     } else if (type === "phone" && config.onOtpSendSms) {
       try {
-        await config.onOtpSendSms(identifier, code);
-      } catch (error) {
+        await config.onOtpSendSms(identifier, code, context);
+      } catch {
         return err(
           HaiIamError.INTERNAL_ERROR,
-          iamM("iam_otpSendFailed"),
-          error
+          iamM("iam_notificationDeliveryUnknown")
         );
       }
     } else {
@@ -2087,7 +1909,7 @@ function createPasswordStrategy(config) {
       if (!resetResult.success)
         return resetResult;
       logger4.info("Password authentication succeeded", { userId: storedUser.id });
-      return ok(toUser(storedUser));
+      return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
   function hashPassword(password) {
@@ -2249,6 +2071,7 @@ function buildAuthnOperations(deps) {
     const effective = apiKey ? applyApiKeyScopes(access, apiKey.scopes) : access;
     const sessionResult = await sessionFunctions.create({
       userId: user.id,
+      expectedCredentialVersion: user.credentialVersion,
       username: user.username,
       displayName: user.displayName,
       avatarUrl: user.avatarUrl,
@@ -2264,8 +2087,9 @@ function buildAuthnOperations(deps) {
     if (!tokenPair) {
       return err(HaiIamError.SESSION_CREATE_FAILED, iamM("iam_createSessionFailed"));
     }
+    const { credentialVersion, ...publicUser } = user;
     return ok({
-      user,
+      user: publicUser,
       tokens: tokenPair,
       ...effective,
       agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnLogin)
@@ -2292,7 +2116,14 @@ function buildAuthnOperations(deps) {
     }
     return result;
   }
-  return { loginRegisteredUser: buildAuthResult, authn: {
+  return { loginRegisteredUser: async (user) => {
+    const stored = await userRepository.findById(user.id);
+    if (!stored.success)
+      return stored;
+    if (!stored.data?.enabled)
+      return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+    return buildAuthResult({ ...user, credentialVersion: stored.data.credentialVersion ?? "" });
+  }, authn: {
     async login(credentials) {
       return loginWithStrategy("password", credentials, passwordStrategy);
     },
@@ -2314,16 +2145,7 @@ function buildAuthnOperations(deps) {
       return buildAuthResult(authenticated.data.user, authenticated.data.apiKey);
     },
     async logout(accessToken) {
-      const sessionResult = await sessionFunctions.get(accessToken);
-      if (sessionResult.success && sessionResult.data) {
-        const tokenPair = sessionResult.data.data?._tokenPair;
-        if (tokenPair?.refreshToken) {
-          await sessionFunctions.revokeRefresh(tokenPair.refreshToken);
-        }
-        await sessionFunctions.delete(sessionResult.data.accessToken);
-        logger5.info("User logged out", { userId: sessionResult.data.userId });
-      }
-      return ok(void 0);
+      return sessionFunctions.delete(accessToken);
     },
     async verifyToken(accessToken) {
       const session = await sessionFunctions.verifyToken(accessToken);
@@ -2337,6 +2159,8 @@ function buildAuthnOperations(deps) {
         return user;
       if (!user.data?.enabled)
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+      if (session.data.credentialVersion !== (user.data.credentialVersion ?? ""))
+        return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
       if (!authorization.success)
         return authorization;
       const current = { ...session.data, username: user.data.username, displayName: user.data.displayName, avatarUrl: user.data.avatarUrl, ...authorization.data };
@@ -3792,25 +3616,25 @@ async function resolveIamNotifications(input) {
   if (!templates.success)
     throw new Error(iamM("iam_securityStateFailed"));
   const configured = new Map(templates.data.map((template) => [template.name, template.provider]));
-  async function send(template, to, vars) {
+  async function send(template, to, vars, context) {
     const provider = configured.get(template);
     if (!reach?.isInitialized || !provider || !to)
       throw new Error(iamM("iam_passwordResetDeliveryFailed"));
-    const result = await reach.send({ provider, to, template, vars });
+    const result = await reach.send({ provider, to, template, vars, idempotencyKey: context.idempotencyKey });
     if (!result.success || !result.data.success)
       throw new Error(iamM("iam_passwordResetDeliveryFailed"));
   }
   if (needsEmail && configured.has("otp_email"))
-    callbacks.onOtpSendEmail = (email, code) => send("otp_email", email, { code });
+    callbacks.onOtpSendEmail = (email, code, context) => send("otp_email", email, { code }, context);
   if (needsSms && configured.has("otp_sms"))
-    callbacks.onOtpSendSms = (phone, code) => send("otp_sms", phone, { code });
+    callbacks.onOtpSendSms = (phone, code, context) => send("otp_sms", phone, { code }, context);
   const resetTemplate = input.passwordReset?.mode === "phone" ? "password_reset_sms" : "password_reset";
   if (needsReset && configured.has(resetTemplate)) {
-    callbacks.onPasswordResetRequest = (user, token, expiresAt) => {
+    callbacks.onPasswordResetRequest = (user, token, context) => {
       const url = input.passwordReset?.resetUrl ? new URL(input.passwordReset.resetUrl) : null;
       url?.searchParams.set("token", token);
-      const vars = { token, expiresAt: expiresAt.toISOString(), resetUrl: url?.toString() ?? token };
-      return send(resetTemplate, input.passwordReset?.mode === "phone" ? user.phone ?? "" : user.email ?? "", vars);
+      const vars = { token, expiresAt: context.expiresAt.toISOString(), resetUrl: url?.toString() ?? token };
+      return send(resetTemplate, input.passwordReset?.mode === "phone" ? user.phone ?? "" : user.email ?? "", vars, context);
     };
   }
   return callbacks;
@@ -3943,283 +3767,267 @@ async function seedIamData(authz) {
     );
   }
 }
-var TOKEN_KEY_PREFIX = "hai:iam:token:";
-var USER_TOKENS_KEY_PREFIX = "hai:iam:user:";
-var REFRESH_TOKEN_PREFIX = "hai:iam:refresh:";
-function buildTokenKey(token) {
-  return `${TOKEN_KEY_PREFIX}${token}`;
+var BASE64_PLUS_REGEX = /\+/g;
+var BASE64_SLASH_REGEX = /\//g;
+var BASE64_TRAILING_PADDING_REGEX = /=+$/;
+function generateToken() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const base64 = btoa(String.fromCharCode(...bytes));
+  return base64.replace(BASE64_PLUS_REGEX, "-").replace(BASE64_SLASH_REGEX, "_").replace(BASE64_TRAILING_PADDING_REGEX, "");
