@h-ai/iam 0.1.0-alpha.72 → 0.1.0-alpha.74

package/dist/index.js

@@ -1,14 +1,21 @@
-import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-VCE74BFW.js';
-export { AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-VCE74BFW.js';
+import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-KPG3M34Q.js';
+export { AccountConfigSchema, AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, CaptchaConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginAccessConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-KPG3M34Q.js';
 import { cache } from '@h-ai/cache';
 import { core, err, ok } from '@h-ai/core';
 import { crypto as crypto$1 } from '@h-ai/crypto';
 import { migrateSchema, reldb, schemaColumns, BaseReldbCrudRepository, HaiReldbError } from '@h-ai/reldb';
-import { createHash, randomBytes } from 'crypto';
+import { createHash, randomBytes, randomInt } from 'crypto';
+import { isIP, BlockList } from 'net';
+import { verifySolution, pbkdf2, createChallenge } from 'altcha/lib';
+import { z } from 'zod';
 import { audit } from '@h-ai/audit';
 
 // messages/en-US.json
 var en_US_default = {
+  iam_invitationDisabled: "Invitations are disabled or a required delivery channel is unavailable.",
+  iam_invitationDeliveryUnknown: "Account created; invitation delivery is unconfirmed. Check delivery before requesting a new reset notification.",
+  iam_reauthenticationRequired: "Verify your password again to continue this operation.",
+  iam_loginAccessDenied: "Sign-in is not allowed from this address or at this time.",
   iam_batchUserIdsInvalid: "Provide at most 1000 non-empty user IDs",
   $schema: "https://inlang.com/schema/inlang-message-format",
   iam_securityStateFailed: "Unable to update authentication security state. Please try again later.",
@@ -196,11 +203,27 @@ var en_US_default = {
   iam_sessionStateFailed: "Shared session state operation failed",
   iam_sessionStateConflict: "Session state changed; retry the operation",
   iam_sessionMaxAgeInvalid: "Invalid session lifetime or timestamp",
-  iam_notificationDeliveryUnknown: "Notification delivery is unknown and may have succeeded; do not resend automatically."
+  iam_sessionLimitExceeded: "The active session limit has been reached. Sign out another session first.",
+  iam_accountPolicyInvalid: "Invalid account type, status, or expiry.",
+  iam_accountUpdateFailed: "Account update failed. Please try again later.",
+  iam_passwordChangeRequired: "Change your initial password before signing in.",
+  iam_passwordMustDiffer: "The new password must differ from the current password.",
+  iam_passwordCharacterClasses: "Use at least {count} character classes in the password.",
+  iam_notificationDeliveryUnknown: "Notification delivery is unknown and may have succeeded; do not resend automatically.",
+  iam_captchaRequired: "Complete the security check first",
+  iam_captchaInvalid: "Security check is invalid or expired; try again",
+  iam_captchaDisabled: "Security challenges are disabled",
+  iam_captchaUnavailable: "Security check is temporarily unavailable",
+  iam_sensitiveOperationsInvalid: "Invalid sensitive operation IDs: use at most 1000 entries of 1\u2013128 characters each.",
+  iam_terminalTypeInvalid: "Invalid terminal type: use web, app, desktop or api."
 };
 
 // messages/ja-JP.json
 var ja_JP_default = {
+  iam_invitationDisabled: "\u62DB\u5F85\u6A5F\u80FD\u304C\u7121\u52B9\u3001\u307E\u305F\u306F\u5FC5\u8981\u306A\u901A\u77E5\u7D4C\u8DEF\u304C\u5229\u7528\u3067\u304D\u307E\u305B\u3093\u3002",
+  iam_invitationDeliveryUnknown: "\u30A2\u30AB\u30A6\u30F3\u30C8\u306F\u4F5C\u6210\u6E08\u307F\u3067\u3059\u304C\u62DB\u5F85\u306E\u914D\u9001\u306F\u672A\u78BA\u8A8D\u3067\u3059\u3002\u914D\u9001\u72B6\u6CC1\u3092\u78BA\u8A8D\u3057\u3066\u304B\u3089\u518D\u8A2D\u5B9A\u901A\u77E5\u3092\u8981\u6C42\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_reauthenticationRequired: "\u3053\u306E\u64CD\u4F5C\u3092\u7D9A\u3051\u308B\u306B\u306F\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u518D\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_loginAccessDenied: "\u3053\u306E\u30A2\u30C9\u30EC\u30B9\u307E\u305F\u306F\u6642\u9593\u5E2F\u304B\u3089\u306E\u30ED\u30B0\u30A4\u30F3\u306F\u8A31\u53EF\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002",
   iam_batchUserIdsInvalid: "\u7A7A\u3067\u306A\u3044\u30E6\u30FC\u30B6\u30FCID\u30921000\u4EF6\u4EE5\u5185\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044",
   $schema: "https://inlang.com/schema/inlang-message-format",
   iam_securityStateFailed: "\u8A8D\u8A3C\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u72B6\u614B\u3092\u66F4\u65B0\u3067\u304D\u307E\u305B\u3093\u3002\u3057\u3070\u3089\u304F\u3057\u3066\u304B\u3089\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
@@ -388,11 +411,27 @@ var ja_JP_default = {
   iam_sessionStateFailed: "\u5171\u6709\u30BB\u30C3\u30B7\u30E7\u30F3\u72B6\u614B\u306E\u64CD\u4F5C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
   iam_sessionStateConflict: "\u30BB\u30C3\u30B7\u30E7\u30F3\u72B6\u614B\u304C\u5909\u66F4\u3055\u308C\u307E\u3057\u305F\u3002\u64CD\u4F5C\u3092\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
   iam_sessionMaxAgeInvalid: "\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u6709\u52B9\u671F\u9593\u307E\u305F\u306F\u30BF\u30A4\u30E0\u30B9\u30BF\u30F3\u30D7\u304C\u7121\u52B9\u3067\u3059",
-  iam_notificationDeliveryUnknown: "\u901A\u77E5\u306E\u914D\u4FE1\u7D50\u679C\u306F\u4E0D\u660E\u3067\u3001\u6210\u529F\u3057\u305F\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002\u81EA\u52D5\u3067\u518D\u9001\u3057\u306A\u3044\u3067\u304F\u3060\u3055\u3044\u3002"
+  iam_sessionLimitExceeded: "\u6709\u52B9\u306A\u30BB\u30C3\u30B7\u30E7\u30F3\u6570\u304C\u4E0A\u9650\u306B\u9054\u3057\u307E\u3057\u305F\u3002\u4ED6\u306E\u30BB\u30C3\u30B7\u30E7\u30F3\u304B\u3089\u30ED\u30B0\u30A2\u30A6\u30C8\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_accountPolicyInvalid: "\u30A2\u30AB\u30A6\u30F3\u30C8\u7A2E\u5225\u3001\u72B6\u614B\u3001\u307E\u305F\u306F\u6709\u52B9\u671F\u9650\u304C\u7121\u52B9\u3067\u3059\u3002",
+  iam_accountUpdateFailed: "\u30A2\u30AB\u30A6\u30F3\u30C8\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u5F8C\u3067\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_passwordChangeRequired: "\u6700\u521D\u306E\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u5909\u66F4\u3057\u3066\u304B\u3089\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_passwordMustDiffer: "\u65B0\u3057\u3044\u30D1\u30B9\u30EF\u30FC\u30C9\u306F\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9\u3068\u7570\u306A\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002",
+  iam_passwordCharacterClasses: "\u30D1\u30B9\u30EF\u30FC\u30C9\u306B\u306F\u5C11\u306A\u304F\u3068\u3082{count}\u7A2E\u985E\u306E\u6587\u5B57\u3092\u542B\u3081\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_notificationDeliveryUnknown: "\u901A\u77E5\u306E\u914D\u4FE1\u7D50\u679C\u306F\u4E0D\u660E\u3067\u3001\u6210\u529F\u3057\u305F\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002\u81EA\u52D5\u3067\u518D\u9001\u3057\u306A\u3044\u3067\u304F\u3060\u3055\u3044\u3002",
+  iam_captchaRequired: "\u5148\u306B\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u3092\u5B8C\u4E86\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_captchaInvalid: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u304C\u7121\u52B9\u307E\u305F\u306F\u671F\u9650\u5207\u308C\u3067\u3059\u3002\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
+  iam_captchaDisabled: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u306F\u7121\u52B9\u3067\u3059",
+  iam_captchaUnavailable: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u3092\u4E00\u6642\u7684\u306B\u5229\u7528\u3067\u304D\u307E\u305B\u3093",
+  iam_sensitiveOperationsInvalid: "\u91CD\u8981\u64CD\u4F5C ID \u306F\u6700\u59271000\u4EF6\u3001\u54041\uFF5E128\u6587\u5B57\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_terminalTypeInvalid: "\u7AEF\u672B\u7A2E\u5225\u306F web\u3001app\u3001desktop\u3001api \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
 };
 
 // messages/zh-CN.json
 var zh_CN_default = {
+  iam_invitationDisabled: "\u9080\u8BF7\u529F\u80FD\u672A\u542F\u7528\uFF0C\u6216\u6240\u9700\u901A\u77E5\u901A\u9053\u672A\u5C31\u7EEA\u3002",
+  iam_invitationDeliveryUnknown: "\u8D26\u53F7\u5DF2\u521B\u5EFA\uFF0C\u9080\u8BF7\u6295\u9012\u5C1A\u672A\u786E\u8BA4\u3002\u8BF7\u6838\u5BF9\u6295\u9012\u540E\u518D\u8BF7\u6C42\u65B0\u7684\u91CD\u7F6E\u901A\u77E5\u3002",
+  iam_reauthenticationRequired: "\u8BF7\u91CD\u65B0\u9A8C\u8BC1\u5BC6\u7801\u540E\u7EE7\u7EED\u6B64\u64CD\u4F5C\u3002",
+  iam_loginAccessDenied: "\u5F53\u524D\u5730\u5740\u6216\u65F6\u6BB5\u4E0D\u5141\u8BB8\u767B\u5F55\u3002",
   iam_batchUserIdsInvalid: "\u8BF7\u63D0\u4F9B\u6700\u591A 1000 \u4E2A\u975E\u7A7A\u7528\u6237 ID",
   $schema: "https://inlang.com/schema/inlang-message-format",
   iam_securityStateFailed: "\u65E0\u6CD5\u66F4\u65B0\u8BA4\u8BC1\u5B89\u5168\u72B6\u6001\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
@@ -580,7 +619,19 @@ var zh_CN_default = {
   iam_sessionStateFailed: "\u4F1A\u8BDD\u5171\u4EAB\u72B6\u6001\u64CD\u4F5C\u5931\u8D25",
   iam_sessionStateConflict: "\u4F1A\u8BDD\u72B6\u6001\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u8BD5",
   iam_sessionMaxAgeInvalid: "\u4F1A\u8BDD\u6709\u6548\u671F\u6216\u65F6\u95F4\u5B57\u6BB5\u65E0\u6548",
-  iam_notificationDeliveryUnknown: "\u901A\u77E5\u53EF\u80FD\u5DF2\u9001\u8FBE\uFF0C\u7ED3\u679C\u672A\u77E5\uFF1B\u8BF7\u52FF\u81EA\u52A8\u91CD\u53D1\u3002"
+  iam_sessionLimitExceeded: "\u6709\u6548\u4F1A\u8BDD\u6570\u91CF\u5DF2\u8FBE\u4E0A\u9650\uFF0C\u8BF7\u5148\u9000\u51FA\u5176\u4ED6\u4F1A\u8BDD",
+  iam_accountPolicyInvalid: "\u8D26\u53F7\u7C7B\u578B\u3001\u72B6\u6001\u6216\u5230\u671F\u65F6\u95F4\u65E0\u6548",
+  iam_accountUpdateFailed: "\u8D26\u53F7\u66F4\u65B0\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  iam_passwordChangeRequired: "\u8BF7\u5148\u66F4\u6362\u521D\u59CB\u5BC6\u7801\u540E\u767B\u5F55",
+  iam_passwordMustDiffer: "\u65B0\u5BC6\u7801\u4E0D\u80FD\u4E0E\u5F53\u524D\u5BC6\u7801\u76F8\u540C",
+  iam_passwordCharacterClasses: "\u5BC6\u7801\u81F3\u5C11\u5E94\u5305\u542B {count} \u7C7B\u5B57\u7B26",
+  iam_notificationDeliveryUnknown: "\u901A\u77E5\u53EF\u80FD\u5DF2\u9001\u8FBE\uFF0C\u7ED3\u679C\u672A\u77E5\uFF1B\u8BF7\u52FF\u81EA\u52A8\u91CD\u53D1\u3002",
+  iam_captchaRequired: "\u8BF7\u5148\u5B8C\u6210\u5B89\u5168\u9A8C\u8BC1",
+  iam_captchaInvalid: "\u5B89\u5168\u9A8C\u8BC1\u65E0\u6548\u6216\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u8BD5",
+  iam_captchaDisabled: "\u5B89\u5168\u9A8C\u8BC1\u672A\u542F\u7528",
+  iam_captchaUnavailable: "\u5B89\u5168\u9A8C\u8BC1\u6682\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  iam_sensitiveOperationsInvalid: "\u654F\u611F\u64CD\u4F5C ID \u5217\u8868\u65E0\u6548\uFF1A\u6700\u591A 1000 \u9879\uFF0C\u6BCF\u9879\u4E3A 1\u2013128 \u5B57\u7B26\u3002",
+  iam_terminalTypeInvalid: "\u7EC8\u7AEF\u7C7B\u578B\u65E0\u6548\uFF0C\u8BF7\u4F7F\u7528 web\u3001app\u3001desktop \u6216 api\u3002"
 };
 
 // src/iam-i18n.ts
@@ -720,8 +771,8 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     }
     return ok(result.data);
   }
-  async findByKeyPrefix(prefix, tx) {
-    const result = await this.findAll({ where: "key_prefix = ?", params: [prefix] }, tx);
+  async findByKeyPrefix(prefix2, tx) {
+    const result = await this.findAll({ where: "key_prefix = ?", params: [prefix2] }, tx);
     if (!result.success) {
       return this.buildQueryError(result.error);
     }
@@ -806,8 +857,140 @@ function buildAgreementDisplay(config, enabled) {
     showOnLogin: config.showOnLogin
   };
 }
+var BASE64_PLUS_REGEX = /\+/g;
+var BASE64_SLASH_REGEX = /\//g;
+var BASE64_TRAILING_PADDING_REGEX = /=+$/;
+function generateToken() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const base64 = btoa(String.fromCharCode(...bytes));
+  return base64.replace(BASE64_PLUS_REGEX, "-").replace(BASE64_SLASH_REGEX, "_").replace(BASE64_TRAILING_PADDING_REGEX, "");
+}
+function getUserSessionScope(userId) {
+  return createHash("sha256").update(userId).digest("hex");
+}
+function generateSessionToken(userId) {
+  return `s1.${getUserSessionScope(userId)}.${generateToken()}`;
+}
+function getTokenSessionScope(token) {
+  return /^s1\.([a-f0-9]{64})\.[\w-]{43}$/.exec(token)?.[1];
+}
+function buildSession(options, now, sessionTtl, accessToken, credentialVersion) {
+  return {
+    version: crypto.randomUUID(),
+    credentialVersion,
+    apiKeyId: options.apiKeyId,
+    apiKeyScopes: options.apiKeyScopes,
+    userId: options.userId,
+    username: options.username,
+    displayName: options.displayName,
+    avatarUrl: options.avatarUrl,
+    roles: options.roles ?? [],
+    permissions: options.permissions ?? [],
+    source: options.source,
+    terminalType: options.terminalType ?? "web",
+    accessToken,
+    createdAt: now,
+    startedAt: now,
+    lastActiveAt: now,
+    expiresAt: new Date(now.getTime() + sessionTtl * 1e3),
+    maxAge: sessionTtl,
+    data: options.data
+  };
+}
+function applySessionPatch(session, patch) {
+  const nextSession = { ...session };
+  if (patch.data !== void 0) {
+    nextSession.data = { ...nextSession.data, ...patch.data };
+  }
+  if (patch.roles !== void 0) {
+    nextSession.roles = patch.roles;
+  }
+  if (patch.permissions !== void 0) {
+    nextSession.permissions = patch.permissions;
+  }
+  if (patch.username !== void 0) {
+    nextSession.username = patch.username;
+  }
+  if (patch.displayName !== void 0) {
+    nextSession.displayName = patch.displayName;
+  }
+  if (patch.avatarUrl !== void 0) {
+    nextSession.avatarUrl = patch.avatarUrl;
+  }
+  if (patch.source !== void 0) {
+    nextSession.source = patch.source;
+  }
+  if (patch.expiresAt !== void 0)
+    nextSession.expiresAt = new Date(patch.expiresAt);
+  nextSession.lastActiveAt = patch.lastActiveAt !== void 0 ? new Date(patch.lastActiveAt) : /* @__PURE__ */ new Date();
+  return nextSession;
+}
+
+// src/ticket/iam-ticket-functions.ts
+var logger = core.logger.child({ module: "iam", scope: "ticket" });
+var TICKET_KEY_PREFIX = "hai:iam:ticket:";
+var DEFAULT_TICKET_TTL_MS = 3e4;
+function buildTicketKey(ticket) {
+  return `${TICKET_KEY_PREFIX}${ticket}`;
+}
+function createTicketOperations() {
+  return {
+    async issue(options) {
+      const ttlMs = options.ttlMs !== void 0 && options.ttlMs > 0 ? options.ttlMs : DEFAULT_TICKET_TTL_MS;
+      const ticket = generateToken();
+      const expiresAt = Date.now() + ttlMs;
+      const record = {
+        subjectId: options.subjectId,
+        purpose: options.purpose,
+        grant: options.grant ?? {},
+        expiresAt
+      };
+      const saved = await cache.kv.set(buildTicketKey(ticket), record, { px: ttlMs, nx: true });
+      if (!saved.success || !saved.data) {
+        logger.warn("Failed to issue ticket", { purpose: options.purpose });
+        return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
+      }
+      return ok({ ticket, expiresAt });
+    },
+    async consume(ticket, options) {
+      if (!ticket) {
+        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
+      }
+      const key = buildTicketKey(ticket);
+      const found = await cache.kv.get(key);
+      if (!found.success) {
+        return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
+      }
+      const record = found.data;
+      if (!record) {
+        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
+      }
+      const removed = await cache.kv.del(key);
+      if (!removed.success || removed.data !== 1) {
+        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
+      }
+      if (record.expiresAt <= Date.now()) {
+        return err(HaiIamError.TICKET_EXPIRED, iamM("iam_ticketExpired"));
+      }
+      if (options?.purpose !== void 0 && options.purpose !== record.purpose) {
+        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
+      }
+      return ok({
+        subjectId: record.subjectId,
+        purpose: record.purpose,
+        grant: record.grant
+      });
+    }
+  };
+}
 var TABLE_NAME2 = "hai_iam_users";
 var USER_FIELDS = [
+  { fieldName: "mustChangePassword", columnName: "must_change_password", def: { type: "BOOLEAN", notNull: true, defaultValue: false }, select: true, create: true, update: false },
+  { fieldName: "accountType", columnName: "account_type", def: { type: "TEXT", notNull: true, defaultValue: "permanent" }, select: true, create: true, update: true },
+  { fieldName: "accountStatus", columnName: "account_status", def: { type: "TEXT", notNull: true, defaultValue: "active" }, select: true, create: true, update: true },
