@h-ai/iam 0.1.0-alpha.73 → 0.1.0-alpha.75

package/dist/index.js

@@ -1,10 +1,10 @@
-import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-22SERPFD.js';
-export { AccountConfigSchema, AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, CaptchaConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginAccessConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-22SERPFD.js';
+import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-KPG3M34Q.js';
+export { AccountConfigSchema, AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, CaptchaConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginAccessConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-KPG3M34Q.js';
 import { cache } from '@h-ai/cache';
 import { core, err, ok } from '@h-ai/core';
 import { crypto as crypto$1 } from '@h-ai/crypto';
 import { migrateSchema, reldb, schemaColumns, BaseReldbCrudRepository, HaiReldbError } from '@h-ai/reldb';
-import { createHash, randomBytes, randomInt } from 'crypto';
+import { randomUUID, createHash, randomBytes, randomInt } from 'crypto';
 import { isIP, BlockList } from 'net';
 import { verifySolution, pbkdf2, createChallenge } from 'altcha/lib';
 import { z } from 'zod';
@@ -213,7 +213,9 @@ var en_US_default = {
   iam_captchaRequired: "Complete the security check first",
   iam_captchaInvalid: "Security check is invalid or expired; try again",
   iam_captchaDisabled: "Security challenges are disabled",
-  iam_captchaUnavailable: "Security check is temporarily unavailable"
+  iam_captchaUnavailable: "Security check is temporarily unavailable",
+  iam_sensitiveOperationsInvalid: "Invalid sensitive operation IDs: use at most 1000 entries of 1\u2013128 characters each.",
+  iam_terminalTypeInvalid: "Invalid terminal type: use web, app, desktop or api."
 };
 
 // messages/ja-JP.json
@@ -419,7 +421,9 @@ var ja_JP_default = {
   iam_captchaRequired: "\u5148\u306B\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u3092\u5B8C\u4E86\u3057\u3066\u304F\u3060\u3055\u3044",
   iam_captchaInvalid: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u304C\u7121\u52B9\u307E\u305F\u306F\u671F\u9650\u5207\u308C\u3067\u3059\u3002\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
   iam_captchaDisabled: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u306F\u7121\u52B9\u3067\u3059",
-  iam_captchaUnavailable: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u3092\u4E00\u6642\u7684\u306B\u5229\u7528\u3067\u304D\u307E\u305B\u3093"
+  iam_captchaUnavailable: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u3092\u4E00\u6642\u7684\u306B\u5229\u7528\u3067\u304D\u307E\u305B\u3093",
+  iam_sensitiveOperationsInvalid: "\u91CD\u8981\u64CD\u4F5C ID \u306F\u6700\u59271000\u4EF6\u3001\u54041\uFF5E128\u6587\u5B57\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_terminalTypeInvalid: "\u7AEF\u672B\u7A2E\u5225\u306F web\u3001app\u3001desktop\u3001api \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
 };
 
 // messages/zh-CN.json
@@ -625,7 +629,9 @@ var zh_CN_default = {
   iam_captchaRequired: "\u8BF7\u5148\u5B8C\u6210\u5B89\u5168\u9A8C\u8BC1",
   iam_captchaInvalid: "\u5B89\u5168\u9A8C\u8BC1\u65E0\u6548\u6216\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u8BD5",
   iam_captchaDisabled: "\u5B89\u5168\u9A8C\u8BC1\u672A\u542F\u7528",
-  iam_captchaUnavailable: "\u5B89\u5168\u9A8C\u8BC1\u6682\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5"
+  iam_captchaUnavailable: "\u5B89\u5168\u9A8C\u8BC1\u6682\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  iam_sensitiveOperationsInvalid: "\u654F\u611F\u64CD\u4F5C ID \u5217\u8868\u65E0\u6548\uFF1A\u6700\u591A 1000 \u9879\uFF0C\u6BCF\u9879\u4E3A 1\u2013128 \u5B57\u7B26\u3002",
+  iam_terminalTypeInvalid: "\u7EC8\u7AEF\u7C7B\u578B\u65E0\u6548\uFF0C\u8BF7\u4F7F\u7528 web\u3001app\u3001desktop \u6216 api\u3002"