+}
+function getUserSessionScope(userId) {
+  return createHash("sha256").update(userId).digest("hex");
 }
-function buildUserTokensKey(userId) {
-  return `${USER_TOKENS_KEY_PREFIX}${userId}:tokens`;
+function generateSessionToken(userId) {
+  return `s1.${getUserSessionScope(userId)}.${generateToken()}`;
 }
-function buildRefreshKey(refreshToken) {
-  return `${REFRESH_TOKEN_PREFIX}${refreshToken}`;
+function getTokenSessionScope(token) {
+  return /^s1\.([a-f0-9]{64})\.[\w-]{43}$/.exec(token)?.[1];
 }
-function restoreSessionDates(session) {
+function buildSession(options, now, sessionTtl, accessToken, credentialVersion) {
   return {
-    ...session,
-    createdAt: session.createdAt instanceof Date ? session.createdAt : new Date(session.createdAt),
-    lastActiveAt: session.lastActiveAt instanceof Date ? session.lastActiveAt : new Date(session.lastActiveAt),
-    expiresAt: session.expiresAt instanceof Date ? session.expiresAt : new Date(session.expiresAt)
+    version: crypto.randomUUID(),
+    credentialVersion,
+    apiKeyId: options.apiKeyId,
+    apiKeyScopes: options.apiKeyScopes,
+    userId: options.userId,
+    username: options.username,
+    displayName: options.displayName,
+    avatarUrl: options.avatarUrl,
+    roles: options.roles ?? [],
+    permissions: options.permissions ?? [],
+    source: options.source,
+    accessToken,
+    createdAt: now,
+    lastActiveAt: now,
+    expiresAt: new Date(now.getTime() + sessionTtl * 1e3),
+    maxAge: sessionTtl,
+    data: options.data
   };
 }
-function buildRepositoryError(messageKey, message, cause) {
-  return err(
-    HaiIamError.REPOSITORY_ERROR,
-    iamM(messageKey, { params: { message } }),
-    cause
-  );
-}
-function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
-  const repo = {
-    async save(session, tokenPair) {
-      const accessToken = session.accessToken;
-      const userId = session.userId;
-      const ttl = getSessionTtl(session);
-      const setResult = await cache.kv.set(buildTokenKey(accessToken), session, { ex: ttl });
-      if (!setResult.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveSessionMappingCacheFailed", { params: { message: setResult.error.message } }),
-          setResult.error
-        );
-      }
-      const saddResult = await cache.set_.sadd(buildUserTokensKey(userId), accessToken);
-      if (!saddResult.success) {
-        await cache.kv.del(buildTokenKey(accessToken));
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveUserSessionCacheFailed", { params: { message: saddResult.error.message } }),
-          saddResult.error
-        );
-      }
-      await cache.kv.expire(buildUserTokensKey(userId), sessionMaxAge * 2);
-      const refreshResult = await cache.kv.set(
-        buildRefreshKey(tokenPair.refreshToken),
-        { userId, accessToken },
-        { ex: refreshTokenMaxAge }
-      );
-      if (!refreshResult.success) {
-        await cache.kv.del(buildTokenKey(accessToken));
-        await cache.set_.srem(buildUserTokensKey(userId), accessToken);
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveSessionMappingCacheFailed", { params: { message: refreshResult.error.message } }),
-          refreshResult.error
-        );
-      }
-      return ok(void 0);
-    },
-    async getByAccessToken(accessToken) {
-      const result = await cache.kv.get(buildTokenKey(accessToken));
-      if (!result.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_querySessionMappingCacheFailed", { params: { message: result.error.message } }),
-          result.error
-        );
-      }
-      if (!result.data) {
-        return ok(null);
-      }
-      return ok(restoreSessionDates(result.data));
-    },
-    async updateByAccessToken(accessToken, data) {
-      const sessionResult = await repo.getByAccessToken(accessToken);
-      if (!sessionResult.success) {
-        return sessionResult;
-      }
-      if (!sessionResult.data) {
-        return err(
-          HaiIamError.SESSION_NOT_FOUND,
-          iamM("iam_sessionNotExist")
-        );
-      }
-      const nextSession = applySessionPatch(sessionResult.data, data);
-      const ttl = getSessionTtl(nextSession);
-      const setResult = await cache.kv.set(buildTokenKey(accessToken), nextSession, { ex: ttl });
-      if (!setResult.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveSessionMappingCacheFailed", { params: { message: setResult.error.message } }),
-          setResult.error
-        );
-      }
-      return ok(void 0);
-    },
-    async removeByAccessToken(accessToken) {
-      const tokenKey = buildTokenKey(accessToken);
-      const sessionResult = await cache.kv.get(tokenKey);
-      if (!sessionResult.success) {
-        return buildRepositoryError(
-          "iam_querySessionMappingCacheFailed",
-          sessionResult.error.message,
-          sessionResult.error
-        );
-      }
-      if (sessionResult.data) {
-        const session = sessionResult.data;
-        const removeUserTokenResult = await cache.set_.srem(buildUserTokensKey(session.userId), accessToken);
-        if (!removeUserTokenResult.success) {
-          return buildRepositoryError(
-            "iam_deleteUserSessionCacheFailed",
-            removeUserTokenResult.error.message,
-            removeUserTokenResult.error
-          );
-        }
-        const tokenPair = session.data?._tokenPair;
-        if (tokenPair?.refreshToken) {
-          const removeRefreshTokenResult = await cache.kv.del(buildRefreshKey(tokenPair.refreshToken));
-          if (!removeRefreshTokenResult.success) {
-            return buildRepositoryError(
-              "iam_deleteSessionMappingCacheFailed",
-              removeRefreshTokenResult.error.message,
-              removeRefreshTokenResult.error
-            );
-          }
+function applySessionPatch(session, patch) {
+  const nextSession = { ...session };
+  if (patch.data !== void 0) {
+    nextSession.data = { ...nextSession.data, ...patch.data };
+  }
+  if (patch.roles !== void 0) {
+    nextSession.roles = patch.roles;
+  }
+  if (patch.permissions !== void 0) {
+    nextSession.permissions = patch.permissions;
+  }
+  if (patch.username !== void 0) {
+    nextSession.username = patch.username;
+  }
+  if (patch.displayName !== void 0) {
+    nextSession.displayName = patch.displayName;
+  }
+  if (patch.avatarUrl !== void 0) {
+    nextSession.avatarUrl = patch.avatarUrl;
+  }
+  if (patch.source !== void 0) {