+  { fieldName: "accountExpiresAt", columnName: "account_expires_at", def: { type: "TIMESTAMP" }, select: true, create: true, update: true },
+  { fieldName: "lastLoginAt", columnName: "last_login_at", def: { type: "TIMESTAMP" }, select: true, create: false, update: false },
   { fieldName: "credentialVersion", columnName: "credential_version", def: { type: "TEXT", notNull: true, defaultValue: "" }, select: true, create: false, update: false },
   { fieldName: "resetVersion", columnName: "reset_version", def: { type: "TEXT", notNull: true, defaultValue: "" }, select: true, create: false, update: false },
   { fieldName: "resetHash", columnName: "reset_hash", def: { type: "TEXT" }, select: true, create: false, update: false },
@@ -909,6 +1092,14 @@ var USER_FIELDS = [
     create: true,
     update: true
   },
+  {
+    fieldName: "firstLoginFailedAt",
+    columnName: "first_login_failed_at",
+    def: { type: "TIMESTAMP" },
+    select: true,
+    create: true,
+    update: true
+  },
   {
     fieldName: "lastLoginFailedAt",
     columnName: "last_login_failed_at",
@@ -980,11 +1171,22 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
       return "(UNIX_TIMESTAMP(CURRENT_TIMESTAMP(3)) * 1000)";
     return "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)";
   }
+  async recordSuccessfulLogin(userId) {
+    const result = await reldb.sql.execute(`UPDATE ${TABLE_NAME2} SET last_login_at = ? WHERE id = ?`, [reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), userId]);
+    return result.success ? ok(void 0) : this.buildQueryError(result.error, result.error);
+  }
+  async suspendInactive(cutoff) {
+    const result = await reldb.sql.execute(
+      `UPDATE ${TABLE_NAME2} SET account_status = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL WHERE enabled = ? AND account_status = ? AND COALESCE(last_login_at, created_at) <= ?`,
+      ["dormant", crypto.randomUUID(), crypto.randomUUID(), reldb.config?.type === "postgresql" ? true : 1, "active", reldb.config?.type === "sqlite" ? cutoff.getTime() : cutoff]
+    );
+    return result.success ? ok(result.data.changes) : this.buildQueryError(result.error, result.error);
+  }
   /** 改密推进凭据代际；会话存储清理失败也不能让旧凭据恢复授权。 */
   async setPassword(input) {
     const result = await reldb.sql.execute(
-      `UPDATE ${TABLE_NAME2} SET password_hash = ?, password_updated_at = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL, reset_attempts = 0 WHERE id = ? AND credential_version = ? AND enabled = ?`,
-      [input.passwordHash, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), crypto.randomUUID(), crypto.randomUUID(), input.userId, input.expectedVersion, reldb.config?.type === "postgresql" ? true : 1]
+      `UPDATE ${TABLE_NAME2} SET password_hash = ?, password_updated_at = ?, credential_version = ?, reset_version = ?, must_change_password = ?, reset_hash = NULL, reset_expires_at = NULL, reset_attempts = 0 WHERE id = ? AND credential_version = ? AND enabled = ?`,
+      [input.passwordHash, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), crypto.randomUUID(), crypto.randomUUID(), reldb.config?.type === "postgresql" ? input.mustChangePassword === true : Number(input.mustChangePassword === true), input.userId, input.expectedVersion, reldb.config?.type === "postgresql" ? true : 1]
     );
     return result.success ? ok(result.data.changes === 1) : this.buildQueryError(result.error, result.error);
   }
@@ -1025,17 +1227,22 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
   /** 密码与令牌消费同一行原子提交，禁止先消费 Redis 凭据再无条件写数据库。 */
   async commitPasswordReset(input) {
     const result = await reldb.sql.execute(
-      `UPDATE ${TABLE_NAME2} SET password_hash = ?, password_updated_at = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL, reset_attempts = 0, login_failed_count = 0, locked_until = NULL, last_login_failed_at = NULL WHERE id = ? AND reset_hash = ? AND reset_version = ? AND credential_version = ? AND reset_expires_at > ${this.databaseNow()} AND enabled = ?`,
+      `UPDATE ${TABLE_NAME2} SET password_hash = ?, password_updated_at = ?, credential_version = ?, reset_version = ?, must_change_password = FALSE, reset_hash = NULL, reset_expires_at = NULL, reset_attempts = 0, login_failed_count = 0, first_login_failed_at = NULL, locked_until = NULL, last_login_failed_at = NULL WHERE id = ? AND reset_hash = ? AND reset_version = ? AND credential_version = ? AND reset_expires_at > ${this.databaseNow()} AND enabled = ?`,
       [input.passwordHash, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), crypto.randomUUID(), crypto.randomUUID(), input.user.id, input.tokenHash, input.user.resetVersion ?? "", input.user.credentialVersion ?? "", reldb.config?.type === "postgresql" ? true : 1]
     );
     return result.success ? ok(result.data.changes === 1) : this.buildQueryError(result.error, result.error);
   }
   async recordLoginFailure(userId, policy) {
+    if (policy.lockoutEnabled === false)
+      return ok(void 0);
     const sqlite = reldb.config?.type === "sqlite";
-    const now = sqlite ? Date.now() : /* @__PURE__ */ new Date();
-    const deadline = Date.now() + policy.lockoutDuration * 1e3;
+    const timestamp = Date.now();
+    const now = sqlite ? timestamp : new Date(timestamp);
+    const cutoff = timestamp - (policy.failureWindow ?? 86400) * 1e3;
+    const windowStart = sqlite ? cutoff : new Date(cutoff);
+    const deadline = timestamp + policy.lockoutDuration * 1e3;
     const lockedUntil = sqlite ? deadline : new Date(deadline);
-    const expired = await reldb.sql.execute(`UPDATE ${TABLE_NAME2} SET login_failed_count = 0, locked_until = NULL, last_login_failed_at = NULL WHERE id = ? AND locked_until <= ?`, [userId, now]);
+    const expired = await reldb.sql.execute(`UPDATE ${TABLE_NAME2} SET login_failed_count = 0, locked_until = NULL, first_login_failed_at = ?, last_login_failed_at = NULL WHERE id = ? AND (locked_until <= ? OR (locked_until IS NULL AND (first_login_failed_at IS NULL OR first_login_failed_at <= ?)))`, [now, userId, now, windowStart]);
     if (!expired.success)
       return this.buildQueryError(expired.error, expired.error);
     const result = await reldb.sql.execute(
@@ -1046,10 +1253,13 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
       return this.buildQueryError(result.error, result.error);
     return ok(void 0);
   }
-  async resetLoginFailures(userId, expectedCredentialVersion) {
+  async resetLoginFailures(userId, expectedCredentialVersion, lockoutEnabled = true) {
+    const params = [userId, expectedCredentialVersion, reldb.config?.type === "postgresql" ? true : 1];
+    if (lockoutEnabled)
+      params.push(reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date());
     const result = await reldb.sql.execute(
-      `UPDATE ${TABLE_NAME2} SET login_failed_count = 0, last_login_failed_at = NULL, locked_until = NULL WHERE id = ? AND credential_version = ? AND enabled = ? AND (locked_until IS NULL OR locked_until <= ?)`,
-      [userId, expectedCredentialVersion, reldb.config?.type === "postgresql" ? true : 1, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date()]
+      `UPDATE ${TABLE_NAME2} SET login_failed_count = 0, first_login_failed_at = NULL, last_login_failed_at = NULL, locked_until = NULL WHERE id = ? AND credential_version = ? AND enabled = ? ${lockoutEnabled ? "AND (locked_until IS NULL OR locked_until <= ?)" : ""}`,
+      params
     );
     if (!result.success)
       return this.buildQueryError(result.error, result.error);
@@ -1061,7 +1271,7 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       if ((user.data.credentialVersion ?? "") !== expectedCredentialVersion)
         return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
-      if (user.data.lockedUntil && user.data.lockedUntil > /* @__PURE__ */ new Date())
+      if (lockoutEnabled && user.data.lockedUntil && user.data.lockedUntil > /* @__PURE__ */ new Date())
         return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
     }
     return ok(void 0);
@@ -1134,25 +1344,23 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
     return ok(result.data[0] ?? null);
   }
 };
-
-// src/authn/apikey/iam-authn-apikey-scope.ts
-function covers(grant, permission) {
-  return grant === "*" || grant === permission || grant.endsWith(":*") && permission.startsWith(grant.slice(0, -1));
+function checkPasswordState(user, policy) {
+  if (policy?.requireInitialChange && user.mustChangePassword)
+    return err(HaiIamError.PASSWORD_CHANGE_REQUIRED, iamM("iam_passwordChangeRequired"));
+  const days = policy?.expirationDays ?? 0;
+  if (days > 0 && user.passwordHash && (!user.passwordUpdatedAt || user.passwordUpdatedAt.getTime() + days * 864e5 <= Date.now()))
+    return err(HaiIamError.PASSWORD_EXPIRED, iamM("iam_passwordExpired"));
+  return ok(void 0);
 }
-function applyApiKeyScopes(access, scopes) {
-  const permissions = /* @__PURE__ */ new Set();
-  for (const permission of access.permissions) {
-    for (const scope of scopes) {
-      if (covers(permission, scope))
-        permissions.add(scope);
-      else if (covers(scope, permission))
-        permissions.add(permission);
-    }
+function isUserActive(user) {
+  return user.enabled && (user.accountStatus ?? "active") === "active" && (user.accountType !== "temporary" || !!user.accountExpiresAt) && (!user.accountExpiresAt || new Date(user.accountExpiresAt).getTime() > Date.now());
+}
+function validateAccountPolicy(user) {
+  if (user.accountType !== void 0 && !["permanent", "temporary"].includes(user.accountType) || user.accountStatus !== void 0 && !["active", "dormant", "closed"].includes(user.accountStatus) || user.accountExpiresAt != null && (!(user.accountExpiresAt instanceof Date) || !Number.isFinite(user.accountExpiresAt.getTime())) || user.accountType === "temporary" && !user.accountExpiresAt) {
+    return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_accountPolicyInvalid"));
   }
-  return { ...access, roles: scopes.includes("*") ? access.roles : [], permissions: [...permissions] };
+  return ok(void 0);
 }
-
-// src/user/iam-user-utils.ts
 function toUser(storedUser) {
   return {
     id: storedUser.id,
@@ -1162,6 +1370,11 @@ function toUser(storedUser) {
     displayName: storedUser.displayName,
     avatarUrl: storedUser.avatarUrl,
     enabled: storedUser.enabled,
+    accountType: storedUser.accountType ?? "permanent",
+    accountStatus: storedUser.accountStatus ?? "active",
+    accountExpiresAt: storedUser.accountExpiresAt ?? null,
+    lastLoginAt: storedUser.lastLoginAt ?? null,
+    mustChangePassword: storedUser.mustChangePassword ?? false,
     emailVerified: storedUser.emailVerified,
     phoneVerified: storedUser.phoneVerified,
     createdAt: storedUser.createdAt,
@@ -1169,6 +1382,23 @@ function toUser(storedUser) {
     metadata: storedUser.metadata
   };
 }
+
+// src/authn/apikey/iam-authn-apikey-scope.ts
+function covers(grant, permission) {
+  return grant === "*" || grant === permission || grant.endsWith(":*") && permission.startsWith(grant.slice(0, -1));
+}
+function applyApiKeyScopes(access, scopes) {
+  const permissions = /* @__PURE__ */ new Set();
+  for (const permission of access.permissions) {
+    for (const scope of scopes) {
+      if (covers(permission, scope))
+        permissions.add(scope);
+      else if (covers(scope, permission))
+        permissions.add(permission);
+    }
+  }
+  return { ...access, roles: scopes.includes("*") ? access.roles : [], permissions: [...permissions] };
+}
 function ensureCredentialType(credentials, type) {
   if (credentials.type !== type) {
     return err(
@@ -1178,8 +1408,8 @@ function ensureCredentialType(credentials, type) {
   }
   return ok(credentials);
 }
-function isAccountLocked(user) {
-  if (!user.lockedUntil) {
+function isAccountLocked(user, policy) {
+  if (policy?.lockoutEnabled === false || !user.lockedUntil) {
     return false;
   }
   return /* @__PURE__ */ new Date() < user.lockedUntil;
@@ -1187,16 +1417,16 @@ function isAccountLocked(user) {
 async function recordLoginFailure(userRepository, user, policy) {
   return userRepository.recordLoginFailure(user.id, policy);
 }
-async function resetLoginFailures(userRepository, user) {
-  return userRepository.resetLoginFailures(user.id, user.credentialVersion ?? "");
+async function resetLoginFailures(userRepository, user, policy) {
+  return userRepository.resetLoginFailures(user.id, user.credentialVersion ?? "", policy?.lockoutEnabled);
 }
 
 // src/authn/apikey/iam-authn-apikey-strategy.ts
-var logger = core.logger.child({ module: "iam", scope: "apikey-strategy" });
+var logger2 = core.logger.child({ module: "iam", scope: "apikey-strategy" });
 var KEY_PREFIX_LENGTH = 12;
-function generateRawKey(prefix) {
+function generateRawKey(prefix2) {
   const hex = randomBytes(32).toString("hex");
-  return `${prefix}${hex}`;
+  return `${prefix2}${hex}`;
 }
 function extractKeyPrefix(rawKey) {
   return rawKey.slice(0, KEY_PREFIX_LENGTH);
@@ -1219,8 +1449,8 @@ function createApiKeyStrategy(config) {
   const { userRepository, apiKeyRepository } = config;
   const passwordOps = crypto$1.password;
   async function verifyRawKey(rawKey) {
-    const prefix = extractKeyPrefix(rawKey);
-    const candidatesResult = await apiKeyRepository.findByKeyPrefix(prefix);
+    const prefix2 = extractKeyPrefix(rawKey);
+    const candidatesResult = await apiKeyRepository.findByKeyPrefix(prefix2);
     if (!candidatesResult.success) {
       return candidatesResult;
     }
@@ -1237,7 +1467,7 @@ function createApiKeyStrategy(config) {
         return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
       }
       apiKeyRepository.updateFields(candidate.id, { lastUsedAt: /* @__PURE__ */ new Date() }).catch(() => {
-        logger.warn("Failed to update API Key lastUsedAt", { keyId: candidate.id });
+        logger2.warn("Failed to update API Key lastUsedAt", { keyId: candidate.id });
       });
       return ok(toApiKey(candidate));
     }
@@ -1264,10 +1494,10 @@ function createApiKeyStrategy(config) {
       if (!userResult.data) {
         return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
       }
-      if (!userResult.data.enabled) {
+      if (!isUserActive(userResult.data)) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       }
-      logger.info("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
+      logger2.debug("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
       return ok({ user: { ...toUser(userResult.data), credentialVersion: userResult.data.credentialVersion ?? "" }, apiKey });
     }
   };
@@ -1304,7 +1534,7 @@ function createApiKeyStrategy(config) {
         const insertResult = await apiKeyRepository.insert(storedApiKey);
         if (!insertResult.success)
           return insertResult;
-        logger.info("API Key created", { userId, keyId: id, name: options.name });
+        logger2.info("API Key created", { userId, keyId: id, name: options.name });
         return ok({ apiKey: toApiKey(storedApiKey), rawKey });
       } catch (error) {
         return err(HaiIamError.INTERNAL_ERROR, iamM("iam_apikeyCreateFailed", { params: { message: String(error) } }), error);
@@ -1326,7 +1556,7 @@ function createApiKeyStrategy(config) {
       const result = await apiKeyRepository.removeById(keyId);
       if (!result.success)
         return result;
-      logger.info("API Key revoked", { keyId });
+      logger2.info("API Key revoked", { keyId });
       return ok(void 0);
     },
     async verifyApiKey(rawKey) {
@@ -1335,6 +1565,120 @@ function createApiKeyStrategy(config) {
   };
   return { strategy, apiKeyFunctions };
 }
+function addresses(entries) {
+  const list = new BlockList();
+  for (const entry of entries) {
+    const [address, prefix2] = entry.split("/");
+    const family = isIP(address) === 4 ? "ipv4" : "ipv6";
+    if (prefix2 === void 0)
+      list.addAddress(address, family);
+    else
+      list.addSubnet(address, Number(prefix2), family);
+  }
+  return list;
+}
+function createLoginAccessCheck(policy) {
+  if (!policy?.enabled)
+    return () => ok(void 0);
+  const allow = addresses(policy.allowIps);
+  const deny = addresses(policy.denyIps);
+  const format = new Intl.DateTimeFormat("en-US", { timeZone: policy.timezone, weekday: "short", hour: "2-digit", minute: "2-digit", hourCycle: "h23" });
+  const weekdays = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"];
+  return (context) => {
+    const rejected = () => err(HaiIamError.LOGIN_ACCESS_DENIED, iamM("iam_loginAccessDenied"));
+    if (policy.allowIps.length || policy.denyIps.length) {
+      const raw = context?.ip?.trim();