 };
 
 // src/iam-i18n.ts
@@ -635,6 +641,118 @@ var iamM = core.i18n.createMessageGetter({
   "ja-JP": ja_JP_default
 });
 
+// src/iam-cache.ts
+var revisionKey = "hai:iam:read_cache:revision";
+var transactions = /* @__PURE__ */ new WeakMap();
+var logger = core.logger.child({ module: "iam", scope: "read-cache" });
+var degraded = false;
+function failure() {
+  return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_sessionExpired"));
+}
+async function revision() {
+  const current = await cache.kv.get(revisionKey);
+  if (!current.success)
+    return current;
+  if (current.data)
+    return ok(current.data);
+  const created = await cache.kv.set(revisionKey, { epoch: randomUUID(), writers: 0 }, { nx: true });
+  if (!created.success)
+    return created;
+  const loaded = await cache.kv.get(revisionKey);
+  return loaded.success && loaded.data ? ok(loaded.data) : failure();
+}
+async function change(delta) {
+  for (let attempt = 0; attempt < 32; attempt++) {
+    const current = await revision();
+    if (!current.success)
+      return current;
+    const written = await cache.kv.compareAndSwap(revisionKey, current.data, { epoch: randomUUID(), writers: Math.max(0, current.data.writers + delta) });
+    if (!written.success)
+      return written;
+    if (written.data)
+      return ok(void 0);
+  }
+  return failure();
+}
+async function readIamCache(key, load) {
+  const before = await revision();
+  if (!before.success || before.data.writers)
+    return load();
+  const address = `hai:iam:read_cache:${before.data.epoch}:${key}`;
+  const cached = await cache.kv.get(address);
+  if (cached.success && cached.data) {
+    const after2 = await revision();
+    if (after2.success && !after2.data.writers && after2.data.epoch === before.data.epoch)
+      return ok(cached.data.value);
+    return load();
+  }
+  const result = await load();
+  if (!result.success)
+    return result;
+  const after = await revision();
+  if (after.success && !after.data.writers && after.data.epoch === before.data.epoch)
+    await cache.kv.set(address, { value: result.data }, { ex: 60 });
+  return result;
+}
+async function finish() {
+  const completed = await change(-1);
+  if (!completed.success && !degraded) {
+    degraded = true;
+    logger.warn("IAM cache invalidation incomplete; authorization reads use database", { code: completed.error.code });
+  }
+  if (completed.success)
+    degraded = false;
+}
+async function enroll(tx) {
+  const existing = transactions.get(tx);
+  if (existing)
+    return existing;
+  const pending = (async () => {
+    const started = await change(1);
+    if (!started.success)
+      return started;
+    const commit = tx.commit.bind(tx);
+    const rollback = tx.rollback.bind(tx);
+    tx.commit = async () => {
+      const result = await commit();
+      if (result.success)
+        await finish();
+      return result;
+    };
+    tx.rollback = async () => {
+      const result = await rollback();
+      if (result.success)
+        await finish();
+      return result;
+    };
+    return ok(void 0);
+  })();
+  transactions.set(tx, pending);
+  return pending;
+}
+function guardIamMutation(operation, txIndex) {
+  return async (...args) => {
+    const candidate = txIndex === void 0 ? void 0 : args[txIndex];
+    const tx = candidate;
+    let started;
+    try {
+      started = tx ? await enroll(tx) : await change(1);
+    } catch {
+      return failure();
+    }
+    if (!started.success)
+      return started;
+    try {
+      return await operation(...args);
+    } catch {
+      return failure();
+    } finally {
+      if (!tx)
+        await finish();
+    }
+  };
+}
+
 // src/authn/apikey/iam-authn-apikey-repository.ts
 var TABLE_NAME = "hai_iam_api_keys";
 var API_KEY_SORT_COLUMNS = {