+    nextSession.source = patch.source;
+  }
+  if (patch.expiresAt !== void 0)
+    nextSession.expiresAt = new Date(patch.expiresAt);
+  nextSession.lastActiveAt = patch.lastActiveAt !== void 0 ? new Date(patch.lastActiveAt) : /* @__PURE__ */ new Date();
+  return nextSession;
+}
+
+// src/session/iam-session-repository-cache.ts
+function retainedUntil(entry) {
+  return Math.max(new Date(entry.session.expiresAt).getTime(), entry.refreshToken ? entry.refreshExpiresAt : 0);
+}
+function restoreSession(session) {
+  const result = { ...session, createdAt: new Date(session.createdAt), lastActiveAt: new Date(session.lastActiveAt), expiresAt: new Date(session.expiresAt) };
+  if (typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![result.createdAt, result.lastActiveAt, result.expiresAt].every((date) => Number.isFinite(date.getTime()))) {
+    throw new TypeError("Invalid session state");
+  }
+  return result;
+}
+function stateKey(scope) {
+  return `hai:iam:sessions:{${scope}}`;
+}
+function repositoryFailure(cause) {
+  return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_sessionStateFailed"), cause);
+}
+function createCacheSessionRepository(refreshTokenMaxAge) {
+  async function read(scope) {
+    try {
+      const result = await cache.kv.get(stateKey(scope));
+      if (!result.success)
+        return repositoryFailure(result.error);
+      if (result.data === null)
+        return ok(void 0);
+      const state = result.data;
+      if (typeof state.revision !== "string" || !state.revision || !state.sessions || typeof state.sessions !== "object" || Array.isArray(state.sessions))
+        throw new TypeError("Invalid session state");
+      for (const [token, entry] of Object.entries(state.sessions)) {
+        const session = restoreSession(entry.session);
+        if (getTokenSessionScope(token) !== scope || token !== session.accessToken || getUserSessionScope(session.userId) !== scope || !Number.isSafeInteger(entry.refreshExpiresAt) || entry.refreshToken !== void 0 && getTokenSessionScope(entry.refreshToken) !== scope) {
+          throw new TypeError("Invalid session state");
         }
       }
-      const removeSessionResult = await cache.kv.del(tokenKey);
-      if (!removeSessionResult.success) {
-        return buildRepositoryError(
-          "iam_deleteSessionMappingCacheFailed",
-          removeSessionResult.error.message,
-          removeSessionResult.error
-        );
-      }
-      return ok(void 0);
-    },
-    async removeByUserId(userId) {
-      const tokensResult = await cache.set_.smembers(buildUserTokensKey(userId));
-      if (!tokensResult.success) {
-        return buildRepositoryError(
-          "iam_queryUserSessionCacheFailed",
-          tokensResult.error.message,
-          tokensResult.error
-        );
-      }
-      let removed = 0;
-      if (tokensResult.data.length > 0) {
-        const results = await Promise.allSettled(
-          tokensResult.data.map((token) => repo.removeByAccessToken(token))
-        );
-        for (const r of results) {
-          if (r.status === "rejected") {
-            return buildRepositoryError(
-              "iam_deleteSessionFailed",
-              String(r.reason),
-              r.reason
-            );
-          }
-          if (!r.value.success)
-            return r.value;
-          removed += 1;
+      return ok(state);
+    } catch (cause) {
+      return repositoryFailure(cause);
+    }
+  }
+  async function mutate(scope, operation) {
+    try {
+      for (let attempt = 0; attempt < 16; attempt++) {
+        const current = await read(scope);
+        if (!current.success)
+          return current;
+        const next = current.data ? JSON.parse(JSON.stringify(current.data)) : { revision: "", sessions: {} };
+        for (const [token, entry] of Object.entries(next.sessions)) {
+          if (retainedUntil(entry) <= Date.now())
+            delete next.sessions[token];
         }
-      }
-      const removeUserTokensKeyResult = await cache.kv.del(buildUserTokensKey(userId));
-      if (!removeUserTokensKeyResult.success) {
-        return buildRepositoryError(
-          "iam_deleteUserSessionCacheFailed",
-          removeUserTokensKeyResult.error.message,
-          removeUserTokensKeyResult.error
-        );
-      }
-      return ok(removed);
+        const outcome = operation(next);
+        if (!outcome.success)
+          return outcome;
+        next.revision = crypto.randomUUID();
+        const entries = Object.values(next.sessions);
+        const px = entries.reduce((ttl, entry) => Math.max(ttl, retainedUntil(entry) - Date.now()), 1);
+        const written = await cache.kv.compareAndSwap(stateKey(scope), current.data, entries.length ? next : void 0, { px });
+        if (!written.success)
+          return repositoryFailure(written.error);
+        if (written.data)
+          return outcome;
+      }
+      return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+    } catch (cause) {
+      return repositoryFailure(cause);
+    }
+  }
+  function storeSession(state, session, tokens) {
+    const scope = getUserSessionScope(session.userId);
+    if (getTokenSessionScope(session.accessToken) !== scope || tokens.accessToken !== session.accessToken || getTokenSessionScope(tokens.refreshToken) !== scope)
+      return err(HaiIamError.TOKEN_INVALID, iamM("iam_sessionStateFailed"));
+    state.sessions[session.accessToken] = { session, refreshToken: tokens.refreshToken, refreshExpiresAt: session.createdAt.getTime() + refreshTokenMaxAge * 1e3 };
+    return ok(void 0);
+  }
+  return {
+    save: (session, tokens, singleDevice = false) => mutate(getUserSessionScope(session.userId), (state) => {
+      if (singleDevice)
+        state.sessions = {};
+      return storeSession(state, session, tokens);
+    }),
+    rotate: (previous, refreshToken, session, tokens) => mutate(getUserSessionScope(previous.userId), (state) => {
+      const old = state.sessions[previous.accessToken];
+      if (!old || old.refreshToken !== refreshToken || old.refreshExpiresAt <= Date.now())
+        return err(HaiIamError.TOKEN_EXPIRED, iamM("iam_refreshTokenExpired"));
+      if (old.session.version !== previous.version || session.userId !== previous.userId)
+        return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+      delete state.sessions[previous.accessToken];
+      return storeSession(state, session, tokens);
+    }),
+    async getByAccessToken(token) {