+      const ip = raw?.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i)?.[1] ?? raw;
+      if (!ip || !isIP(ip))
+        return rejected();
+      const family = isIP(ip) === 4 ? "ipv4" : "ipv6";
+      if (deny.check(ip, family) || policy.allowIps.length && !allow.check(ip, family))
+        return rejected();
+    }
+    if (policy.windows.length) {
+      const parts = Object.fromEntries(format.formatToParts(/* @__PURE__ */ new Date()).map((part) => [part.type, part.value]));
+      const day = weekdays.indexOf(parts.weekday) + 1;
+      const previousDay = day === 1 ? 7 : day - 1;
+      const time = `${parts.hour}:${parts.minute}`;
+      const permitted = policy.windows.some((window) => window.start < window.end ? window.days.includes(day) && time >= window.start && time < window.end : window.days.includes(day) && time >= window.start || window.days.includes(previousDay) && time < window.end);
+      if (!permitted)
+        return rejected();
+    }
+    return ok(void 0);
+  };
+}
+var logger3 = core.logger.child({ module: "iam", scope: "captcha" });
+var prefix = "hai:iam:captcha:";
+var operationSchema = z.enum(["login", "register", "sendOtp", "passwordReset", "renewPassword"]);
+var proofSchema = z.object({
+  id: z.string().regex(/^[a-f0-9]{64}$/),
+  solution: z.object({ counter: z.number().int().min(0).max(2e3), derivedKey: z.string().regex(/^[a-f0-9]{64}$/i), time: z.number().finite().nonnegative().optional() })
+});
+async function createIamCaptcha(config, input) {
+  if (!config.enabled)
+    return err(HaiIamError.CAPTCHA_DISABLED, iamM("iam_captchaDisabled"));
+  const operation = operationSchema.safeParse(input?.operation);
+  if (!operation.success)
+    return err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
+  try {
+    const id = randomBytes(32).toString("hex");
+    const signatureSecret = randomBytes(32).toString("hex");
+    const keySecret = randomBytes(32).toString("hex");
+    const challenge = await createChallenge({
+      algorithm: "PBKDF2/SHA-256",
+      cost: config.cost,
+      counter: randomInt(1, config.maxCounter + 1),
+      deriveKey: pbkdf2.deriveKey,
+      hmacSignatureSecret: signatureSecret,
+      hmacKeySignatureSecret: keySecret,
+      data: { operation: operation.data }
+    });
+    const record = { operation: operation.data, challenge, signatureSecret, keySecret };
+    const saved = await cache.kv.set(`${prefix}${id}`, record, { nx: true, ex: config.ttlSeconds });
+    if (!saved.success || !saved.data)
+      return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
+    return ok({ id, challenge });
+  } catch (error) {
+    logger3.error("Captcha challenge generation failed", { operation: operation.data, error });
+    return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
+  }
+}
+async function verifyIamCaptcha(config, operation, proof) {
+  if (!config.enabled)
+    return ok(void 0);
+  if (!proof)
+    return err(HaiIamError.CAPTCHA_REQUIRED, iamM("iam_captchaRequired"));
+  if (typeof proof !== "string" || proof.length > 4096)
+    return err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
+  let payload;
+  try {
+    const parsed = proofSchema.safeParse(JSON.parse(proof));
+    if (!parsed.success)
+      return err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
+    payload = parsed.data;
+  } catch {
+    return err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
+  }
+  try {
+    const key = `${prefix}${payload.id}`;
+    const found = await cache.kv.get(key);
+    if (!found.success)
+      return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
+    if (!found.data || found.data.operation !== operation)
+      return err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
+    const record = found.data;
+    const result = await verifySolution({ challenge: record.challenge, solution: payload.solution, deriveKey: pbkdf2.deriveKey, hmacSignatureSecret: record.signatureSecret, hmacKeySignatureSecret: record.keySecret });
+    if (!result.verified)
+      return err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
+    const removed = await cache.kv.del(key);
+    if (!removed.success)
+      return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
+    return removed.data === 1 ? ok(void 0) : err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
+  } catch (error) {
+    logger3.error("Captcha verification failed", { operation, error });
+    return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
+  }
+}
 async function loadLdapClientFactory() {
   const { Client } = await import('ldapts');
   return async (config) => {
@@ -1389,7 +1733,7 @@ async function loadLdapClientFactory() {
     }
   };
 }
-var logger2 = core.logger.child({ module: "iam", scope: "ldap-strategy" });
+var logger4 = core.logger.child({ module: "iam", scope: "ldap-strategy" });
 function escapeLdapFilterValue(value) {
   return value.replace(/[\\*()/\0]/g, (ch) => {
     const hex = ch.charCodeAt(0).toString(16).padStart(2, "0");
@@ -1405,6 +1749,7 @@ function createLdapStrategy(config) {
     maxLoginAttempts = 5,
     lockoutDuration = 900
   } = config;
+  const failurePolicy = { maxLoginAttempts, lockoutDuration, lockoutEnabled: config.lockoutEnabled ?? true, failureWindow: config.failureWindow ?? 86400 };
   function getAttributeValue(entry, attr) {
     const value = entry.attributes[attr];
     if (Array.isArray(value)) {
@@ -1471,13 +1816,13 @@ function createLdapStrategy(config) {
         }
         let storedUser = localUserResult.data;
         if (storedUser) {
-          if (!storedUser.enabled) {
+          if (!isUserActive(storedUser)) {
             return err(
               HaiIamError.USER_DISABLED,
               iamM("iam_accountDisabled")
             );
           }
-          if (isAccountLocked(storedUser)) {
+          if (isAccountLocked(storedUser, failurePolicy)) {
             return err(
               HaiIamError.USER_LOCKED,
               iamM("iam_accountLocked")
@@ -1487,11 +1832,11 @@ function createLdapStrategy(config) {
         const userBindResult = await client.bind(entry.dn, password);
         if (!userBindResult.success) {
           if (storedUser) {
-            const failureResult = await recordLoginFailure(userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+            const failureResult = await recordLoginFailure(userRepository, storedUser, failurePolicy);
             if (!failureResult.success)
               return failureResult;
           }
-          logger2.warn("LDAP authentication failed", { username });
+          logger4.warn("LDAP authentication failed", { username });
           return err(
             HaiIamError.INVALID_CREDENTIALS,
             iamM("iam_passwordWrong")
@@ -1529,7 +1874,7 @@ function createLdapStrategy(config) {
                 return assigned;
               }
             } catch (callbackError) {
-              logger2.warn("onUserAutoRegistered callback failed", { userId: storedUser?.id, error: callbackError });
+              logger4.warn("onUserAutoRegistered callback failed", { userId: storedUser?.id, error: callbackError });
             }
           }
         } else if (storedUser && syncUser) {
@@ -1551,10 +1896,10 @@ function createLdapStrategy(config) {
         }
         if (!storedUser)
           return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
-        const resetResult = await resetLoginFailures(userRepository, storedUser);
+        const resetResult = await resetLoginFailures(userRepository, storedUser, failurePolicy);
         if (!resetResult.success)
           return resetResult;
-        logger2.info("LDAP authentication succeeded", { userId: storedUser.id });
+        logger4.debug("LDAP authentication succeeded", { userId: storedUser.id });
         return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
       } finally {
         await client.unbind();
@@ -1632,7 +1977,7 @@ function createCacheOtpRepository() {
   };
   return otpRepoInstance;
 }
-var logger3 = core.logger.child({ module: "iam", scope: "otp-strategy" });
+var logger5 = core.logger.child({ module: "iam", scope: "otp-strategy" });
 var PHONE_IDENTIFIER_REGEX = /^\+?\d{8,}$/;
 var PHONE_SEPARATOR_REGEX = /[\s-]/g;
 function generateOtpCode(length) {
@@ -1662,6 +2007,7 @@ function createOtpStrategy(config) {
   const otpConfig = config.otpConfig ? OtpConfigSchema.parse(config.otpConfig) : OtpConfigSchema.parse({});
   const maxLoginAttempts = config.maxLoginAttempts ?? 5;
   const lockoutDuration = config.lockoutDuration ?? 900;
+  const failurePolicy = { maxLoginAttempts, lockoutDuration, lockoutEnabled: config.lockoutEnabled ?? true, failureWindow: config.failureWindow ?? 86400 };
   const registerConfig = config.registerConfig;
   const allowAutoRegister = registerConfig?.enabled ?? config.autoRegister ?? false;
   const defaultEnabled = registerConfig?.defaultEnabled ?? true;
@@ -1683,17 +2029,17 @@ function createOtpStrategy(config) {
       }
       let storedUser = userResult.data;
       if (storedUser) {
-        if (!storedUser.enabled) {
+        if (!isUserActive(storedUser)) {
           return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
         }
-        if (isAccountLocked(storedUser)) {
+        if (isAccountLocked(storedUser, failurePolicy)) {
           return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
         }
       }
       const consumed = await config.otpRepository.consumeOtp(identifier, code, otpConfig.maxAttempts);
       if (!consumed.success) {
         if (storedUser && consumed.error.code === HaiIamError.OTP_INVALID.code) {
-          const failed = await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+          const failed = await recordLoginFailure(config.userRepository, storedUser, failurePolicy);
           if (!failed.success)
             return failed;
         }
@@ -1729,19 +2075,19 @@ function createOtpStrategy(config) {
               return assigned;
             }
           } catch (callbackError) {
-            logger3.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
+            logger5.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
           }
         }
       }
       if (!storedUser) {
         return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
       }
-      if (!storedUser.enabled)
+      if (!isUserActive(storedUser))
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-      const resetResult = await resetLoginFailures(config.userRepository, storedUser);
+      const resetResult = await resetLoginFailures(config.userRepository, storedUser, failurePolicy);
       if (!resetResult.success)
         return resetResult;
-      logger3.info("OTP authentication succeeded", { userId: storedUser.id });
+      logger5.debug("OTP authentication succeeded", { userId: storedUser.id });
       return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
@@ -1785,12 +2131,12 @@ function createOtpStrategy(config) {
       );
     }
     const result = { expiresAt };
-    logger3.debug("OTP challenge sent", { identifier, expiresAt });
+    logger5.debug("OTP challenge sent", { identifier, expiresAt });
     return ok(result);
   }
   return { strategy, challenge };
 }
-var logger4 = core.logger.child({ module: "iam", scope: "password-strategy" });
+var logger6 = core.logger.child({ module: "iam", scope: "password-strategy" });
 var PASSWORD_UPPERCASE_REGEX = /[A-Z]/;
 var PASSWORD_LOWERCASE_REGEX = /[a-z]/;
 var PASSWORD_DIGIT_REGEX = /\d/;
@@ -1799,6 +2145,7 @@ function createPasswordStrategy(config) {
   const passwordConfig = config.passwordConfig ? PasswordConfigSchema.parse(config.passwordConfig) : PasswordConfigSchema.parse({});
   const maxLoginAttempts = config.maxLoginAttempts ?? 5;
   const lockoutDuration = config.lockoutDuration ?? 900;
+  const failurePolicy = { maxLoginAttempts, lockoutDuration, lockoutEnabled: config.lockoutEnabled ?? true, failureWindow: config.failureWindow ?? 86400 };
   const passwordOps = crypto$1.password;
   function mapPasswordError(message) {
     return err(
@@ -1843,21 +2190,16 @@ function createPasswordStrategy(config) {
         iamM("iam_passwordNeedSpecialChar")
       );
     }
+    const classes = [PASSWORD_UPPERCASE_REGEX, PASSWORD_LOWERCASE_REGEX, PASSWORD_DIGIT_REGEX, PASSWORD_SPECIAL_CHAR_REGEX].filter((pattern) => pattern.test(password)).length;
+    if (classes < passwordConfig.minCharacterClasses)
+      return err(HaiIamError.PASSWORD_POLICY_VIOLATION, iamM("iam_passwordCharacterClasses", { params: { count: passwordConfig.minCharacterClasses } }));
     return ok(void 0);
   }
-  function isPasswordExpired(user) {
-    if (passwordConfig.expirationDays <= 0 || !user.passwordUpdatedAt) {
-      return false;
-    }
-    const expirationDate = new Date(user.passwordUpdatedAt);
-    expirationDate.setDate(expirationDate.getDate() + passwordConfig.expirationDays);
-    return /* @__PURE__ */ new Date() > expirationDate;
-  }
   function checkAccountStatus(user) {
-    if (!user.enabled) {
+    if (!isUserActive(user)) {
       return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
     }
-    if (isAccountLocked(user)) {
+    if (isAccountLocked(user, failurePolicy)) {
       return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
     }
     return ok(void 0);
@@ -1871,10 +2213,10 @@ function createPasswordStrategy(config) {
       return mapPasswordError(verifyResult.error.message);
     }
     if (!verifyResult.data) {
-      const failureResult = await recordLoginFailure(config.userRepository, user, { maxLoginAttempts, lockoutDuration });
+      const failureResult = await recordLoginFailure(config.userRepository, user, failurePolicy);
       if (!failureResult.success)
         return failureResult;
-      logger4.warn("Password verification failed", { userId: user.id });
+      logger6.warn("Password verification failed", { userId: user.id });
       return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
     }
     return ok(void 0);
@@ -1902,13 +2244,13 @@ function createPasswordStrategy(config) {
       const pwResult = await verifyUserPassword(storedUser, password);
       if (!pwResult.success)
         return pwResult;
-      if (isPasswordExpired(storedUser)) {
-        return err(HaiIamError.PASSWORD_EXPIRED, iamM("iam_passwordExpired"));
-      }
-      const resetResult = await resetLoginFailures(config.userRepository, storedUser);
+      const passwordState = checkPasswordState(storedUser, passwordConfig);
+      if (!passwordState.success)
+        return passwordState;
+      const resetResult = await resetLoginFailures(config.userRepository, storedUser, failurePolicy);
       if (!resetResult.success)
         return resetResult;
-      logger4.info("Password authentication succeeded", { userId: storedUser.id });
+      logger6.debug("Password authentication succeeded", { userId: storedUser.id });
       return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
@@ -1928,7 +2270,7 @@ function createPasswordStrategy(config) {
 }
 
 // src/authn/iam-authn-functions.ts
-var logger5 = core.logger.child({ module: "iam", scope: "authn" });
+var logger7 = core.logger.child({ module: "iam", scope: "authn" });
 async function createAuthnOperations(deps) {
   try {
     const { config, sessionFunctions, authzFunctions, ldapClientFactory, ldapSyncUser, onOtpSendEmail, onOtpSendSms } = deps;
@@ -1949,6 +2291,8 @@ async function createAuthnOperations(deps) {
       passwordConfig: config.password,
       userRepository,
       maxLoginAttempts: securityConfig.maxLoginAttempts,
+      lockoutEnabled: securityConfig.lockoutEnabled,
+      failureWindow: securityConfig.failureWindow,
       lockoutDuration: securityConfig.lockoutDuration
     });
     let otpResult;
@@ -1962,6 +2306,8 @@ async function createAuthnOperations(deps) {
         autoRegister: true,
         registerConfig: config.register,
         maxLoginAttempts: securityConfig.maxLoginAttempts,
+        lockoutEnabled: securityConfig.lockoutEnabled,
+        failureWindow: securityConfig.failureWindow,
         lockoutDuration: securityConfig.lockoutDuration,
         onUserAutoRegistered,
         onOtpSendEmail,
@@ -1978,6 +2324,8 @@ async function createAuthnOperations(deps) {
         syncUser: ldapSyncUser ?? true,
         defaultEnabled: config.register.defaultEnabled,
         maxLoginAttempts: securityConfig.maxLoginAttempts,
+        lockoutEnabled: securityConfig.lockoutEnabled,
+        failureWindow: securityConfig.failureWindow,
         lockoutDuration: securityConfig.lockoutDuration,
         onUserAutoRegistered
       });