@@ -736,6 +854,10 @@ async function createDbApiKeyRepository() {
     return apiKeyRepoInstance;
   const repo = new DbApiKeyRepository();
   await repo.count();
+  repo.removeById = guardIamMutation(repo.removeById.bind(repo), 1);
+  const update = repo.updateFields.bind(repo);
+  const protectedUpdate = guardIamMutation(update, 2);
+  repo.updateFields = (id, data, tx) => Object.keys(data).every((key) => key === "lastUsedAt") ? update(id, data, tx) : protectedUpdate(id, data, tx);
   apiKeyRepoInstance = repo;
   apiKeyRepoSqlOps = reldb.sql;
   return repo;
@@ -882,6 +1004,7 @@ function buildSession(options, now, sessionTtl, accessToken, credentialVersion)
     roles: options.roles ?? [],
     permissions: options.permissions ?? [],
     source: options.source,
+    terminalType: options.terminalType ?? "web",
     accessToken,
     createdAt: now,
     startedAt: now,
@@ -921,7 +1044,7 @@ function applySessionPatch(session, patch) {
 }
 
 // src/ticket/iam-ticket-functions.ts
-var logger = core.logger.child({ module: "iam", scope: "ticket" });
+var logger2 = core.logger.child({ module: "iam", scope: "ticket" });
 var TICKET_KEY_PREFIX = "hai:iam:ticket:";
 var DEFAULT_TICKET_TTL_MS = 3e4;
 function buildTicketKey(ticket) {
@@ -941,7 +1064,7 @@ function createTicketOperations() {
       };
       const saved = await cache.kv.set(buildTicketKey(ticket), record, { px: ttlMs, nx: true });
       if (!saved.success || !saved.data) {
-        logger.warn("Failed to issue ticket", { purpose: options.purpose });
+        logger2.warn("Failed to issue ticket", { purpose: options.purpose });
         return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
       }
       return ok({ ticket, expiresAt });
@@ -1145,6 +1268,12 @@ async function createDbUserRepository() {
     return userRepoInstance;
   const repo = new DbUserRepository();
   await repo.count();
+  repo.create = guardIamMutation(repo.create.bind(repo), 1);
+  repo.updateById = guardIamMutation(repo.updateById.bind(repo), 2);
+  repo.deleteById = guardIamMutation(repo.deleteById.bind(repo), 1);
+  repo.suspendInactive = guardIamMutation(repo.suspendInactive.bind(repo));
+  repo.setPassword = guardIamMutation(repo.setPassword.bind(repo));
+  repo.commitPasswordReset = guardIamMutation(repo.commitPasswordReset.bind(repo));
   userRepoInstance = repo;
   userRepoSqlOps = reldb.sql;
   return repo;
@@ -1415,7 +1544,7 @@ async function resetLoginFailures(userRepository, user, policy) {
 }
 
 // src/authn/apikey/iam-authn-apikey-strategy.ts
-var logger2 = core.logger.child({ module: "iam", scope: "apikey-strategy" });
+var logger3 = core.logger.child({ module: "iam", scope: "apikey-strategy" });
 var KEY_PREFIX_LENGTH = 12;
 function generateRawKey(prefix2) {
   const hex = randomBytes(32).toString("hex");
@@ -1441,7 +1570,7 @@ function createApiKeyStrategy(config) {
   const apikeyConfig = config.apikeyConfig ? ApiKeyConfigSchema.parse(config.apikeyConfig) : ApiKeyConfigSchema.parse({});
   const { userRepository, apiKeyRepository } = config;
   const passwordOps = crypto$1.password;
-  async function verifyRawKey(rawKey) {
+  async function loadRawKey(rawKey) {
     const prefix2 = extractKeyPrefix(rawKey);
     const candidatesResult = await apiKeyRepository.findByKeyPrefix(prefix2);
     if (!candidatesResult.success) {
@@ -1460,12 +1589,26 @@ function createApiKeyStrategy(config) {
         return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
       }
       apiKeyRepository.updateFields(candidate.id, { lastUsedAt: /* @__PURE__ */ new Date() }).catch(() => {
-        logger2.warn("Failed to update API Key lastUsedAt", { keyId: candidate.id });
+        logger3.warn("Failed to update API Key lastUsedAt", { keyId: candidate.id });
       });
       return ok(toApiKey(candidate));
     }