+      const scope = getTokenSessionScope(token);
+      if (!scope)
+        return ok(null);
+      const result = await read(scope);
+      if (!result.success)
+        return result;
+      const record = result.data?.sessions[token];
+      if (!record)
+        return ok(null);
+      const session = restoreSession(record.session);
+      return ok(session.expiresAt.getTime() <= Date.now() ? null : session);
     },
-    async getByRefreshToken(refreshToken) {
-      const mappingResult = await cache.kv.get(buildRefreshKey(refreshToken));
-      if (!mappingResult.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_querySessionMappingCacheFailed", { params: { message: mappingResult.error.message } }),
-          mappingResult.error
-        );
-      }
-      if (!mappingResult.data) {
+    async getByRefreshToken(token) {
+      const scope = getTokenSessionScope(token);
+      if (!scope)
         return ok(null);
-      }
-      return repo.getByAccessToken(mappingResult.data.accessToken);
+      const result = await read(scope);
+      if (!result.success)
+        return result;
+      const record = Object.values(result.data?.sessions ?? {}).find((entry) => entry.refreshToken === token && entry.refreshExpiresAt > Date.now());
+      if (!record)
+        return ok(null);
+      return ok(restoreSession(record.session));
     },
-    async removeRefreshToken(refreshToken) {
-      const result = await cache.kv.del(buildRefreshKey(refreshToken));
-      if (!result.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_deleteSessionMappingCacheFailed", { params: { message: result.error.message } }),
-          result.error
-        );
-      }
-      return ok(void 0);
+    async updateByAccessToken(token, patch, expectedVersion) {
+      const scope = getTokenSessionScope(token);
+      if (!scope)
+        return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
+      return mutate(scope, (state) => {
+        const entry = state.sessions[token];
+        if (!entry || new Date(entry.session.expiresAt).getTime() <= Date.now())
+          return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
+        if (!expectedVersion || entry.session.version !== expectedVersion)
+          return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+        const updated = applySessionPatch(restoreSession(entry.session), patch);
+        if (![updated.expiresAt, updated.lastActiveAt].every((date) => Number.isFinite(date.getTime())))
+          return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sessionMaxAgeInvalid"));
+        entry.session = { ...updated, version: crypto.randomUUID() };
+        return ok(void 0);
+      });
     },
-    async patchUserSessions(userId, updates) {
-      const tokensResult = await cache.set_.smembers(buildUserTokensKey(userId));
-      if (!tokensResult.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryUserSessionCacheFailed", { params: { message: tokensResult.error.message } }),
-          tokensResult.error
-        );
-      }
-      const tokens = tokensResult.data;
-      const readResults = await Promise.allSettled(
-        tokens.map(async (token) => {
-          const sessionKey = buildTokenKey(token);
-          const [sessionResult, ttlResult] = await Promise.all([
-            cache.kv.get(sessionKey),
-            cache.kv.ttl(sessionKey)
-          ]);
-          return { token, sessionKey, sessionResult, ttlResult };
-        })
-      );
-      const staleTokens = [];
-      const writeOps = [];
-      for (const entry of readResults) {
-        if (entry.status === "rejected") {
-          return buildRepositoryError(
-            "iam_queryUserSessionCacheFailed",
-            String(entry.reason),
-            entry.reason
-          );
-        }
-        const { token, sessionKey, sessionResult, ttlResult } = entry.value;
-        if (!sessionResult.success || !sessionResult.data || !ttlResult.success || ttlResult.data <= 0) {
-          staleTokens.push(token);
-          continue;
-        }
-        const updated = { ...sessionResult.data, ...updates };
-        writeOps.push(cache.kv.set(sessionKey, updated, { ex: ttlResult.data }));
-      }
-      const writeResults = await Promise.allSettled(writeOps);
-      for (const writeResult of writeResults) {
-        if (writeResult.status === "rejected") {
-          return buildRepositoryError(
-            "iam_saveUserSessionCacheFailed",
-            String(writeResult.reason),
-            writeResult.reason
-          );
-        }
-        if (!writeResult.value.success) {
-          return buildRepositoryError(
-            "iam_saveUserSessionCacheFailed",
-            writeResult.value.error.message,
-            writeResult.value.error
-          );
+    async touchByAccessToken(token, expectedVersion, now) {
+      const scope = getTokenSessionScope(token);
+      if (!scope)
+        return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
+      return mutate(scope, (state) => {
+        const entry = state.sessions[token];
+        if (!entry || new Date(entry.session.expiresAt).getTime() <= Date.now())
+          return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
+        if (entry.session.version !== expectedVersion)
+          return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+        const current = restoreSession(entry.session);
+        const next = {
+          ...current,
+          lastActiveAt: new Date(Math.max(current.lastActiveAt.getTime(), now.getTime())),
+          expiresAt: new Date(Math.max(current.expiresAt.getTime(), now.getTime() + current.maxAge * 1e3))
+        };
+        entry.session = next;
+        return ok(next);
+      });
+    },
+    async removeByAccessToken(token) {
+      const scope = getTokenSessionScope(token);
+      if (!scope)
+        return ok(void 0);
+      return mutate(scope, (state) => {
+        delete state.sessions[token];
+        return ok(void 0);
+      });
+    },
+    removeByUserId: (userId) => mutate(getUserSessionScope(userId), (state) => {
+      const count = Object.keys(state.sessions).length;
+      state.sessions = {};
+      return ok(count);
+    }),
+    async removeRefreshToken(token) {
+      const scope = getTokenSessionScope(token);
+      if (!scope)
+        return ok(void 0);
+      return mutate(scope, (state) => {
+        for (const entry of Object.values(state.sessions)) {
+          if (entry.refreshToken === token)