@@ -2006,10 +2354,10 @@ async function createAuthnOperations(deps) {
       userRepository,
       config
     });
-    logger5.info("Authn sub-feature initialized");
+    logger7.info("Authn sub-feature initialized");
     return ok({ authn: operations.authn, loginRegisteredUser: operations.loginRegisteredUser, passwordStrategyResult: passwordResult, apiKeyFunctions });
   } catch (error) {
-    logger5.error("Authn sub-feature initialization failed", { error });
+    logger7.error("Authn sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -2031,6 +2379,7 @@ function buildAuthnOperations(deps) {
   } = deps;
   const loginConfig = LoginConfigSchema.parse(config.login ?? {});
   const agreementConfig = AgreementConfigSchema.parse(config.agreements ?? {});
+  const checkAccess = createLoginAccessCheck(config.loginAccess);
   function loginDisabled(type) {
     if (!loginConfig[type]) {
       return err(
@@ -2061,9 +2410,20 @@ function buildAuthnOperations(deps) {
       iamM("iam_featureNotImplemented")
     );
   }
-  async function buildAuthResult(user, apiKey) {
-    if (!user.enabled)
+  async function buildAuthResult(user, apiKey, context) {
+    const permitted = checkAccess(context);
+    if (!permitted.success)
+      return permitted;
+    if (!isUserActive(user))
+      return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+    const stored = await userRepository.findById(user.id);
+    if (!stored.success)
+      return stored;
+    if (!stored.data || !isUserActive(stored.data))
       return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+    const passwordState = checkPasswordState(stored.data, config.password);
+    if (!passwordState.success)
+      return passwordState;
     const authorization = await authzFunctions.getUserAuthorization(user.id);
     if (!authorization.success)
       return authorization;
@@ -2077,7 +2437,8 @@ function buildAuthnOperations(deps) {
       avatarUrl: user.avatarUrl,
       ...effective,
       apiKeyId: apiKey?.id,
-      apiKeyScopes: apiKey?.scopes
+      apiKeyScopes: apiKey?.scopes,
+      terminalType: context?.terminalType ?? (apiKey ? "api" : "web")
     });
     if (!sessionResult.success) {
       return sessionResult;
@@ -2087,6 +2448,13 @@ function buildAuthnOperations(deps) {
     if (!tokenPair) {
       return err(HaiIamError.SESSION_CREATE_FAILED, iamM("iam_createSessionFailed"));
     }
+    const recorded = await userRepository.recordSuccessfulLogin(user.id);
+    if (!recorded.success) {
+      const revoked = await sessionFunctions.delete(session.accessToken);
+      if (!revoked.success)
+        logger7.error("Failed to revoke session after login timestamp write failure", { userId: user.id, error: revoked.error });
+      return recorded;
+    }
     const { credentialVersion, ...publicUser } = user;
     return ok({
       user: publicUser,
@@ -2095,7 +2463,13 @@ function buildAuthnOperations(deps) {
       agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnLogin)
     });
   }
-  async function loginWithStrategy(type, credentials, strategy) {
+  async function loginWithStrategy(type, credentials, strategy, context) {
+    const captcha = await verifyIamCaptcha(config.captcha, "login", credentials.captcha);
+    if (!captcha.success)
+      return captcha;
+    const permitted = checkAccess(context);
+    if (!permitted.success)
+      return permitted;
     const disabled = loginDisabled(type);
     if (disabled)
       return disabled;
@@ -2107,33 +2481,104 @@ function buildAuthnOperations(deps) {
       ...credentials
     });
     if (!authResult.success) {
-      logger5.warn("Login failed", { type, reason: authResult.error.code });
+      logger7.warn("Login failed", { type, reason: authResult.error.code });
       return authResult;
     }
-    const result = await buildAuthResult(authResult.data);
+    if (credentials.expectedUserId && credentials.expectedUserId !== authResult.data.id)
+      return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
+    const result = await buildAuthResult(authResult.data, void 0, context);
     if (result.success) {
-      logger5.info("Login succeeded", { type, userId: authResult.data.id });
+      logger7.info("Login succeeded", { type, userId: authResult.data.id });
     }
     return result;
   }
-  return { loginRegisteredUser: async (user) => {
+  async function verifyCurrentSession(accessToken) {
+    const session = await sessionFunctions.verifyToken(accessToken);
+    if (!session.success)
+      return session;
+    const [user, authorization] = await Promise.all([
+      userRepository.findById(session.data.userId),
+      authzFunctions.getUserAuthorization(session.data.userId)
+    ]);
+    if (!user.success)
+      return user;
+    if (!user.data?.enabled)
+      return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+    if (session.data.credentialVersion !== (user.data.credentialVersion ?? ""))
+      return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
+    if (!authorization.success)
+      return authorization;
+    const current = { ...session.data, username: user.data.username, displayName: user.data.displayName, avatarUrl: user.data.avatarUrl, ...authorization.data };
+    return ok(current.apiKeyId ? applyApiKeyScopes(current, current.apiKeyScopes ?? []) : current);
+  }
+  const tickets = createTicketOperations();
+  const sensitive = config.reauthentication;
+  async function requiresProof(operation) {
+    if (!sensitive?.enabled)
+      return ok(false);
+    const configured = await authzFunctions.getSensitiveOperations();
+    if (!configured.success)
+      return configured;
+    return ok(sensitive.operations.includes(operation) || configured.data.includes(operation));
+  }
+  return { loginRegisteredUser: async (user, context) => {
     const stored = await userRepository.findById(user.id);
     if (!stored.success)
       return stored;
-    if (!stored.data?.enabled)
+    if (!stored.data || !isUserActive(stored.data))
       return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-    return buildAuthResult({ ...user, credentialVersion: stored.data.credentialVersion ?? "" });
+    return buildAuthResult({ ...user, credentialVersion: stored.data.credentialVersion ?? "" }, void 0, context);
   }, authn: {
-    async login(credentials) {
-      return loginWithStrategy("password", credentials, passwordStrategy);
+    createCaptcha: (input) => createIamCaptcha(config.captcha, input),
+    async reauthenticate(accessToken, password, operation) {
+      const required = await requiresProof(operation);
+      if (!required.success)
+        return required;
+      if (!required.data)
+        return err(HaiIamError.PERMISSION_DENIED, iamM("iam_reauthenticationRequired"));
+      const current = await verifyCurrentSession(accessToken);
+      if (!current.success)
+        return current;
+      const stored = await userRepository.findById(current.data.userId);
+      if (!stored.success)
+        return stored;
+      if (!stored.data)
+        return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
+      const verified = await passwordStrategy.authenticate({ type: "password", identifier: stored.data.username, password });
+      if (!verified.success)
+        return verified;
+      if (verified.data.credentialVersion !== current.data.credentialVersion)
+        return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
+      return tickets.issue({ subjectId: current.data.userId, purpose: `iam:reauth:${operation}`, ttlMs: sensitive.ttlSeconds * 1e3, grant: { operation, sessionVersion: current.data.version, credentialVersion: current.data.credentialVersion } });
+    },
+    async checkSensitiveOperation(accessToken, operation, ticket) {
+      const current = await verifyCurrentSession(accessToken);
+      if (!current.success)
+        return current;
+      const required = await requiresProof(operation);
+      if (!required.success)
+        return required;
+      if (!required.data)
+        return ok(void 0);
+      if (!ticket)
+        return err(HaiIamError.REAUTHENTICATION_REQUIRED, iamM("iam_reauthenticationRequired"));
+      const proof = await tickets.consume(ticket, { purpose: `iam:reauth:${operation}` });
+      if (!proof.success)
+        return proof;
+      if (proof.data.subjectId !== current.data.userId || proof.data.grant.operation !== operation || proof.data.grant.sessionVersion !== current.data.version || proof.data.grant.credentialVersion !== current.data.credentialVersion)
+        return err(HaiIamError.REAUTHENTICATION_REQUIRED, iamM("iam_reauthenticationRequired"));
+      return ok(void 0);
+    },
+    async login(credentials, context) {
+      return loginWithStrategy("password", credentials, passwordStrategy, context);
     },
-    async loginWithOtp(credentials) {
-      return loginWithStrategy("otp", credentials, otpStrategy);
+    async loginWithOtp(credentials, context) {
+      return loginWithStrategy("otp", credentials, otpStrategy, context);
     },
-    async loginWithLdap(credentials) {
-      return loginWithStrategy("ldap", credentials, ldapStrategy);
+    async loginWithLdap(credentials, context) {
+      return loginWithStrategy("ldap", credentials, ldapStrategy, context);
     },
-    async loginWithApiKey(credentials) {
+    async loginWithApiKey(credentials, context) {
       const disabled = loginDisabled("apikey");
       if (disabled)
         return disabled;
@@ -2142,31 +2587,16 @@ function buildAuthnOperations(deps) {
       const authenticated = await apiKeyStrategy.authenticate({ type: "apikey", ...credentials });
       if (!authenticated.success)
         return authenticated;
-      return buildAuthResult(authenticated.data.user, authenticated.data.apiKey);
+      return buildAuthResult(authenticated.data.user, authenticated.data.apiKey, context);
     },
     async logout(accessToken) {
       return sessionFunctions.delete(accessToken);
     },
-    async verifyToken(accessToken) {
-      const session = await sessionFunctions.verifyToken(accessToken);
-      if (!session.success)
-        return session;
-      const [user, authorization] = await Promise.all([
-        userRepository.findById(session.data.userId),
-        authzFunctions.getUserAuthorization(session.data.userId)
-      ]);
-      if (!user.success)
-        return user;
-      if (!user.data?.enabled)
-        return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-      if (session.data.credentialVersion !== (user.data.credentialVersion ?? ""))
-        return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
-      if (!authorization.success)
-        return authorization;
-      const current = { ...session.data, username: user.data.username, displayName: user.data.displayName, avatarUrl: user.data.avatarUrl, ...authorization.data };
-      return ok(current.apiKeyId ? applyApiKeyScopes(current, current.apiKeyScopes ?? []) : current);
-    },
-    async sendOtp(identifier) {
+    verifyToken: verifyCurrentSession,
+    async sendOtp(identifier, options) {
+      const captcha = await verifyIamCaptcha(config.captcha, "sendOtp", options?.captcha);
+      if (!captcha.success)
+        return captcha;
       const disabled = loginDisabled("otp");
       if (disabled) {
         return disabled;
@@ -2183,6 +2613,7 @@ function buildAuthnOperations(deps) {
 }
 var TABLE_NAME3 = "hai_iam_permissions";
 var PERMISSION_FIELDS = [
+  { fieldName: "sensitiveOperations", columnName: "sensitive_operations", def: { type: "JSON" }, select: true, create: true, update: true },
   {
     fieldName: "id",
     columnName: "id",
@@ -2272,6 +2703,27 @@ async function createDbPermissionRepository() {
   return repo;
 }
 var DbPermissionRepository = class extends BaseReldbCrudRepository {
+  async getSensitiveOperations() {
+    const result = await reldb.sql.query("SELECT sensitive_operations FROM hai_iam_permissions WHERE sensitive_operations IS NOT NULL");
+    if (!result.success)
+      return result;
+    const operations = /* @__PURE__ */ new Set();
+    try {
+      for (const row of result.data) {
+        const values = typeof row.sensitive_operations === "string" ? JSON.parse(row.sensitive_operations) : row.sensitive_operations;
+        if (!Array.isArray(values) || values.length > 1e3)
+          return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+        for (const value of values) {
+          if (typeof value !== "string" || !value.trim() || value.length > 128)
+            return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+          operations.add(value.trim());
+        }
+      }
+      return ok([...operations].sort());
+    } catch {
+      return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+    }
+  }
   constructor() {
     super(reldb, {
       table: TABLE_NAME3,
@@ -2840,7 +3292,7 @@ var DbRoleRepository = class extends BaseReldbCrudRepository {
 };
 
 // src/authz/iam-authz-functions.ts
-var logger6 = core.logger.child({ module: "iam", scope: "authz" });
+var logger8 = core.logger.child({ module: "iam", scope: "authz" });
 async function createAuthzOperations(deps) {
   try {
     const { config, session } = deps;
@@ -2862,10 +3314,10 @@ async function createAuthzOperations(deps) {
       userRoleRepository: userRoleResult.data,
       session
     });
-    logger6.info("Authz sub-feature initialized");
+    logger8.info("Authz sub-feature initialized");
     return ok(manager);
   } catch (error) {
-    logger6.error("Authz sub-feature initialization failed", { error });
+    logger8.error("Authz sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -2905,8 +3357,8 @@ function createRbacManager(config) {
       return true;
     }
     if (code.endsWith(":*")) {
-      const prefix = code.slice(0, -1);
-      return permission.startsWith(prefix);
+      const prefix2 = code.slice(0, -1);
+      return permission.startsWith(prefix2);
     }
     return false;
   }
@@ -2961,19 +3413,19 @@ function createRbacManager(config) {
   async function syncSessionPermissionsForRole(roleId) {
     const userIdsResult = await userRoleRepository.getUserIdsByRoleId(roleId);
     if (!userIdsResult.success) {
-      logger6.error("Failed to query users for permission sync", { roleId, error: userIdsResult.error.message });
+      logger8.error("Failed to query users for permission sync", { roleId, error: userIdsResult.error.message });
       return;
     }
     await Promise.allSettled(
       userIdsResult.data.map(async (userId) => {
         const permResult = await resolveUserPermissionCodes(userId);
         if (!permResult.success) {
-          logger6.error("Failed to resolve permissions for session sync", { userId, roleId, error: permResult.error.message });
+          logger8.error("Failed to resolve permissions for session sync", { userId, roleId, error: permResult.error.message });
           return;
         }
         const syncResult = await session.patchUserSessions(userId, { permissions: permResult.data });
         if (!syncResult.success) {
-          logger6.error("Failed to sync session permissions", { userId, roleId, error: syncResult.error.message });
+          logger8.error("Failed to sync session permissions", { userId, roleId, error: syncResult.error.message });
         }
       })
     );
@@ -2987,17 +3439,17 @@ function createRbacManager(config) {
     if (roleCodesResult.success) {
       updates.roles = roleCodesResult.data;
     } else {
-      logger6.error("Failed to resolve roles for session sync", { userId, error: roleCodesResult.error.message });
+      logger8.error("Failed to resolve roles for session sync", { userId, error: roleCodesResult.error.message });
     }
     if (permCodesResult.success) {
       updates.permissions = permCodesResult.data;
     } else {
-      logger6.error("Failed to resolve permissions for session sync", { userId, error: permCodesResult.error.message });
+      logger8.error("Failed to resolve permissions for session sync", { userId, error: permCodesResult.error.message });
     }
     if (updates.roles !== void 0 || updates.permissions !== void 0) {
       const syncResult = await session.patchUserSessions(userId, updates);
       if (!syncResult.success) {
-        logger6.error("Failed to patch user sessions", { userId, error: syncResult.error.message });
+        logger8.error("Failed to patch user sessions", { userId, error: syncResult.error.message });
       }
     }
   }
@@ -3021,6 +3473,22 @@ function createRbacManager(config) {
     return ok(void 0);
   }
   return {
+    getSensitiveOperations: () => rbacConfig.enabled ? permissionRepository.getSensitiveOperations() : Promise.resolve(ok([])),