     return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
   }
+  async function verifyRawKey(rawKey) {
+    const fingerprint = createHash("sha256").update(rawKey).digest("hex");
+    const result = await readIamCache(`verified_apikey:${fingerprint}`, async () => {
+      const verified = await loadRawKey(rawKey);
+      return verified.success ? ok({ ...verified.data, expiresAt: verified.data.expiresAt?.getTime() ?? null, createdAt: verified.data.createdAt.getTime(), lastUsedAt: verified.data.lastUsedAt?.getTime() ?? null }) : verified;
+    });
+    if (!result.success)
+      return result;
+    if (!result.data.enabled)
+      return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
+    if (result.data.expiresAt !== null && result.data.expiresAt <= Date.now())
+      return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
+    return ok({ ...result.data, expiresAt: result.data.expiresAt === null ? null : new Date(result.data.expiresAt), createdAt: new Date(result.data.createdAt), lastUsedAt: result.data.lastUsedAt === null ? null : new Date(result.data.lastUsedAt) });
+  }
   const strategy = {
     type: "apikey",
     name: "apikey-strategy",
@@ -1490,7 +1633,7 @@ function createApiKeyStrategy(config) {
       if (!isUserActive(userResult.data)) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       }
-      logger2.info("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
+      logger3.debug("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
       return ok({ user: { ...toUser(userResult.data), credentialVersion: userResult.data.credentialVersion ?? "" }, apiKey });
     }
   };
@@ -1527,7 +1670,7 @@ function createApiKeyStrategy(config) {
         const insertResult = await apiKeyRepository.insert(storedApiKey);
         if (!insertResult.success)
           return insertResult;
-        logger2.info("API Key created", { userId, keyId: id, name: options.name });
+        logger3.info("API Key created", { userId, keyId: id, name: options.name });
         return ok({ apiKey: toApiKey(storedApiKey), rawKey });
       } catch (error) {
         return err(HaiIamError.INTERNAL_ERROR, iamM("iam_apikeyCreateFailed", { params: { message: String(error) } }), error);
@@ -1549,7 +1692,7 @@ function createApiKeyStrategy(config) {
       const result = await apiKeyRepository.removeById(keyId);
       if (!result.success)
         return result;
-      logger2.info("API Key revoked", { keyId });
+      logger3.info("API Key revoked", { keyId });
       return ok(void 0);
     },
     async verifyApiKey(rawKey) {
@@ -1600,7 +1743,7 @@ function createLoginAccessCheck(policy) {
     return ok(void 0);
   };
 }
-var logger3 = core.logger.child({ module: "iam", scope: "captcha" });
+var logger4 = core.logger.child({ module: "iam", scope: "captcha" });
 var prefix = "hai:iam:captcha:";
 var operationSchema = z.enum(["login", "register", "sendOtp", "passwordReset", "renewPassword"]);
 var proofSchema = z.object({
@@ -1632,7 +1775,7 @@ async function createIamCaptcha(config, input) {
       return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
     return ok({ id, challenge });
   } catch (error) {
-    logger3.error("Captcha challenge generation failed", { operation: operation.data, error });
+    logger4.error("Captcha challenge generation failed", { operation: operation.data, error });
     return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
   }
 }
@@ -1668,7 +1811,7 @@ async function verifyIamCaptcha(config, operation, proof) {
       return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
     return removed.data === 1 ? ok(void 0) : err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
   } catch (error) {
-    logger3.error("Captcha verification failed", { operation, error });
+    logger4.error("Captcha verification failed", { operation, error });