+            delete entry.refreshToken;
         }
-      }
-      if (staleTokens.length > 0) {
-        const staleCleanupResult = await cache.set_.srem(buildUserTokensKey(userId), ...staleTokens);
-        if (!staleCleanupResult.success) {
-          return buildRepositoryError(
-            "iam_deleteUserSessionCacheFailed",
-            staleCleanupResult.error.message,
-            staleCleanupResult.error
-          );
+        return ok(void 0);
+      });
+    },
+    patchUserSessions(userId, patch) {
+      let targets;
+      return mutate(getUserSessionScope(userId), (state) => {
+        targets ??= new Map(Object.entries(state.sessions).map(([token, entry]) => [token, entry.session.version]));
+        for (const [token, version] of targets) {
+          const entry = state.sessions[token];
+          if (!entry)
+            continue;
+          if (entry.session.version !== version)
+            return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+          entry.session = { ...applySessionPatch(restoreSession(entry.session), patch), version: crypto.randomUUID() };
         }
-      }
-      return ok(void 0);
+        return ok(void 0);
+      });
     }
   };
-  return repo;
 }
 
 // src/session/iam-session-functions.ts
@@ -4236,10 +4044,10 @@ async function createSessionOperations(deps) {
     const { config } = deps;
     const sessionConfig = SessionConfigSchema.parse(config.session ?? {});
     const sessionRepository = createCacheSessionRepository(
-      sessionConfig.maxAge ?? 86400,
       sessionConfig.refreshTokenMaxAge ?? 604800
     );
     const functions = buildSessionFunctions({
+      readCredential: deps.readCredential,
       maxAge: sessionConfig.maxAge,
       sliding: sessionConfig.sliding,
       singleDevice: sessionConfig.singleDevice,
@@ -4262,6 +4070,31 @@ function buildSessionFunctions(config) {
   const sliding = config.sliding ?? true;
   const singleDevice = config.singleDevice ?? false;
   const repo = config.sessionRepository;
+  function candidate(options, credentialVersion) {
+    const now = /* @__PURE__ */ new Date();
+    const ttl = options.maxAge ?? maxAge;
+    if (!Number.isSafeInteger(ttl) || ttl <= 0 || !Number.isFinite(new Date(now.getTime() + ttl * 1e3).getTime()))
+      return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sessionMaxAgeInvalid"));
+    const accessToken = generateSessionToken(options.userId);
+    const tokens = { accessToken, refreshToken: generateSessionToken(options.userId), expiresIn: ttl, tokenType: "Bearer" };
+    const session = buildSession(options, now, ttl, accessToken, credentialVersion);
+    session.data = { ...session.data, _tokenPair: tokens };
+    return ok({ session, tokens });
+  }
+  async function credential(userId, expected) {
+    try {
+      const current = await config.readCredential(userId);
+      if (!current.success)
+        return current;
+      if (!current.data || current.data.enabled !== true)
+        return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+      if (typeof current.data.version !== "string" || expected !== void 0 && current.data.version !== expected)
+        return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
+      return ok(current.data.version);
+    } catch {
+      return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_sessionExpired"));
+    }
+  }
   async function validateApiKey(session) {
     if (!session.apiKeyId)
       return ok(session);
@@ -4275,31 +4108,21 @@ function buildSessionFunctions(config) {
       return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
     if (!key.enabled)
       return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
-    if (key.expiresAt && /* @__PURE__ */ new Date() > key.expiresAt)
+    if (key.expiresAt && /* @__PURE__ */ new Date() >= key.expiresAt)
       return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
     return ok(applyApiKeyScopes({ ...session, apiKeyScopes: key.scopes }, key.scopes));
   }
   return {
     async create(options) {
       try {
-        if (singleDevice) {
-          const clearResult = await repo.removeByUserId(options.userId);
-          if (!clearResult.success) {
-            return clearResult;
-          }
-        }
-        const accessToken = generateToken();
-        const tokenPair = {
-          accessToken,
-          refreshToken: generateToken(),
-          expiresIn: maxAge,
-          tokenType: "Bearer"
-        };
-        const now = /* @__PURE__ */ new Date();
-        const sessionTtl = options.maxAge ?? maxAge;
-        const session = buildSession(options, now, sessionTtl, accessToken);
-        session.data = { ...session.data, _tokenPair: tokenPair };
-        const saveResult = await repo.save(session, tokenPair);
+        const bound = await credential(options.userId, options.expectedCredentialVersion);
+        if (!bound.success)
+          return bound;
+        const built = candidate(options, bound.data);
+        if (!built.success)
+          return built;
+        const { session, tokens } = built.data;
+        const saveResult = await repo.save(session, tokens, singleDevice);
         if (!saveResult.success) {
           return saveResult;
         }
@@ -4329,20 +4152,23 @@ function buildSessionFunctions(config) {
         }
         return ok(null);
       }
+      if (typeof session.credentialVersion !== "string")
+        return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
+      const bound = await credential(session.userId, session.credentialVersion);
+      if (!bound.success)
+        return bound;
       const validated = await validateApiKey(session);
       if (!validated.success)
         return validated;
+      let output = validated.data;
       if (sliding) {
-        const now = /* @__PURE__ */ new Date();
-        const updateResult = await repo.updateByAccessToken(accessToken, {
-          lastActiveAt: now,
-          expiresAt: new Date(now.getTime() + maxAge * 1e3)
-        });
+        const updateResult = await repo.touchByAccessToken(accessToken, session.version, /* @__PURE__ */ new Date());
         if (!updateResult.success) {
           return updateResult;
         }
+        output = { ...output, lastActiveAt: updateResult.data.lastActiveAt, expiresAt: updateResult.data.expiresAt };
       }
-      return ok(stripInternalSessionFields(validated.data));
+      return ok(stripInternalSessionFields(output));
     },
     async verifyToken(accessToken) {