+    async setPermissionSensitiveOperations(permissionId, operations) {
+      if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
+        return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
+      const updated = await permissionRepository.updateById(permissionId, { sensitiveOperations: [...new Set(operations.map((value) => value.trim()))] });
+      if (!updated.success)
+        return updated;
+      if (updated.data.changes === 0) {
+        const existing = await permissionRepository.findById(permissionId);
+        if (!existing.success)
+          return existing;
+        if (!existing.data)
+          return err(HaiIamError.PERMISSION_NOT_FOUND, iamM("iam_permissionNotExist"));
+      }
+      return ok(void 0);
+    },
     async checkPermission(userId, permission) {
       if (!rbacConfig.enabled) {
         return ok(true);
@@ -3065,8 +3533,7 @@ function createRbacManager(config) {
       }
       const result = await userRoleRepository.assign(userId, roleId, tx);
       if (result.success) {
-        logger6.info("Role assigned to user", { userId, roleId });
-        void audit.log({ action: "role.assign", resource: "iam_user_role", resourceId: userId, details: { roleId } });
+        logger8.info("Role assigned to user", { userId, roleId });
         if (!tx) {
           await syncUserSessionAfterRoleChange(userId);
         }
@@ -3076,8 +3543,7 @@ function createRbacManager(config) {
     async removeRole(userId, roleId, tx) {
       const result = await userRoleRepository.remove(userId, roleId, tx);
       if (result.success) {
-        logger6.info("Role removed from user", { userId, roleId });
-        void audit.log({ action: "role.remove", resource: "iam_user_role", resourceId: userId, details: { roleId } });
+        logger8.info("Role removed from user", { userId, roleId });
         if (!tx) {
           await syncUserSessionAfterRoleChange(userId);
         }
@@ -3145,8 +3611,7 @@ function createRbacManager(config) {
           error
         );
       }
-      logger6.info("Roles synced for user", { userId, added: toAdd.length, removed: toRemove.length });
-      void audit.log({ action: "roles.sync", resource: "iam_user_role", resourceId: userId, details: { added: toAdd, removed: toRemove } });
+      logger8.info("Roles synced for user", { userId, added: toAdd.length, removed: toRemove.length });
       if (ownTx) {
         await syncUserSessionAfterRoleChange(userId);
       }
@@ -3198,8 +3663,7 @@ function createRbacManager(config) {
             return mapRepositoryError2("iam_createRoleFailed", commitResult.error.message);
           }
         }
-        logger6.info("Role created", { roleId: createdResult.data.id, code: role.code });
-        void audit.helper.crud({ action: "create", resource: "iam_role", resourceId: createdResult.data.id, details: { code: role.code } });
+        logger8.info("Role created", { roleId: createdResult.data.id, code: role.code });
         if (role.code === rbacConfig.superAdminRole) {
           superAdminRoleId = void 0;
         }
@@ -3296,10 +3760,9 @@ function createRbacManager(config) {
               affectedUsersResult.data.map((userId) => syncUserSessionAfterRoleChange(userId))
             );
           } else {
-            logger6.error("Failed to query affected users after updateRole", { roleId, error: affectedUsersResult.error.message });
+            logger8.error("Failed to query affected users after updateRole", { roleId, error: affectedUsersResult.error.message });
           }
         }
-        void audit.helper.crud({ action: "update", resource: "iam_role", resourceId: roleId, details: data });
         return ok(updatedResult.data);
       } catch (error) {
         if (ownTx)
@@ -3372,12 +3835,15 @@ function createRbacManager(config) {
         );
       }
       superAdminRoleId = void 0;
-      logger6.info("Role deleted", { roleId });
-      void audit.helper.crud({ action: "delete", resource: "iam_role", resourceId: roleId });
+      logger8.info("Role deleted", { roleId });
       return ok(void 0);
     },
     // ─── 权限管理 ───
     async createPermission(permission, tx) {
+      const operations = permission.sensitiveOperations ?? [];
+      if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
+        return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
+      permission = { ...permission, sensitiveOperations: [...new Set(operations.map((value) => value.trim()))] };
       const ownTx = !tx;
       if (!tx) {
         const txResult = await reldb.tx.begin();
@@ -3413,8 +3879,7 @@ function createRbacManager(config) {
             return mapRepositoryError2("iam_createPermissionFailed", commitResult.error.message);
           }
         }
-        logger6.info("Permission created", { permissionId: createdResult.data.id, code: permission.code });
-        void audit.helper.crud({ action: "create", resource: "iam_permission", resourceId: createdResult.data.id, details: { code: permission.code } });
+        logger8.info("Permission created", { permissionId: createdResult.data.id, code: permission.code });
         return ok(createdResult.data);
       } catch (error) {
         if (ownTx)
@@ -3518,8 +3983,7 @@ function createRbacManager(config) {
           affectedRoleIds.map((roleId) => syncSessionPermissionsForRole(roleId))
         );
       }
-      logger6.info("Permission deleted", { permissionId });
-      void audit.helper.crud({ action: "delete", resource: "iam_permission", resourceId: permissionId });
+      logger8.info("Permission deleted", { permissionId });
       return ok(void 0);
     },
     async assignPermissionToRole(roleId, permissionId, tx) {
@@ -3541,8 +4005,7 @@ function createRbacManager(config) {
       }
       const assignResult = await rolePermissionRepository.assign(roleId, permissionId, tx);
       if (assignResult.success) {
-        logger6.info("Permission assigned to role", { roleId, permissionId });
-        void audit.log({ action: "permission.assign", resource: "iam_role_permission", resourceId: roleId, details: { permissionId } });
+        logger8.info("Permission assigned to role", { roleId, permissionId });
         if (!tx) {
           await syncSessionPermissionsForRole(roleId);
         }
@@ -3571,8 +4034,7 @@ function createRbacManager(config) {
       }
       const removeResult = await rolePermissionRepository.remove(roleId, permissionId, tx);
       if (removeResult.success) {
-        logger6.info("Permission removed from role", { roleId, permissionId });
-        void audit.log({ action: "permission.remove", resource: "iam_role_permission", resourceId: roleId, details: { permissionId } });
+        logger8.info("Permission removed from role", { roleId, permissionId });
         if (!tx) {
           await syncSessionPermissionsForRole(roleId);
         }
@@ -3590,7 +4052,109 @@ function createRbacManager(config) {
     }
   };
 }
+var logger9 = core.logger.child({ module: "iam", scope: "audit" });
+async function observe(operation, event, tx) {
+  const result = await operation();
+  const fields = typeof event === "function" ? event(result) : event;
+  if (!fields)
+    return result;
+  if (tx && !result.success) {
+    logger9.warn("IAM transactional operation failed", { action: fields.action, resource: fields.resource, reasonCode: result.error.code });
+    return result;
+  }
+  const recorded = await audit.capture({
+    ...fields,
+    category: "system",
+    outcome: result.success ? "success" : [401, 403, 409, 423, 429].includes(result.error.httpStatus ?? 500) ? "denied" : "failure",
+    details: { ...fields.details, ...!result.success ? { reasonCode: result.error.code } : {} }
+  }, { tx });
+  if (!recorded.success) {
+    logger9.error("IAM event audit failed", { action: fields.action, resource: fields.resource, error: recorded.error });
+    if (tx)
+      return recorded;
+  }
+  return result;
+}
+function loginEvent(method, result, context) {
+  return {
+    action: "auth.login",
+    resource: "iam.auth",
+    details: { method },
+    // 登录结果本身已完成鉴别，不把客户端提交的标识声明当成已验证主体。
+    userId: result.success ? result.data.user.id : null,
+    actorSnapshot: result.success ? { id: result.data.user.id, username: result.data.user.username, displayName: result.data.user.displayName, roles: result.data.roles } : null,
+    ipAddress: context?.ip,
+    userAgent: context?.userAgent?.slice(0, 4096),
+    requestId: context?.requestId
+  };
+}
+function observeAuth(operations) {
+  return {
+    ...operations,
+    login: (credentials, context) => observe(() => operations.login(credentials, context), (result) => loginEvent("password", result, context)),
+    loginWithOtp: (credentials, context) => observe(() => operations.loginWithOtp(credentials, context), (result) => loginEvent("otp", result, context)),
+    loginWithLdap: (credentials, context) => observe(() => operations.loginWithLdap(credentials, context), (result) => loginEvent("ldap", result, context)),
+    loginWithApiKey: (credentials, context) => observe(() => operations.loginWithApiKey(credentials, context), (result) => loginEvent("apikey", result, context)),
+    registerAndLogin: (options, context) => observe(() => operations.registerAndLogin(options, context), (result) => loginEvent("registration", result, context)),
+    logout: (token) => observe(() => operations.logout(token), { action: "auth.logout", resource: "iam.auth" }),
+    sendOtp: (identifier, options) => observe(() => operations.sendOtp(identifier, options), { action: "otp.send", resource: "iam.auth" }),
+    reauthenticate: (token, password, operation) => observe(() => operations.reauthenticate(token, password, operation), { action: "auth.reauthenticate", resource: "iam.auth", details: { operation } }),
+    checkSensitiveOperation: (token, operation, ticket) => observe(() => operations.checkSensitiveOperation(token, operation, ticket), (result) => !result.success ? { action: "auth.sensitive-denied", resource: "iam.auth", details: { operation } } : void 0)
+  };
+}
+function observeUsers(operations) {
+  return {
+    ...operations,
+    register: (options) => observe(() => operations.register(options), (result) => ({ action: "user.register", resource: "iam.users", resourceId: result.success ? result.data.user.id : void 0 })),
+    createUser: (options) => observe(() => operations.createUser(options), (result) => ({ action: "user.create", resource: "iam.users", resourceId: result.success ? result.data.user.id : void 0 })),
+    inviteUser: (options) => observe(() => operations.inviteUser(options), (result) => ({ action: "user.invite", resource: "iam.users", resourceId: result.success ? result.data.user.id : void 0 })),
+    updateUser: (id, data) => observe(() => operations.updateUser(id, data), { action: "user.update", resource: "iam.users", resourceId: id, details: { fields: Object.keys(data), ...data.accountStatus ? { accountStatus: data.accountStatus } : {}, ...data.accountType ? { accountType: data.accountType } : {} } }),
+    updateCurrentUser: (token, data) => observe(() => operations.updateCurrentUser(token, data), (result) => ({ action: "user.profile", resource: "iam.users", resourceId: result.success ? result.data.id : void 0, details: { fields: Object.keys(data) } })),
+    deleteUser: (id) => observe(() => operations.deleteUser(id), { action: "user.delete", resource: "iam.users", resourceId: id }),
+    adminResetPassword: (id, password) => observe(() => operations.adminResetPassword(id, password), { action: "password.admin-reset", resource: "iam.users", resourceId: id }),
+    changePassword: (id, previous, next) => observe(() => operations.changePassword(id, previous, next), { action: "password.change", resource: "iam.users", resourceId: id }),
+    changeCurrentUserPassword: (token, previous, next) => observe(() => operations.changeCurrentUserPassword(token, previous, next), { action: "password.change", resource: "iam.users" }),
+    renewPassword: (input) => observe(() => operations.renewPassword(input), { action: "password.renew", resource: "iam.users" }),
+    requestPasswordReset: (identifier, options) => observe(() => operations.requestPasswordReset(identifier, options), { action: "password.reset-request", resource: "iam.users" }),
+    confirmPasswordReset: (token, password) => observe(() => operations.confirmPasswordReset(token, password), { action: "password.reset-complete", resource: "iam.users" }),
+    scanInactiveAccounts: () => observe(() => operations.scanInactiveAccounts(), (result) => result.success && result.data === 0 ? void 0 : { action: "account.inactivity-scan", resource: "iam.users", details: result.success ? { count: result.data } : {} })
+  };
+}
+function observeAuthorization(operations) {
+  return {
+    ...operations,
+    assignRole: (id, roleId, tx) => observe(() => operations.assignRole(id, roleId, tx), { action: "role.assign", resource: "iam.user-roles", resourceId: id, details: { roleId } }, tx),
+    removeRole: (id, roleId, tx) => observe(() => operations.removeRole(id, roleId, tx), { action: "role.remove", resource: "iam.user-roles", resourceId: id, details: { roleId } }, tx),
+    syncRoles: (id, roleIds, tx) => observe(() => operations.syncRoles(id, roleIds, tx), { action: "role.sync", resource: "iam.user-roles", resourceId: id, details: { roleIds } }, tx),
+    createRole: (input, tx) => observe(() => operations.createRole(input, tx), (result) => ({ action: "role.create", resource: "iam.roles", resourceId: result.success ? result.data.id : void 0, details: { code: input.code } }), tx),
+    updateRole: (id, data, tx) => observe(() => operations.updateRole(id, data, tx), { action: "role.update", resource: "iam.roles", resourceId: id, details: { fields: Object.keys(data), permissionIds: data.permissionIds } }, tx),
+    deleteRole: (id, tx) => observe(() => operations.deleteRole(id, tx), { action: "role.delete", resource: "iam.roles", resourceId: id }, tx),
+    createPermission: (input, tx) => observe(() => operations.createPermission(input, tx), (result) => ({ action: "permission.create", resource: "iam.permissions", resourceId: result.success ? result.data.id : void 0, details: { code: input.code } }), tx),
+    setPermissionSensitiveOperations: (id, operationIds) => observe(() => operations.setPermissionSensitiveOperations(id, operationIds), { action: "permission.sensitive-operations", resource: "iam.permissions", resourceId: id, details: { operations: operationIds } }),
+    deletePermission: (id, tx) => observe(() => operations.deletePermission(id, tx), { action: "permission.delete", resource: "iam.permissions", resourceId: id }, tx),
+    assignPermissionToRole: (id, permissionId, tx) => observe(() => operations.assignPermissionToRole(id, permissionId, tx), { action: "permission.assign", resource: "iam.role-permissions", resourceId: id, details: { permissionId } }, tx),
+    removePermissionFromRole: (id, permissionId, tx) => observe(() => operations.removePermissionFromRole(id, permissionId, tx), { action: "permission.remove", resource: "iam.role-permissions", resourceId: id, details: { permissionId } }, tx)
+  };
+}
+function observeSessions(operations) {
+  return {
+    ...operations,
+    create: (options) => observe(() => operations.create(options), (result) => ({ action: "session.create", resource: "iam.sessions", resourceId: result.success ? result.data.version : options.userId })),
+    delete: (token) => observe(() => operations.delete(token), { action: "session.delete", resource: "iam.sessions" }),
+    deleteByUserId: (id) => observe(() => operations.deleteByUserId(id), (result) => ({ action: "session.revoke-user", resource: "iam.sessions", resourceId: id, details: result.success ? { count: result.data } : {} })),
+    refresh: (token) => observe(() => operations.refresh(token), { action: "session.refresh", resource: "iam.sessions" }),
+    revokeRefresh: (token) => observe(() => operations.revokeRefresh(token), { action: "session.revoke-refresh", resource: "iam.sessions" })
+  };
+}
+function observeApiKeys(operations) {
+  return {
+    ...operations,
+    createApiKey: (userId, options) => observe(() => operations.createApiKey(userId, options), (result) => ({ action: "apikey.create", resource: "iam.apikeys", resourceId: result.success ? result.data.apiKey.id : void 0, details: { subjectId: userId, scopes: options.scopes } })),
+    revokeApiKey: (id) => observe(() => operations.revokeApiKey(id), { action: "apikey.revoke", resource: "iam.apikeys", resourceId: id })
+  };
+}
 var columns = { credential_version: "VARCHAR(255) NOT NULL DEFAULT ''", reset_version: "VARCHAR(255) NOT NULL DEFAULT ''", reset_hash: "TEXT", reset_expires_at: "BIGINT", reset_attempts: "INTEGER NOT NULL DEFAULT 0" };