     return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
   }
 }
@@ -1726,7 +1869,7 @@ async function loadLdapClientFactory() {
     }
   };
 }
-var logger4 = core.logger.child({ module: "iam", scope: "ldap-strategy" });
+var logger5 = core.logger.child({ module: "iam", scope: "ldap-strategy" });
 function escapeLdapFilterValue(value) {
   return value.replace(/[\\*()/\0]/g, (ch) => {
     const hex = ch.charCodeAt(0).toString(16).padStart(2, "0");
@@ -1829,7 +1972,7 @@ function createLdapStrategy(config) {
             if (!failureResult.success)
               return failureResult;
           }
-          logger4.warn("LDAP authentication failed", { username });
+          logger5.warn("LDAP authentication failed", { username });
           return err(
             HaiIamError.INVALID_CREDENTIALS,
             iamM("iam_passwordWrong")
@@ -1867,7 +2010,7 @@ function createLdapStrategy(config) {
                 return assigned;
               }
             } catch (callbackError) {
-              logger4.warn("onUserAutoRegistered callback failed", { userId: storedUser?.id, error: callbackError });
+              logger5.warn("onUserAutoRegistered callback failed", { userId: storedUser?.id, error: callbackError });
             }
           }
         } else if (storedUser && syncUser) {
@@ -1892,7 +2035,7 @@ function createLdapStrategy(config) {
         const resetResult = await resetLoginFailures(userRepository, storedUser, failurePolicy);
         if (!resetResult.success)
           return resetResult;
-        logger4.info("LDAP authentication succeeded", { userId: storedUser.id });
+        logger5.debug("LDAP authentication succeeded", { userId: storedUser.id });
         return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
       } finally {
         await client.unbind();
@@ -1912,7 +2055,7 @@ function createCacheOtpRepository() {
   if (otpRepoInstance)
     return otpRepoInstance;
   const keyFor = (identifier) => `hai:iam:otp:${normalizeOtpIdentifier(identifier)}`;
-  const failure = () => err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"));
+  const failure2 = () => err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"));
   const invalid = () => err(HaiIamError.OTP_INVALID, iamM("iam_otpNotExistOrExpired"));
   otpRepoInstance = {
     async issueOtp(input) {
@@ -1927,7 +2070,7 @@ function createCacheOtpRepository() {
       const key = keyFor(input.identifier);
       const current = await cache.kv.get(key);
       if (!current.success)
-        return failure();
+        return failure2();
       if (current.data && current.data.cooldownUntil > Date.now()) {
         return err(HaiIamError.OTP_RESEND_TOO_FAST, iamM("iam_otpResendTooFast", { params: { seconds: Math.ceil((current.data.cooldownUntil - Date.now()) / 1e3) } }));
       }
@@ -1935,7 +2078,7 @@ function createCacheOtpRepository() {
         return invalid();
       const published = await cache.kv.compareAndSwap(key, current.data ?? void 0, state, { px: Math.max(state.expiresAt, state.cooldownUntil) - Date.now() });
       if (!published.success)
-        return failure();
+        return failure2();
       if (!published.data)
         return err(HaiIamError.SECURITY_BUSY, iamM("iam_securityBusy"));
       if (Date.now() >= state.expiresAt)
@@ -1948,7 +2091,7 @@ function createCacheOtpRepository() {
       for (let attempt = 0; attempt < 16; attempt++) {
         const current = await cache.kv.get(key);
         if (!current.success)
-          return failure();
+          return failure2();
         const state = current.data;
         if (!state || state.code === null || state.expiresAt <= Date.now() || state.attempts >= maxAttempts || version && state.version !== version)
           return invalid();
@@ -1958,7 +2101,7 @@ function createCacheOtpRepository() {