       const sessionResult = await this.get(accessToken);
@@ -4357,8 +4183,8 @@ function buildSessionFunctions(config) {
       }
       return ok(sessionResult.data);
     },
-    async update(accessToken, data) {
-      return repo.updateByAccessToken(accessToken, data);
+    async update(accessToken, data, expectedVersion) {
+      return repo.updateByAccessToken(accessToken, data, expectedVersion);
     },
     async delete(accessToken) {
       logger8.debug("Session delete requested");
@@ -4384,15 +4210,16 @@ function buildSessionFunctions(config) {
             iamM("iam_refreshTokenExpired")
           );
         }
+        if (typeof oldSession.credentialVersion !== "string")
+          return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
+        const bound = await credential(oldSession.userId, oldSession.credentialVersion);
+        if (!bound.success)
+          return bound;
         const validated = await validateApiKey(oldSession);
         if (!validated.success)
           return validated;
         const effectiveSession = validated.data;
-        const removeOldSessionResult = await repo.removeByAccessToken(oldSession.accessToken);
-        if (!removeOldSessionResult.success) {
-          return removeOldSessionResult;
-        }
-        const newSessionResult = await this.create({
+        const next = candidate({
           userId: oldSession.userId,
           username: oldSession.username,
           displayName: oldSession.displayName,
@@ -4402,20 +4229,19 @@ function buildSessionFunctions(config) {
           apiKeyId: effectiveSession.apiKeyId,
           apiKeyScopes: effectiveSession.apiKeyScopes,
           source: oldSession.source,
+          maxAge: oldSession.maxAge,
           data: oldSession.data ? { ...oldSession.data, _tokenPair: void 0 } : void 0
-        });
-        if (!newSessionResult.success) {
-          return newSessionResult;
-        }
-        const tokenPair = newSessionResult.data.data?._tokenPair;
-        if (!tokenPair) {
-          return err(
-            HaiIamError.TOKEN_REFRESH_FAILED,
-            iamM("iam_refreshTokenFailed")
-          );
-        }
+        }, oldSession.credentialVersion);
+        if (!next.success)
+          return next;
+        const rotated = await repo.rotate(oldSession, refreshToken, next.data.session, next.data.tokens);
+        if (!rotated.success)
+          return rotated;
+        const current = await credential(oldSession.userId, oldSession.credentialVersion);
+        if (!current.success)
+          return current;
         logger8.debug("Token refreshed", { userId: oldSession.userId });
-        return ok(tokenPair);
+        return ok(next.data.tokens);
       } catch (error) {
         return err(
           HaiIamError.TOKEN_REFRESH_FAILED,
@@ -4451,7 +4277,7 @@ function createTicketOperations() {
         expiresAt
       };
       const saved = await cache.kv.set(buildTicketKey(ticket), record, { px: ttlMs, nx: true });
-      if (!saved.success) {
+      if (!saved.success || !saved.data) {
         logger9.warn("Failed to issue ticket", { purpose: options.purpose });
         return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
       }
@@ -4488,213 +4314,6 @@ function createTicketOperations() {
     }
   };
 }
-function hashResetToken(token) {
-  const result = crypto$1.hash.hash(token);
-  if (!result.success) {
-    return err(
-      HaiIamError.REPOSITORY_ERROR,
-      iamM("iam_hashResetTokenFailed", { params: { message: result.error.message } }),
-      result.error
-    );
-  }
-  return ok(result.data);
-}
-var RESET_TOKEN_KEY_PREFIX = "hai:iam:reset:";
-var RESET_ATTEMPTS_KEY_PREFIX = "hai:iam:reset:attempts:";
-var RESET_USER_TOKEN_KEY_PREFIX = "hai:iam:reset:user:";
-function buildResetTokenKey(hashedToken) {
-  return `${RESET_TOKEN_KEY_PREFIX}${hashedToken}`;
-}
-function buildAttemptsKey(userId) {
-  return `${RESET_ATTEMPTS_KEY_PREFIX}${userId}`;
-}
-function buildUserTokenKey(userId) {
-  return `${RESET_USER_TOKEN_KEY_PREFIX}${userId}`;
-}
-function buildResetTokenRepositoryError(messageKey, message, cause) {
-  return err(
-    HaiIamError.REPOSITORY_ERROR,
-    iamM(messageKey, { params: { message } }),
-    cause
-  );
-}
-var resetTokenRepoInstance = null;
-function resetResetTokenRepoSingleton() {
-  resetTokenRepoInstance = null;
-}
-function createCacheResetTokenRepository() {
-  if (resetTokenRepoInstance)
-    return resetTokenRepoInstance;
-  async function clearTokenState(hashedToken, userId) {
-    const cleanupResults = await Promise.all([
-      cache.kv.del(buildResetTokenKey(hashedToken)),
-      cache.kv.del(buildAttemptsKey(userId)),
-      cache.kv.del(buildUserTokenKey(userId))
-    ]);
-    const failedCleanup = cleanupResults.find((result) => !result.success);
-    if (failedCleanup && !failedCleanup.success) {
-      return buildResetTokenRepositoryError(
-        "iam_saveResetTokenFailed",
-        failedCleanup.error.message,
-        failedCleanup.error
-      );
-    }
-    return ok(void 0);
-  }
-  const repo = {
-    async saveToken(token, userId, expiresAt) {
-      return withIamLock(`reset:${userId}`, async () => {
-        const hashResult = hashResetToken(token);
-        if (!hashResult.success) {
-          return hashResult;
-        }
-        const hashedToken = hashResult.data;
-        const ttlSeconds = Math.max(1, Math.ceil((expiresAt.getTime() - Date.now()) / 1e3));
-        const userTokenKey = buildUserTokenKey(userId);
-        const existingTokenResult = await cache.kv.get(userTokenKey);
-        if (!existingTokenResult.success) {
-          return buildResetTokenRepositoryError(
-            "iam_queryResetTokenFailed",
-            existingTokenResult.error.message,
-            existingTokenResult.error
-          );
-        }
-        if (existingTokenResult.data && existingTokenResult.data !== hashedToken) {
-          const removeExistingTokenResult = await cache.kv.del(buildResetTokenKey(existingTokenResult.data));
-          if (!removeExistingTokenResult.success) {
-            return buildResetTokenRepositoryError(
-              "iam_saveResetTokenFailed",
-              removeExistingTokenResult.error.message,
-              removeExistingTokenResult.error
-            );
-          }
-        }
-        const setResult = await cache.kv.set(buildResetTokenKey(hashedToken), userId, { ex: ttlSeconds });
-        if (!setResult.success) {
-          return err(