+var accountColumns = { account_type: "VARCHAR(16) NOT NULL DEFAULT 'permanent'", account_status: "VARCHAR(16) NOT NULL DEFAULT 'active'", account_expires_at: "TIMESTAMP", last_login_at: "TIMESTAMP" };
 var steps = [{
   version: 1,
   name: "credential-and-reset-versions",
@@ -3611,6 +4175,59 @@ var steps = [{
     }
     return ok(void 0);
   }
+}, {
+  version: 2,
+  name: "account-lifecycle",
+  async needed(sql) {
+    const found = await schemaColumns(reldb, "hai_iam_users", sql);
+    return found.success ? ok(found.data.length > 0 && Object.keys(accountColumns).some((name) => !found.data.includes(name))) : found;
+  },
+  async apply(sql) {
+    const found = await schemaColumns(reldb, "hai_iam_users", sql);
+    if (!found.success)
+      return found;
+    for (const [name, definition] of Object.entries(accountColumns)) {
+      if (found.data.includes(name))
+        continue;
+      const added = await sql.execute(`ALTER TABLE hai_iam_users ADD COLUMN ${name} ${definition}`);
+      if (!added.success)
+        return added;
+    }
+    return ok(void 0);
+  }
+}, {
+  version: 3,
+  name: "initial-password-state",
+  async needed(sql) {
+    const found = await schemaColumns(reldb, "hai_iam_users", sql);
+    return found.success ? ok(found.data.length > 0 && !found.data.includes("must_change_password")) : found;
+  },
+  async apply(sql) {
+    const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN must_change_password BOOLEAN NOT NULL DEFAULT FALSE");
+    return added.success ? ok(void 0) : added;
+  }
+}, {
+  version: 4,
+  name: "login-failure-window",
+  async needed(sql) {
+    const found = await schemaColumns(reldb, "hai_iam_users", sql);
+    return found.success ? ok(found.data.length > 0 && !found.data.includes("first_login_failed_at")) : found;
+  },
+  async apply(sql) {
+    const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN first_login_failed_at TIMESTAMP");
+    return added.success ? ok(void 0) : added;
+  }
+}, {
+  version: 5,
+  name: "permission-sensitive-operations",
+  async needed(sql) {
+    const found = await schemaColumns(reldb, "hai_iam_permissions", sql);
+    return found.success ? ok(found.data.length > 0 && !found.data.includes("sensitive_operations")) : found;
+  },
+  async apply(sql) {
+    const added = await sql.execute("ALTER TABLE hai_iam_permissions ADD COLUMN sensitive_operations JSON");
+    return added.success ? ok(void 0) : added;
+  }
 }];
 function migrateIam(options = {}) {
   return migrateSchema(reldb, "iam", steps, options);
@@ -3658,9 +4275,11 @@ async function resolveIamNotifications(input) {
 // src/iam-public-config.ts
 function buildIamPublicConfig(config, runtime) {
   const otp = OtpConfigSchema.parse(config.otp ?? {});
+  const session = SessionConfigSchema.parse(config.session ?? {});
   const email = config.login.otp && !!config.otp && otp.email && !!runtime.onOtpSendEmail;
   const sms = config.login.otp && !!config.otp && otp.sms && !!runtime.onOtpSendSms;
   return {
+    captcha: { enabled: config.captcha.enabled },
     password: PasswordConfigSchema.parse(config.password ?? {}),
     register: { enabled: config.register.enabled },
     login: { password: config.login.password, otp: email || sms, ldap: config.login.ldap && !!config.ldap, email, sms },
@@ -3668,10 +4287,12 @@ function buildIamPublicConfig(config, runtime) {
     otp: { length: otp.length, resendInterval: otp.resendInterval },
     agreements: { ...config.agreements },
     ui: AuthUiConfigSchema.parse(config.ui ?? {}),
-    session: { maxAge: SessionConfigSchema.parse(config.session ?? {}).maxAge }
+    session: { maxAge: session.maxAge, endOnPageHide: session.endOnPageHide },
+    reauthentication: { enabled: config.reauthentication?.enabled ?? false, operations: [...config.reauthentication?.operations ?? []] },
+    initialCredentials: { enabled: Boolean(config.initialCredentials?.enabled && config.passwordReset?.enabled !== false && runtime.onPasswordResetRequest) }
   };
 }
-var logger7 = core.logger.child({ module: "iam", scope: "seed" });
+var logger10 = core.logger.child({ module: "iam", scope: "seed" });
 var DEFAULT_ROLES = [
   { code: "admin", name: () => iamM("iam_seedRoleAdminName"), description: () => iamM("iam_seedRoleAdminDesc"), isSystem: true },
   { code: "user", name: () => iamM("iam_seedRoleUserName"), description: () => iamM("iam_seedRoleUserDesc"), isSystem: true },
@@ -3771,10 +4392,10 @@ async function seedIamData(authz) {
         }
       }
     }
-    logger7.info("IAM seed data initialized");
+    logger10.info("IAM seed data initialized");
     return ok(void 0);
   } catch (error) {
-    logger7.error("Failed to seed IAM data", { error });
+    logger10.error("Failed to seed IAM data", { error });
     return err(
       HaiIamError.REPOSITORY_ERROR,
       iamM("iam_initSeedDataFailed"),
@@ -3782,81 +4403,12 @@ async function seedIamData(authz) {
     );
   }
 }
-var BASE64_PLUS_REGEX = /\+/g;
-var BASE64_SLASH_REGEX = /\//g;
-var BASE64_TRAILING_PADDING_REGEX = /=+$/;
-function generateToken() {
-  const bytes = new Uint8Array(32);
-  crypto.getRandomValues(bytes);
-  const base64 = btoa(String.fromCharCode(...bytes));
-  return base64.replace(BASE64_PLUS_REGEX, "-").replace(BASE64_SLASH_REGEX, "_").replace(BASE64_TRAILING_PADDING_REGEX, "");
-}
-function getUserSessionScope(userId) {
-  return createHash("sha256").update(userId).digest("hex");
-}
-function generateSessionToken(userId) {
-  return `s1.${getUserSessionScope(userId)}.${generateToken()}`;
-}
-function getTokenSessionScope(token) {
-  return /^s1\.([a-f0-9]{64})\.[\w-]{43}$/.exec(token)?.[1];
-}
-function buildSession(options, now, sessionTtl, accessToken, credentialVersion) {
-  return {
-    version: crypto.randomUUID(),
-    credentialVersion,
-    apiKeyId: options.apiKeyId,
-    apiKeyScopes: options.apiKeyScopes,
-    userId: options.userId,
-    username: options.username,
-    displayName: options.displayName,
-    avatarUrl: options.avatarUrl,
-    roles: options.roles ?? [],
-    permissions: options.permissions ?? [],
-    source: options.source,
-    accessToken,
-    createdAt: now,
-    lastActiveAt: now,
-    expiresAt: new Date(now.getTime() + sessionTtl * 1e3),
-    maxAge: sessionTtl,
-    data: options.data
-  };
-}
-function applySessionPatch(session, patch) {
-  const nextSession = { ...session };
-  if (patch.data !== void 0) {
-    nextSession.data = { ...nextSession.data, ...patch.data };
-  }
-  if (patch.roles !== void 0) {
-    nextSession.roles = patch.roles;
-  }
-  if (patch.permissions !== void 0) {
-    nextSession.permissions = patch.permissions;
-  }
-  if (patch.username !== void 0) {
-    nextSession.username = patch.username;
-  }
-  if (patch.displayName !== void 0) {
-    nextSession.displayName = patch.displayName;
-  }
-  if (patch.avatarUrl !== void 0) {
-    nextSession.avatarUrl = patch.avatarUrl;
-  }
-  if (patch.source !== void 0) {
-    nextSession.source = patch.source;
-  }
-  if (patch.expiresAt !== void 0)
-    nextSession.expiresAt = new Date(patch.expiresAt);
-  nextSession.lastActiveAt = patch.lastActiveAt !== void 0 ? new Date(patch.lastActiveAt) : /* @__PURE__ */ new Date();
-  return nextSession;
-}
-
-// src/session/iam-session-repository-cache.ts
 function retainedUntil(entry) {
   return Math.max(new Date(entry.session.expiresAt).getTime(), entry.refreshToken ? entry.refreshExpiresAt : 0);
 }
 function restoreSession(session) {
-  const result = { ...session, createdAt: new Date(session.createdAt), lastActiveAt: new Date(session.lastActiveAt), expiresAt: new Date(session.expiresAt) };
-  if (typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![result.createdAt, result.lastActiveAt, result.expiresAt].every((date) => Number.isFinite(date.getTime()))) {
+  const result = { ...session, createdAt: new Date(session.createdAt), startedAt: new Date(session.startedAt ?? session.createdAt), lastActiveAt: new Date(session.lastActiveAt), expiresAt: new Date(session.expiresAt) };
+  if (result.terminalType !== void 0 && !["web", "app", "desktop", "api"].includes(result.terminalType) || typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![result.createdAt, result.startedAt, result.lastActiveAt, result.expiresAt].every((date) => Number.isFinite(date.getTime()))) {
     throw new TypeError("Invalid session state");
   }
   return result;
@@ -3867,7 +4419,16 @@ function stateKey(scope) {
 function repositoryFailure(cause) {
   return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_sessionStateFailed"), cause);
 }
-function createCacheSessionRepository(refreshTokenMaxAge) {
+function createCacheSessionRepository(refreshTokenMaxAge, policy = {}) {
+  const idleTimeout = policy.idleTimeout ?? 0;
+  const absoluteTimeout = policy.absoluteTimeout ?? 0;
+  const maxSessions = policy.maxSessions ?? 0;
+  function policyExpired(session) {
+    const now = Date.now();
+    const activeAt = new Date(session.lastActiveAt).getTime();
+    const startedAt = new Date(session.startedAt ?? session.createdAt).getTime();
+    return idleTimeout > 0 && activeAt + idleTimeout * 1e3 <= now || absoluteTimeout > 0 && startedAt + absoluteTimeout * 1e3 <= now;
+  }
   async function read(scope) {
     try {
       const result = await cache.kv.get(stateKey(scope));
@@ -3897,7 +4458,7 @@ function createCacheSessionRepository(refreshTokenMaxAge) {
           return current;
         const next = current.data ? JSON.parse(JSON.stringify(current.data)) : { revision: "", sessions: {} };
         for (const [token, entry] of Object.entries(next.sessions)) {
-          if (retainedUntil(entry) <= Date.now())
+          if (retainedUntil(entry) <= Date.now() || policyExpired(entry.session))
             delete next.sessions[token];
         }
         const outcome = operation(next);
@@ -3926,16 +4487,40 @@ function createCacheSessionRepository(refreshTokenMaxAge) {
   }
   return {
     save: (session, tokens, singleDevice = false) => mutate(getUserSessionScope(session.userId), (state) => {
-      if (singleDevice)
-        state.sessions = {};
+      const active = Object.entries(state.sessions).filter(([, entry]) => entry.session.credentialVersion === session.credentialVersion);
+      const terminal = session.terminalType ?? "web";
+      const limits = policy.terminalLimits ?? {};
+      const cap = limits[terminal];
+      if (Object.keys(limits).length && cap === void 0)
+        return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+      const removed = /* @__PURE__ */ new Set();
+      if (singleDevice) {
+        if (policy.singleDeviceMode === "reject" && active.length)
+          return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+        if (policy.singleDeviceMode !== "reject")
+          Object.keys(state.sessions).forEach((token) => removed.add(token));
+      } else if (cap) {
+        const same = active.filter(([, entry]) => (entry.session.terminalType ?? "web") === terminal).sort(([firstToken, first], [secondToken, second]) => new Date(first.session.startedAt ?? first.session.createdAt).getTime() - new Date(second.session.startedAt ?? second.session.createdAt).getTime() || firstToken.localeCompare(secondToken));
+        if (same.length >= cap) {
+          if (policy.terminalLimitMode !== "replace")
+            return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+          same.slice(0, same.length - cap + 1).forEach(([token]) => removed.add(token));
+        }
+      }
+      if (maxSessions > 0 && active.filter(([token]) => !removed.has(token)).length >= maxSessions)
+        return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+      removed.forEach((token) => delete state.sessions[token]);
       return storeSession(state, session, tokens);
     }),
     rotate: (previous, refreshToken, session, tokens) => mutate(getUserSessionScope(previous.userId), (state) => {
       const old = state.sessions[previous.accessToken];
-      if (!old || old.refreshToken !== refreshToken || old.refreshExpiresAt <= Date.now())
+      if (!old || old.refreshToken !== refreshToken || old.refreshExpiresAt <= Date.now() || policyExpired(old.session))
         return err(HaiIamError.TOKEN_EXPIRED, iamM("iam_refreshTokenExpired"));
       if (old.session.version !== previous.version || session.userId !== previous.userId)
         return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+      session.startedAt = new Date(old.session.startedAt ?? old.session.createdAt);
+      if (idleTimeout > 0)
+        session.lastActiveAt = new Date(old.session.lastActiveAt);
       delete state.sessions[previous.accessToken];
       return storeSession(state, session, tokens);
     }),
@@ -3950,7 +4535,7 @@ function createCacheSessionRepository(refreshTokenMaxAge) {
       if (!record)
         return ok(null);
       const session = restoreSession(record.session);
-      return ok(session.expiresAt.getTime() <= Date.now() ? null : session);
+      return ok(session.expiresAt.getTime() <= Date.now() || policyExpired(session) ? null : session);
     },
     async getByRefreshToken(token) {
       const scope = getTokenSessionScope(token);
@@ -3962,7 +4547,8 @@ function createCacheSessionRepository(refreshTokenMaxAge) {
       const record = Object.values(result.data?.sessions ?? {}).find((entry) => entry.refreshToken === token && entry.refreshExpiresAt > Date.now());
       if (!record)
         return ok(null);
-      return ok(restoreSession(record.session));
+      const session = restoreSession(record.session);
+      return ok(policyExpired(session) ? null : session);
     },
     async updateByAccessToken(token, patch, expectedVersion) {
       const scope = getTokenSessionScope(token);
@@ -3970,10 +4556,12 @@ function createCacheSessionRepository(refreshTokenMaxAge) {
         return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
       return mutate(scope, (state) => {
         const entry = state.sessions[token];
-        if (!entry || new Date(entry.session.expiresAt).getTime() <= Date.now())
+        if (!entry || new Date(entry.session.expiresAt).getTime() <= Date.now() || policyExpired(entry.session))
           return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
         if (!expectedVersion || entry.session.version !== expectedVersion)
           return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+        if (patch.terminalType !== void 0 && patch.terminalType !== (entry.session.terminalType ?? "web"))
+          return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
         const updated = applySessionPatch(restoreSession(entry.session), patch);
         if (![updated.expiresAt, updated.lastActiveAt].every((date) => Number.isFinite(date.getTime())))
           return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sessionMaxAgeInvalid"));
@@ -3987,7 +4575,7 @@ function createCacheSessionRepository(refreshTokenMaxAge) {
         return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
       return mutate(scope, (state) => {
         const entry = state.sessions[token];
-        if (!entry || new Date(entry.session.expiresAt).getTime() <= Date.now())
+        if (!entry || new Date(entry.session.expiresAt).getTime() <= Date.now() || policyExpired(entry.session))
           return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
         if (entry.session.version !== expectedVersion)
           return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
@@ -3995,7 +4583,7 @@ function createCacheSessionRepository(refreshTokenMaxAge) {
         const next = {
           ...current,
           lastActiveAt: new Date(Math.max(current.lastActiveAt.getTime(), now.getTime())),
-          expiresAt: new Date(Math.max(current.expiresAt.getTime(), now.getTime() + current.maxAge * 1e3))
+          expiresAt: policy.sliding === false ? current.expiresAt : new Date(Math.max(current.expiresAt.getTime(), now.getTime() + current.maxAge * 1e3))
         };
         entry.session = next;
         return ok(next);
@@ -4053,26 +4641,28 @@ function stripInternalSessionFields(session) {
   const hasExtraKeys = Object.keys(rest).length > 0;
   return { ...session, data: hasExtraKeys ? rest : void 0 };
 }
-var logger8 = core.logger.child({ module: "iam", scope: "session" });
+var logger11 = core.logger.child({ module: "iam", scope: "session" });
 async function createSessionOperations(deps) {
   try {
     const { config } = deps;
     const sessionConfig = SessionConfigSchema.parse(config.session ?? {});
     const sessionRepository = createCacheSessionRepository(