-            HaiIamError.REPOSITORY_ERROR,
-            iamM("iam_saveResetTokenFailed", { params: { message: setResult.error.message } }),
-            setResult.error
-          );
-        }
-        const saveUserTokenResult = await cache.kv.set(userTokenKey, hashedToken, { ex: ttlSeconds });
-        if (!saveUserTokenResult.success) {
-          await cache.kv.del(buildResetTokenKey(hashedToken));
-          return buildResetTokenRepositoryError(
-            "iam_saveResetTokenFailed",
-            saveUserTokenResult.error.message,
-            saveUserTokenResult.error
-          );
-        }
-        const attemptsResult = await cache.kv.set(buildAttemptsKey(userId), 0, { ex: ttlSeconds });
-        if (!attemptsResult.success) {
-          await Promise.all([
-            cache.kv.del(buildResetTokenKey(hashedToken)),
-            cache.kv.del(userTokenKey)
-          ]);
-          return buildResetTokenRepositoryError(
-            "iam_saveResetTokenFailed",
-            attemptsResult.error.message,
-            attemptsResult.error
-          );
-        }
-        return ok(void 0);
-      });
-    },
-    async useToken(token, maxAttempts, operation) {
-      const hash = hashResetToken(token);
-      if (!hash.success)
-        return hash;
-      const user = await cache.kv.get(buildResetTokenKey(hash.data));
-      if (!user.success)
-        return buildResetTokenRepositoryError("iam_queryResetTokenFailed", user.error.message, user.error);
-      if (!user.data)
-        return err(HaiIamError.RESET_TOKEN_INVALID, iamM("iam_resetTokenInvalid"));
-      return withIamLock(`reset:${user.data}`, async () => {
-        const verified = await repo.tryGetUserByToken(token, maxAttempts);
-        if (!verified.success)
-          return verified;
-        const result = await operation(verified.data);
-        if (!result.success)
-          return result;
-        return repo.removeToken(token);
-      });
-    },
-    async tryGetUserByToken(token, maxAttempts) {
-      const hashResult = hashResetToken(token);
-      if (!hashResult.success) {
-        return hashResult;
-      }
-      const hashedToken = hashResult.data;
-      const tokenKey = buildResetTokenKey(hashedToken);
-      const result = await cache.kv.get(tokenKey);
-      if (!result.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryResetTokenFailed", { params: { message: result.error.message } }),
-          result.error
-        );
-      }
-      if (!result.data) {
-        return err(
-          HaiIamError.RESET_TOKEN_INVALID,
-          iamM("iam_resetTokenInvalid")
-        );
-      }
-      const userId = result.data;
-      const current = await cache.kv.get(buildUserTokenKey(userId));
-      if (!current.success)
-        return buildResetTokenRepositoryError("iam_queryResetTokenFailed", current.error.message, current.error);
-      if (current.data !== hashedToken)
-        return err(HaiIamError.RESET_TOKEN_INVALID, iamM("iam_resetTokenInvalid"));
-      const attemptsKey = buildAttemptsKey(userId);
-      const incrResult = await cache.kv.incr(attemptsKey);
-      if (!incrResult.success) {
-        return buildResetTokenRepositoryError(
-          "iam_saveResetTokenFailed",
-          incrResult.error.message,
-          incrResult.error
-        );
-      }
-      const nextAttempts = incrResult.data;
-      if (nextAttempts > maxAttempts) {
-        const clearResult = await clearTokenState(hashedToken, userId);
-        if (!clearResult.success) {
-          return clearResult;
-        }
-        return err(
-          HaiIamError.RESET_TOKEN_MAX_ATTEMPTS,
-          iamM("iam_resetTokenMaxAttempts")
-        );
-      }
-      return ok(userId);
-    },
-    async removeToken(token) {
-      const hashResult = hashResetToken(token);
-      if (!hashResult.success) {
-        return hashResult;
-      }
-      const hashedToken = hashResult.data;
-      const tokenKey = buildResetTokenKey(hashedToken);
-      const result = await cache.kv.get(tokenKey);
-      if (!result.success) {
-        return buildResetTokenRepositoryError(
-          "iam_queryResetTokenFailed",
-          result.error.message,
-          result.error
-        );
-      }
-      if (!result.data) {
-        return ok(void 0);
-      }
-      return clearTokenState(hashedToken, result.data);
-    }
-  };
-  resetTokenRepoInstance = repo;
-  return repo;
-}
-
-// src/user/iam-user-functions.ts
 var logger10 = core.logger.child({ module: "iam", scope: "user" });
 var USER_SORT_COLUMNS = {
   /** 用户名列。 */
@@ -4712,10 +4331,8 @@ async function createUserOperations(deps) {
   try {
     const { config, passwordStrategyResult, sessionFunctions, authzFunctions, onPasswordResetRequest } = deps;
     const userRepository = await createDbUserRepository();
-    const resetTokenRepository = createCacheResetTokenRepository();
     const functions = buildUserFunctions({
       userRepository,
-      resetTokenRepository,
       passwordStrategyResult,
       sessionFunctions,
       authzFunctions,
@@ -5172,14 +4789,14 @@ function buildPasswordChangeOps(ctx) {
       const hashResult = hashPassword(newPassword);
       if (!hashResult.success)
         return hashResult;
-      const updateResult = await userRepository.updateById(userId, {
-        passwordHash: hashResult.data,
-        passwordUpdatedAt: /* @__PURE__ */ new Date()
-      });
-      if (!updateResult.success) {
-        return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
-      }
-      await sessionFunctions.deleteByUserId(userId);
+      const updateResult = await userRepository.setPassword({ userId, expectedVersion: userResult.data.credentialVersion ?? "", passwordHash: hashResult.data });
+      if (!updateResult.success)
+        return updateResult;
+      if (!updateResult.data)
+        return err(HaiIamError.CONFLICT, iamM("iam_securityStateFailed"));
+      const revoked = await sessionFunctions.deleteByUserId(userId);
+      if (!revoked.success)
+        return revoked;
       logger10.info("Admin reset password", { userId });
       return ok(void 0);
     },
@@ -5229,14 +4846,14 @@ function buildPasswordChangeOps(ctx) {
       const hashResult = hashPassword(newPassword);
       if (!hashResult.success)
         return hashResult;
-      const updateResult = await userRepository.updateById(userId, {
-        passwordHash: hashResult.data,
-        passwordUpdatedAt: /* @__PURE__ */ new Date()