-      sessionConfig.refreshTokenMaxAge ?? 604800
+      sessionConfig.refreshTokenMaxAge ?? 604800,
+      sessionConfig
     );
     const functions = buildSessionFunctions({
       readCredential: deps.readCredential,
       maxAge: sessionConfig.maxAge,
       sliding: sessionConfig.sliding,
       singleDevice: sessionConfig.singleDevice,
+      idleTimeout: sessionConfig.idleTimeout,
       sessionRepository,
       apiKeyRepository: config.login.apikey ? await createDbApiKeyRepository() : void 0
     });
-    logger8.info("Session sub-feature initialized");
+    logger11.info("Session sub-feature initialized");
     return ok(functions);
   } catch (error) {
-    logger8.error("Session sub-feature initialization failed", { error });
+    logger11.error("Session sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -4086,6 +4676,8 @@ function buildSessionFunctions(config) {
   const singleDevice = config.singleDevice ?? false;
   const repo = config.sessionRepository;
   function candidate(options, credentialVersion) {
+    if (options.terminalType !== void 0 && !["web", "app", "desktop", "api"].includes(options.terminalType))
+      return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_terminalTypeInvalid"));
     const now = /* @__PURE__ */ new Date();
     const ttl = options.maxAge ?? maxAge;
     if (!Number.isSafeInteger(ttl) || ttl <= 0 || !Number.isFinite(new Date(now.getTime() + ttl * 1e3).getTime()))
@@ -4141,7 +4733,7 @@ function buildSessionFunctions(config) {
         if (!saveResult.success) {
           return saveResult;
         }
-        logger8.debug("Session created", { userId: options.userId });
+        logger11.debug("Session created", { userId: options.userId });
         return ok(session);
       } catch (error) {
         return err(
@@ -4176,7 +4768,7 @@ function buildSessionFunctions(config) {
       if (!validated.success)
         return validated;
       let output = validated.data;
-      if (sliding) {
+      if (sliding || (config.idleTimeout ?? 0) > 0) {
         const updateResult = await repo.touchByAccessToken(accessToken, session.version, /* @__PURE__ */ new Date());
         if (!updateResult.success) {
           return updateResult;
@@ -4202,7 +4794,7 @@ function buildSessionFunctions(config) {
       return repo.updateByAccessToken(accessToken, data, expectedVersion);
     },
     async delete(accessToken) {
-      logger8.debug("Session delete requested");
+      logger11.debug("Session delete requested");
       return repo.removeByAccessToken(accessToken);
     },
     async deleteByUserId(userId) {
@@ -4244,6 +4836,7 @@ function buildSessionFunctions(config) {
           apiKeyId: effectiveSession.apiKeyId,
           apiKeyScopes: effectiveSession.apiKeyScopes,
           source: oldSession.source,
+          terminalType: oldSession.terminalType ?? "web",
           maxAge: oldSession.maxAge,
           data: oldSession.data ? { ...oldSession.data, _tokenPair: void 0 } : void 0
         }, oldSession.credentialVersion);
@@ -4255,7 +4848,7 @@ function buildSessionFunctions(config) {
         const current = await credential(oldSession.userId, oldSession.credentialVersion);
         if (!current.success)
           return current;
-        logger8.debug("Token refreshed", { userId: oldSession.userId });
+        logger11.debug("Token refreshed", { userId: oldSession.userId });
         return ok(next.data.tokens);
       } catch (error) {
         return err(
@@ -4273,63 +4866,7 @@ function buildSessionFunctions(config) {
     }
   };
 }
-var logger9 = core.logger.child({ module: "iam", scope: "ticket" });
-var TICKET_KEY_PREFIX = "hai:iam:ticket:";
-var DEFAULT_TICKET_TTL_MS = 3e4;
-function buildTicketKey(ticket) {
-  return `${TICKET_KEY_PREFIX}${ticket}`;
-}
-function createTicketOperations() {
-  return {
-    async issue(options) {
-      const ttlMs = options.ttlMs !== void 0 && options.ttlMs > 0 ? options.ttlMs : DEFAULT_TICKET_TTL_MS;
-      const ticket = generateToken();
-      const expiresAt = Date.now() + ttlMs;
-      const record = {
-        subjectId: options.subjectId,
-        purpose: options.purpose,
-        grant: options.grant ?? {},
-        expiresAt
-      };
-      const saved = await cache.kv.set(buildTicketKey(ticket), record, { px: ttlMs, nx: true });
-      if (!saved.success || !saved.data) {
-        logger9.warn("Failed to issue ticket", { purpose: options.purpose });
-        return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
-      }
-      return ok({ ticket, expiresAt });
-    },
-    async consume(ticket, options) {
-      if (!ticket) {
-        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
-      }
-      const key = buildTicketKey(ticket);
-      const found = await cache.kv.get(key);
-      if (!found.success) {
-        return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
-      }
-      const record = found.data;
-      if (!record) {
-        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
-      }
-      const removed = await cache.kv.del(key);
-      if (!removed.success || removed.data !== 1) {
-        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
-      }
-      if (record.expiresAt <= Date.now()) {
-        return err(HaiIamError.TICKET_EXPIRED, iamM("iam_ticketExpired"));
-      }
-      if (options?.purpose !== void 0 && options.purpose !== record.purpose) {
-        return err(HaiIamError.TICKET_INVALID, iamM("iam_ticketInvalid"));
-      }
-      return ok({
-        subjectId: record.subjectId,
-        purpose: record.purpose,
-        grant: record.grant
-      });
-    }
-  };
-}
-var logger10 = core.logger.child({ module: "iam", scope: "user" });
+var logger12 = core.logger.child({ module: "iam", scope: "user" });
 var USER_SORT_COLUMNS = {
   /** 用户名列。 */
   username: "username",
@@ -4354,10 +4891,10 @@ async function createUserOperations(deps) {
       config,
       onPasswordResetRequest
     });
-    logger10.info("User sub-feature initialized");
+    logger12.info("User sub-feature initialized");
     return ok(functions);
   } catch (error) {
-    logger10.error("User sub-feature initialization failed", { error });
+    logger12.error("User sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -4420,10 +4957,26 @@ async function validateUniqueFieldsForUpdate(userRepository, userId, data) {
   }
   return ok(void 0);
 }
+function validatePasswordReplacement(ctx, user, password) {
+  const strength = ctx.validatePassword(password);
+  if (!strength.success)
+    return strength;
+  if (user.passwordHash && (user.mustChangePassword && ctx.config.password?.requireInitialChange || ctx.config.password?.preventSamePassword || (ctx.config.password?.expirationDays ?? 0) > 0)) {
+    const same = crypto$1.password.verify(password, user.passwordHash);
+    if (!same.success)
+      return same;
+    if (same.data)
+      return err(HaiIamError.PASSWORD_POLICY_VIOLATION, iamM("iam_passwordMustDiffer"));
+  }
+  return ok(void 0);
+}
 function buildRegistrationOps(ctx) {
   const { userRepository, authzFunctions, config, registerConfig, agreementConfig } = ctx;
   const { validatePassword, hashPassword } = ctx;
   async function validateRegisterPreconditions(options) {
+    const accountPolicy = validateAccountPolicy(options);
+    if (!accountPolicy.success)
+      return accountPolicy;
     const validateResult = validatePassword(options.password);
     if (!validateResult.success)
       return validateResult;
@@ -4459,7 +5012,7 @@ function buildRegistrationOps(ctx) {
       return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
     return authzFunctions.assignRole(userId, roleResult.data.id);
   }
-  async function createUser(options, enabled) {
+  async function createUser(options, enabled, managed = false) {
     const preResult = await validateRegisterPreconditions(options);
     if (!preResult.success)
       return preResult;
@@ -4477,6 +5030,10 @@ function buildRegistrationOps(ctx) {
       phone: options.phone,
       displayName: options.displayName,
       enabled,
+      accountType: options.accountType ?? "permanent",
+      accountStatus: options.accountStatus ?? "active",
+      accountExpiresAt: options.accountExpiresAt,
+      mustChangePassword: managed && config.password?.requireInitialChange === true,
       emailVerified: false,
       phoneVerified: false,
       passwordHash: hashResult.data,
@@ -4506,15 +5063,18 @@ function buildRegistrationOps(ctx) {
       await userRepository.deleteById(createdUser.id);
       return assigned;
     }
-    logger10.info("User registered", { userId: createdUser.id, username: options.username });
+    logger12.info("User registered", { userId: createdUser.id, username: options.username });
     return ok({
       user: toUser(createdUser),
       agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnRegister)
     });
   }
   return {
-    createUser: (options) => createUser(options, true),
-    register(options) {
+    createUser: (options) => createUser(options, true, true),
+    async register(options) {
+      const captcha = await verifyIamCaptcha(ctx.config.captcha, "register", options.captcha);
+      if (!captcha.success)
+        return captcha;
       if (!registerConfig.enabled)
         return Promise.resolve(err(HaiIamError.REGISTER_DISABLED, iamM("iam_registerDisabled")));
       return createUser(options, registerConfig.defaultEnabled);
@@ -4693,6 +5253,18 @@ function buildUserMutationOps(ctx) {
       return ok(toUser(updatedResult.data));
     },
     async updateUser(userId, data) {
+      const currentAccount = await userRepository.findById(userId);
+      if (!currentAccount.success)
+        return currentAccount;
+      if (!currentAccount.data)
+        return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
+      const accountPolicy = validateAccountPolicy({
+        accountType: data.accountType === void 0 ? currentAccount.data.accountType : data.accountType,
+        accountStatus: data.accountStatus === void 0 ? currentAccount.data.accountStatus : data.accountStatus,
+        accountExpiresAt: data.accountExpiresAt === void 0 ? currentAccount.data.accountExpiresAt : data.accountExpiresAt
+      });
+      if (!accountPolicy.success)
+        return accountPolicy;
       if (!hasUpdateFields(data)) {
         const currentResult = await userRepository.findById(userId);
         if (!currentResult.success) {
@@ -4710,18 +5282,37 @@ function buildUserMutationOps(ctx) {
       if (!uniqueResult.success) {
         return uniqueResult;
       }
-      const updateResult = await userRepository.updateById(userId, data);
-      if (!updateResult.success) {
-        return mapUpdateErrorAsDomainError(updateResult.error);
-      }
-      if (updateResult.data.changes === 0) {
-        return err(
-          HaiIamError.USER_NOT_FOUND,
-          iamM("iam_userNotExist")
-        );
+      const changesSecurity = data.enabled !== void 0 || data.accountStatus !== void 0 || data.accountType !== void 0 || data.accountExpiresAt !== void 0;
+      const transaction = changesSecurity ? await reldb.tx.begin() : void 0;
+      if (transaction && !transaction.success)
+        return transaction;
+      const tx = transaction?.success ? transaction.data : void 0;
+      let transactionCommitted = false;
+      try {
+        const updateResult = await userRepository.updateById(userId, data, tx);
+        if (!updateResult.success)
+          return mapUpdateErrorAsDomainError(updateResult.error);
+        if (updateResult.data.changes === 0)
+          return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
+        if (tx) {
+          const advanced = await tx.execute("UPDATE hai_iam_users SET credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL WHERE id = ? AND credential_version = ?", [globalThis.crypto.randomUUID(), globalThis.crypto.randomUUID(), userId, currentAccount.data.credentialVersion ?? ""]);
+          if (!advanced.success || advanced.data.changes !== 1)
+            return advanced.success ? err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict")) : advanced;
+          const committed = await tx.commit();
+          if (!committed.success)
+            return committed;
+          transactionCommitted = true;
+        }
+      } catch (cause) {
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_accountUpdateFailed"), cause);
+      } finally {
+        if (tx && !transactionCommitted)
+          await tx.rollback();
       }
-      if (data.enabled === false) {
-        await sessionFunctions.deleteByUserId(userId);
+      if (tx) {
+        const revoked = await sessionFunctions.deleteByUserId(userId);
+        if (!revoked.success)
+          logger12.warn("Account credentials revoked; session cache cleanup failed", { userId, error: revoked.error });
       }
       const updatedResult = await userRepository.findById(userId);
       if (!updatedResult.success) {
@@ -4736,7 +5327,7 @@ function buildUserMutationOps(ctx) {
       return ok(toUser(updatedResult.data));
     },
     async deleteUser(userId) {
-      logger10.debug("Deleting user", { userId });
+      logger12.debug("Deleting user", { userId });
       const userResult = await userRepository.findById(userId);
       if (!userResult.success) {
         return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
@@ -4776,17 +5367,17 @@ function buildUserMutationOps(ctx) {
         );
       }
       await sessionFunctions.deleteByUserId(userId);
-      logger10.info("User deleted", { userId });
+      logger12.info("User deleted", { userId });
       return ok(void 0);
     }
   };
 }
 function buildPasswordChangeOps(ctx) {
   const { userRepository, sessionFunctions } = ctx;
-  const { validatePassword, hashPassword } = ctx;
+  const { hashPassword } = ctx;
   return {
     async adminResetPassword(userId, newPassword) {
-      logger10.debug("Admin resetting user password", { userId });
+      logger12.debug("Admin resetting user password", { userId });
       const userResult = await userRepository.findById(userId);
       if (!userResult.success) {
         return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
@@ -4797,13 +5388,13 @@ function buildPasswordChangeOps(ctx) {
           iamM("iam_userNotExist")
         );
       }
-      const validateResult = validatePassword(newPassword);
+      const validateResult = validatePasswordReplacement(ctx, userResult.data, newPassword);
       if (!validateResult.success)
         return validateResult;
       const hashResult = hashPassword(newPassword);
       if (!hashResult.success)
         return hashResult;
-      const updateResult = await userRepository.setPassword({ userId, expectedVersion: userResult.data.credentialVersion ?? "", passwordHash: hashResult.data });
+      const updateResult = await userRepository.setPassword({ userId, expectedVersion: userResult.data.credentialVersion ?? "", passwordHash: hashResult.data, mustChangePassword: ctx.config.password?.requireInitialChange === true });
       if (!updateResult.success)
         return updateResult;
       if (!updateResult.data)
@@ -4811,7 +5402,7 @@ function buildPasswordChangeOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(userId);
       if (!revoked.success)
         return revoked;
-      logger10.info("Admin reset password", { userId });
+      logger12.info("Admin reset password", { userId });
       return ok(void 0);
     },
     async changePassword(userId, oldPassword, newPassword) {
@@ -4826,10 +5417,10 @@ function buildPasswordChangeOps(ctx) {
         );
       }
       const user = userResult.data;
-      if (!user.enabled) {
+      if (!isUserActive(user)) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       }
-      if (isAccountLocked(user)) {
+      if (isAccountLocked(user, ctx.loginConfig)) {
         return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
       }
       if (!user.passwordHash) {
@@ -4840,10 +5431,7 @@ function buildPasswordChangeOps(ctx) {
       }
       const verifyResult = crypto$1.password.verify(oldPassword, user.passwordHash);
       if (!verifyResult.success || !verifyResult.data) {
-        const failureResult = await recordLoginFailure(userRepository, user, {
-          maxLoginAttempts: ctx.loginConfig.maxLoginAttempts,
-          lockoutDuration: ctx.loginConfig.lockoutDuration
-        });
+        const failureResult = await recordLoginFailure(userRepository, user, ctx.loginConfig);
         if (!failureResult.success)
           return failureResult;
         return err(
@@ -4851,10 +5439,10 @@ function buildPasswordChangeOps(ctx) {
           iamM("iam_originalPasswordWrong")
         );
       }