-      });
-      if (!updateResult.success) {
-        return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
-      }
-      await sessionFunctions.deleteByUserId(userId);
+      const updateResult = await userRepository.setPassword({ userId, expectedVersion: user.credentialVersion ?? "", passwordHash: hashResult.data });
+      if (!updateResult.success)
+        return updateResult;
+      if (!updateResult.data)
+        return err(HaiIamError.CONFLICT, iamM("iam_securityStateFailed"));
+      const revoked = await sessionFunctions.deleteByUserId(userId);
+      if (!revoked.success)
+        return revoked;
       logger10.info("Password changed", { userId });
       return ok(void 0);
     },
@@ -5258,7 +4875,7 @@ function buildPasswordChangeOps(ctx) {
   };
 }
 function buildPasswordResetOps(ctx) {
-  const { userRepository, resetTokenRepository, sessionFunctions, onPasswordResetRequest } = ctx;
+  const { userRepository, sessionFunctions, onPasswordResetRequest } = ctx;
   const { validatePassword, hashPassword } = ctx;
   return {
     async requestPasswordReset(identifier) {
@@ -5280,15 +4897,19 @@ function buildPasswordResetOps(ctx) {
         return ok(void 0);
       const token = generateToken();
       const expiresAt = new Date(Date.now() + resetConfig.tokenExpiresIn * 1e3);
-      const saveResult = await resetTokenRepository.saveToken(token, user.id, expiresAt);
-      if (!saveResult.success) {
+      const tokenHash = crypto$1.hash.hash(token);
+      if (!tokenHash.success)
+        return tokenHash;
+      const saveResult = await userRepository.publishPasswordReset({ user: userResult.data, tokenHash: tokenHash.data, expiresAt });
+      if (!saveResult.success)
         return saveResult;
-      }
+      if (!saveResult.data)
+        return err(HaiIamError.CONFLICT, iamM("iam_securityStateFailed"));
       try {
-        await onPasswordResetRequest(user, token, expiresAt);
+        await onPasswordResetRequest(user, token, { expiresAt, idempotencyKey: `iam-reset:${tokenHash.data}` });
       } catch {
         logger10.error("Password reset callback failed", { userId: user.id });
-        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_passwordResetDeliveryFailed"));
+        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_notificationDeliveryUnknown"));
       }
       logger10.info("Password reset token generated", { userId: user.id });
       return ok(void 0);
@@ -5298,41 +4919,28 @@ function buildPasswordResetOps(ctx) {
       const resetConfig = ctx.resetConfig;
       if (!resetConfig.enabled)
         return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
-      return resetTokenRepository.useToken(token, resetConfig.maxAttempts, async (userId) => {
-        const validateResult = validatePassword(newPassword);
-        if (!validateResult.success)
-          return validateResult;
-        const userResult = await userRepository.findById(userId);
-        if (!userResult.success) {
-          return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
-        }
-        if (!userResult.data) {
-          return err(
-            HaiIamError.USER_NOT_FOUND,
-            iamM("iam_userNotExist")
-          );
-        }
-        if (!userResult.data.enabled)
-          return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-        const hashResult = hashPassword(newPassword);
-        if (!hashResult.success)
-          return hashResult;
-        const updateResult = await userRepository.updateById(userId, {
-          passwordHash: hashResult.data,
-          passwordUpdatedAt: /* @__PURE__ */ new Date(),
-          loginFailedCount: 0,
-          lockedUntil: null,
-          lastLoginFailedAt: null
-        });
-        if (!updateResult.success) {
-          return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
-        }
-        const revoked = await sessionFunctions.deleteByUserId(userId);
-        if (!revoked.success)
-          return revoked;
-        logger10.info("Password reset confirmed", { userId });
-        return ok(void 0);
-      });
+      const tokenHash = crypto$1.hash.hash(token);
+      if (!tokenHash.success)
+        return tokenHash;
+      const claimed = await userRepository.claimPasswordReset(tokenHash.data, resetConfig.maxAttempts);
+      if (!claimed.success)
+        return claimed;
+      const validateResult = validatePassword(newPassword);
+      if (!validateResult.success)
+        return validateResult;
+      const hashResult = hashPassword(newPassword);
+      if (!hashResult.success)
+        return hashResult;
+      const committed = await userRepository.commitPasswordReset({ user: claimed.data, tokenHash: tokenHash.data, passwordHash: hashResult.data });
+      if (!committed.success)
+        return committed;
+      if (!committed.data)
+        return err(HaiIamError.RESET_TOKEN_INVALID, iamM("iam_resetTokenInvalid"));
+      const revoked = await sessionFunctions.deleteByUserId(claimed.data.id);
+      if (!revoked.success)
+        return revoked;
+      logger10.info("Password reset confirmed", { userId: claimed.data.id });
+      return ok(void 0);
     }
   };
 }
@@ -5434,7 +5042,16 @@ var iam = {
       const parsed = parseResult.data;
       const { onPasswordResetRequest, onOtpSendEmail, onOtpSendSms } = await resolveIamNotifications(config);
       logger11.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
-      const sessionResult = await createSessionOperations({ config: parsed });
+      const credentialUsers = await createDbUserRepository();
+      const sessionResult = await createSessionOperations({
+        config: parsed,
+        readCredential: async (userId) => {
+          const found = await credentialUsers.findById(userId);
+          if (!found.success)
+            return found;
+          return ok(found.data ? { version: found.data.credentialVersion ?? "", enabled: found.data.enabled } : null);
+        }
+      });
       if (!sessionResult.success) {
         return sessionResult;
       }
@@ -5548,13 +5165,12 @@ var iam = {
     resetApiKeyRepoSingleton();
     resetOtpRepoSingleton();
     resetUserRepoSingleton();
-    resetResetTokenRepoSingleton();
     resetRoleRepoSingleton();
     resetPermissionRepoSingleton();
     logger11.info("IAM module closed");
   }
 };
 
-export { AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema, iam };
+export { iam };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map