-      const resetResult = await resetLoginFailures(userRepository, user);
+      const resetResult = await resetLoginFailures(userRepository, user, ctx.loginConfig);
       if (!resetResult.success)
         return resetResult;
-      const validateResult = validatePassword(newPassword);
+      const validateResult = validatePasswordReplacement(ctx, user, newPassword);
       if (!validateResult.success)
         return validateResult;
       const hashResult = hashPassword(newPassword);
@@ -4868,7 +5456,7 @@ function buildPasswordChangeOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(userId);
       if (!revoked.success)
         return revoked;
-      logger10.info("Password changed", { userId });
+      logger12.info("Password changed", { userId });
       return ok(void 0);
     },
     /**
@@ -4888,48 +5476,58 @@ function buildPasswordChangeOps(ctx) {
     }
   };
 }
+async function issuePasswordReset(ctx, stored) {
+  const { userRepository, onPasswordResetRequest, resetConfig } = ctx;
+  if (!onPasswordResetRequest)
+    return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
+  const user = toUser(stored);
+  const token = generateToken();
+  const expiresAt = new Date(Date.now() + resetConfig.tokenExpiresIn * 1e3);
+  const tokenHash = crypto$1.hash.hash(token);
+  if (!tokenHash.success)
+    return tokenHash;
+  const saveResult = await userRepository.publishPasswordReset({ user: stored, tokenHash: tokenHash.data, expiresAt });
+  if (!saveResult.success)
+    return saveResult;
+  if (!saveResult.data)
+    return err(HaiIamError.CONFLICT, iamM("iam_securityStateFailed"));
+  try {
+    await onPasswordResetRequest(user, token, { expiresAt, idempotencyKey: `iam-reset:${tokenHash.data}` });
+  } catch {
+    logger12.error("Password reset callback failed", { userId: user.id });
+    return err(HaiIamError.INTERNAL_ERROR, iamM("iam_notificationDeliveryUnknown"));
+  }
+  logger12.info("Password reset token generated", { userId: user.id });
+  return ok(void 0);
+}
 function buildPasswordResetOps(ctx) {
   const { userRepository, sessionFunctions, onPasswordResetRequest } = ctx;
-  const { validatePassword, hashPassword } = ctx;
+  const { hashPassword } = ctx;
   return {
-    async requestPasswordReset(identifier) {
-      logger10.debug("Password reset requested", { identifier });
+    async requestPasswordReset(identifier, options) {
+      const captcha = await verifyIamCaptcha(ctx.config.captcha, "passwordReset", options?.captcha);
+      if (!captcha.success)
+        return captcha;
+      logger12.debug("Password reset requested", { identifier });
       const resetConfig = ctx.resetConfig;
       if (!resetConfig.enabled || !onPasswordResetRequest)
         return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
       const userResult = await userRepository.findByIdentifier(identifier);
       if (!userResult.success) {
-        logger10.warn("Failed to look up user for password reset", { identifier });
+        logger12.warn("Failed to look up user for password reset", { identifier });
         return ok(void 0);
       }
       if (!userResult.data) {
-        logger10.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
+        logger12.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
         return ok(void 0);
       }
       const user = toUser(userResult.data);
       if (!user.enabled)
         return ok(void 0);
-      const token = generateToken();
-      const expiresAt = new Date(Date.now() + resetConfig.tokenExpiresIn * 1e3);
-      const tokenHash = crypto$1.hash.hash(token);
-      if (!tokenHash.success)
-        return tokenHash;
-      const saveResult = await userRepository.publishPasswordReset({ user: userResult.data, tokenHash: tokenHash.data, expiresAt });
-      if (!saveResult.success)
-        return saveResult;
-      if (!saveResult.data)
-        return err(HaiIamError.CONFLICT, iamM("iam_securityStateFailed"));
-      try {
-        await onPasswordResetRequest(user, token, { expiresAt, idempotencyKey: `iam-reset:${tokenHash.data}` });
-      } catch {
-        logger10.error("Password reset callback failed", { userId: user.id });
-        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_notificationDeliveryUnknown"));
-      }
-      logger10.info("Password reset token generated", { userId: user.id });
-      return ok(void 0);
+      return issuePasswordReset(ctx, userResult.data);
     },
     async confirmPasswordReset(token, newPassword) {
-      logger10.debug("Confirming password reset");
+      logger12.debug("Confirming password reset");
       const resetConfig = ctx.resetConfig;
       if (!resetConfig.enabled)
         return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
@@ -4939,7 +5537,7 @@ function buildPasswordResetOps(ctx) {
       const claimed = await userRepository.claimPasswordReset(tokenHash.data, resetConfig.maxAttempts);
       if (!claimed.success)
         return claimed;
-      const validateResult = validatePassword(newPassword);
+      const validateResult = validatePasswordReplacement(ctx, claimed.data, newPassword);
       if (!validateResult.success)
         return validateResult;
       const hashResult = hashPassword(newPassword);
@@ -4953,7 +5551,7 @@ function buildPasswordResetOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(claimed.data.id);
       if (!revoked.success)
         return revoked;
-      logger10.info("Password reset confirmed", { userId: claimed.data.id });
+      logger12.info("Password reset confirmed", { userId: claimed.data.id });
       return ok(void 0);
     }
   };
@@ -4969,17 +5567,56 @@ function buildUserFunctions(deps) {
     resetConfig: PasswordResetConfigSchema.parse(deps.config.passwordReset ?? {}),
     loginConfig: SecurityConfigSchema.parse(deps.config.security ?? {})
   };
+  const passwordChanges = buildPasswordChangeOps(ctx);
+  const registration = buildRegistrationOps(ctx);
   return {
-    ...buildRegistrationOps(ctx),
+    ...registration,
     ...buildUserQueryOps(ctx),
     ...buildUserMutationOps(ctx),
-    ...buildPasswordChangeOps(ctx),
-    ...buildPasswordResetOps(ctx)
+    ...passwordChanges,
+    ...buildPasswordResetOps(ctx),
+    async inviteUser(options) {
+      const destination = ctx.resetConfig.mode === "phone" ? options.phone : options.email;
+      if (!deps.config.initialCredentials?.enabled || !ctx.resetConfig.enabled || !ctx.onPasswordResetRequest || !destination)
+        return err(HaiIamError.INVITATION_DISABLED, iamM("iam_invitationDisabled"));
+      const policy = deps.passwordStrategyResult.passwordConfig;
+      const length = Math.min(policy.maxLength, Math.max(32, policy.minLength));
+      const password = `Aa1!${Array.from({ length: Math.ceil(length / 32) }, () => generateToken()).join("")}`.slice(0, length);
+      const created = await registration.createUser({ ...options, password });
+      if (!created.success)
+        return created;
+      const stored = await deps.userRepository.findById(created.data.user.id);
+      if (!stored.success || !stored.data)
+        return err(HaiIamError.INVITATION_DELIVERY_UNKNOWN, iamM("iam_invitationDeliveryUnknown"));
+      const delivered = await issuePasswordReset(ctx, stored.data);
+      if (!delivered.success)
+        return err(HaiIamError.INVITATION_DELIVERY_UNKNOWN, iamM("iam_invitationDeliveryUnknown"), delivered.error);
+      return created;
+    },
+    async renewPassword(input) {
+      const captcha = await verifyIamCaptcha(deps.config.captcha, "renewPassword", input.captcha);
+      if (!captcha.success)
+        return captcha;
+      const found = await deps.userRepository.findByIdentifier(input.identifier);
+      if (!found.success)
+        return found;
+      if (!found.data) {
+        crypto$1.password.hash("dummy-password-to-prevent-timing-leak");
+        return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
+      }
+      return passwordChanges.changePassword(found.data.id, input.password, input.newPassword);
+    },
+    async scanInactiveAccounts() {
+      const days = deps.config.accounts?.dormantAfterDays ?? 0;
+      if (days === 0)
+        return ok(0);
+      return deps.userRepository.suspendInactive(new Date(Date.now() - days * 864e5));
+    }
   };
 }
 
 // src/iam-main.ts
-var logger11 = core.logger.child({ module: "iam", scope: "main" });
+var logger13 = core.logger.child({ module: "iam", scope: "main" });
 var initInProgress = false;
 var currentConfig = null;
 var currentPublicConfig = null;
@@ -4989,6 +5626,8 @@ var currentAuthz = null;
 var currentSession = null;
 var currentApiKey = null;
 var currentTicket = null;
+var accountScanTimer;
+var accountScanRunning;
 var notInitialized = core.module.createNotInitializedKit(
   HaiIamError.NOT_INITIALIZED,
   () => iamM("iam_notInitialized")
@@ -5008,7 +5647,7 @@ var notInitializedUser = new Proxy({}, {
 var iam = {
   async init(config) {
     if (initInProgress) {
-      logger11.warn("IAM init already in progress, skipping concurrent call");
+      logger13.warn("IAM init already in progress, skipping concurrent call");
       return err(
         HaiIamError.CONFIG_ERROR,
         iamM("iam_initInProgress")
@@ -5017,11 +5656,11 @@ var iam = {
     initInProgress = true;
     try {
       if (currentConfig !== null) {
-        logger11.warn("IAM module is already initialized, reinitializing");
+        logger13.warn("IAM module is already initialized, reinitializing");
         await iam.close();
       }
       const { ldapClientFactory, ldapSyncUser } = config;
-      logger11.info("Initializing IAM module");
+      logger13.info("Initializing IAM module");
       if (!reldb.isInitialized) {
         return err(
           HaiIamError.CONFIG_ERROR,
@@ -5046,7 +5685,7 @@ var iam = {
       }
       const parseResult = IamConfigSchema.safeParse(config);
       if (!parseResult.success) {
-        logger11.error("IAM config validation failed", { error: parseResult.error.message });
+        logger13.error("IAM config validation failed", { error: parseResult.error.message });
         return err(
           HaiIamError.CONFIG_ERROR,
           iamM("iam_configError", { params: { error: parseResult.error.message } }),
@@ -5055,7 +5694,7 @@ var iam = {
       }
       const parsed = parseResult.data;
       const { onPasswordResetRequest, onOtpSendEmail, onOtpSendSms } = await resolveIamNotifications(config);
-      logger11.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
+      logger13.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
       const migration = await migrateIam();
       if (!migration.success)
         return migration;
@@ -5066,20 +5705,27 @@ var iam = {
           const found = await credentialUsers.findById(userId);
           if (!found.success)
             return found;
-          return ok(found.data ? { version: found.data.credentialVersion ?? "", enabled: found.data.enabled } : null);
+          if (found.data) {
+            const passwordState = checkPasswordState(found.data, parsed.password);
+            if (!passwordState.success)
+              return passwordState;
+          }
+          return ok(found.data ? { version: found.data.credentialVersion ?? "", enabled: isUserActive(found.data) } : null);
         }
       });
       if (!sessionResult.success) {
         return sessionResult;
       }
-      const authzResult = await createAuthzOperations({ config: parsed, session: sessionResult.data });
+      const sessions = observeSessions(sessionResult.data);
+      const authzResult = await createAuthzOperations({ config: parsed, session: sessions });
       if (!authzResult.success) {
         return authzResult;
       }
+      const authorization = observeAuthorization(authzResult.data);
       const authnResult = await createAuthnOperations({
         config: parsed,
-        sessionFunctions: sessionResult.data,
-        authzFunctions: authzResult.data,
+        sessionFunctions: sessions,
+        authzFunctions: authorization,
         ldapClientFactory,
         ldapSyncUser,
         onOtpSendEmail,
@@ -5091,41 +5737,57 @@ var iam = {
       const userResult = await createUserOperations({
         config: parsed,
         passwordStrategyResult: authnResult.data.passwordStrategyResult,
-        sessionFunctions: sessionResult.data,
-        authzFunctions: authzResult.data,
+        sessionFunctions: sessions,
+        authzFunctions: authorization,
         onPasswordResetRequest
       });
       if (!userResult.success) {
         return userResult;
       }
+      const users = observeUsers(userResult.data);
       if (parsed.seedDefaultData) {
-        const seedResult = await seedIamData(authzResult.data);
+        const seedResult = await seedIamData(authorization);
         if (!seedResult.success) {
           return seedResult;
         }
       }
-      currentSession = sessionResult.data;
-      currentAuthz = authzResult.data;
-      currentUser = userResult.data;
+      currentSession = sessions;
+      currentAuthz = authorization;
+      currentUser = users;
       currentConfig = parsed;
       currentPublicConfig = buildIamPublicConfig(parsed, { ...config, onPasswordResetRequest, onOtpSendEmail, onOtpSendSms });
-      currentApiKey = authnResult.data.apiKeyFunctions;
+      currentApiKey = authnResult.data.apiKeyFunctions ? observeApiKeys(authnResult.data.apiKeyFunctions) : null;
       currentTicket = createTicketOperations();
       const authn = authnResult.data.authn;
-      currentAuth = {
+      currentAuth = observeAuth({
         ...authn,
-        async registerAndLogin(options) {
+        async registerAndLogin(options, context) {
           const regResult = await currentUser.register(options);
           if (!regResult.success) {
             return regResult;
           }
-          return authnResult.data.loginRegisteredUser(regResult.data.user);
+          return authnResult.data.loginRegisteredUser(regResult.data.user, context);
         }
-      };
-      logger11.info("IAM module initialized");
+      });
+      if ((parsed.accounts?.dormantAfterDays ?? 0) > 0) {
+        accountScanTimer = setInterval(() => {
+          if (accountScanRunning)
+            return;
+          accountScanRunning = users.scanInactiveAccounts().then((result) => {
+            if (!result.success)
+              logger13.error("Inactive account scan failed", { error: result.error });
+          }).catch((error) => {
+            logger13.error("Inactive account scan failed", { error });
+          }).finally(() => {
+            accountScanRunning = void 0;
+          });
+        }, (parsed.accounts?.scanIntervalSeconds ?? 3600) * 1e3);
+        accountScanTimer.unref();
+      }
+      logger13.info("IAM module initialized");
       return ok(void 0);
     } catch (error) {
-      logger11.error("IAM module initialization failed", { error });
+      logger13.error("IAM module initialization failed", { error });
       return err(
         HaiIamError.CONFIG_ERROR,
         iamM("iam_initFailed"),
@@ -5138,6 +5800,18 @@ var iam = {
   get auth() {
     return currentAuth ?? notInitializedAuth;
   },
+  async getPublicConfig() {
+    const snapshot = currentPublicConfig ? structuredClone(currentPublicConfig) : null;
+    const authz = currentAuthz;
+    if (!snapshot || !authz)
+      return notInitialized.result();
+    if (!snapshot.reauthentication.enabled)
+      return ok(snapshot);
+    const configured = await authz.getSensitiveOperations();
+    if (!configured.success)
+      return configured;
+    return ok({ ...snapshot, reauthentication: { ...snapshot.reauthentication, operations: [.../* @__PURE__ */ new Set([...snapshot.reauthentication.operations, ...configured.data])].sort() } });
+  },
   get user() {
     return currentUser ?? notInitializedUser;
   },
@@ -5167,10 +5841,13 @@ var iam = {
   },
   async close() {
     if (currentConfig === null && currentAuth === null && currentUser === null && currentAuthz === null && currentSession === null) {
-      logger11.info("IAM module already closed, skipping");
+      logger13.info("IAM module already closed, skipping");
       return;
     }
-    logger11.info("Closing IAM module");
+    logger13.info("Closing IAM module");
+    clearInterval(accountScanTimer);
+    accountScanTimer = void 0;
+    await accountScanRunning;
     currentAuth = null;
     currentUser = null;
     currentAuthz = null;
@@ -5184,7 +5861,7 @@ var iam = {
     resetUserRepoSingleton();
     resetRoleRepoSingleton();
     resetPermissionRepoSingleton();
-    logger11.info("IAM module closed");
+    logger13.info("IAM module closed");
   }
 };