         const next = { ...state, attempts, code: correct || attempts >= maxAttempts ? null : state.code };
         const committed = await cache.kv.compareAndSwap(key, state, next, { keepTtl: true });
         if (!committed.success)
-          return failure();
+          return failure2();
         if (!committed.data)
           continue;
         if (!correct || state.expiresAt <= Date.now())
@@ -1970,7 +2113,7 @@ function createCacheOtpRepository() {
   };
   return otpRepoInstance;
 }
-var logger5 = core.logger.child({ module: "iam", scope: "otp-strategy" });
+var logger6 = core.logger.child({ module: "iam", scope: "otp-strategy" });
 var PHONE_IDENTIFIER_REGEX = /^\+?\d{8,}$/;
 var PHONE_SEPARATOR_REGEX = /[\s-]/g;
 function generateOtpCode(length) {
@@ -2068,7 +2211,7 @@ function createOtpStrategy(config) {
               return assigned;
             }
           } catch (callbackError) {
-            logger5.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
+            logger6.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
           }
         }
       }
@@ -2080,7 +2223,7 @@ function createOtpStrategy(config) {
       const resetResult = await resetLoginFailures(config.userRepository, storedUser, failurePolicy);
       if (!resetResult.success)
         return resetResult;
-      logger5.info("OTP authentication succeeded", { userId: storedUser.id });
+      logger6.debug("OTP authentication succeeded", { userId: storedUser.id });
       return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
@@ -2124,12 +2267,12 @@ function createOtpStrategy(config) {
       );
     }
     const result = { expiresAt };
-    logger5.debug("OTP challenge sent", { identifier, expiresAt });
+    logger6.debug("OTP challenge sent", { identifier, expiresAt });
     return ok(result);
   }
   return { strategy, challenge };
 }
-var logger6 = core.logger.child({ module: "iam", scope: "password-strategy" });
+var logger7 = core.logger.child({ module: "iam", scope: "password-strategy" });
 var PASSWORD_UPPERCASE_REGEX = /[A-Z]/;
 var PASSWORD_LOWERCASE_REGEX = /[a-z]/;
 var PASSWORD_DIGIT_REGEX = /\d/;
@@ -2209,7 +2352,7 @@ function createPasswordStrategy(config) {
       const failureResult = await recordLoginFailure(config.userRepository, user, failurePolicy);
       if (!failureResult.success)
         return failureResult;
-      logger6.warn("Password verification failed", { userId: user.id });
+      logger7.warn("Password verification failed", { userId: user.id });
       return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
     }
     return ok(void 0);
@@ -2243,7 +2386,7 @@ function createPasswordStrategy(config) {
       const resetResult = await resetLoginFailures(config.userRepository, storedUser, failurePolicy);
       if (!resetResult.success)
         return resetResult;
-      logger6.info("Password authentication succeeded", { userId: storedUser.id });
+      logger7.debug("Password authentication succeeded", { userId: storedUser.id });
       return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
@@ -2263,7 +2406,7 @@ function createPasswordStrategy(config) {
 }
 
 // src/authn/iam-authn-functions.ts
-var logger7 = core.logger.child({ module: "iam", scope: "authn" });
+var logger8 = core.logger.child({ module: "iam", scope: "authn" });
 async function createAuthnOperations(deps) {
   try {
     const { config, sessionFunctions, authzFunctions, ldapClientFactory, ldapSyncUser, onOtpSendEmail, onOtpSendSms } = deps;
@@ -2347,10 +2490,10 @@ async function createAuthnOperations(deps) {
       userRepository,
       config
     });
-    logger7.info("Authn sub-feature initialized");
+    logger8.info("Authn sub-feature initialized");
     return ok({ authn: operations.authn, loginRegisteredUser: operations.loginRegisteredUser, passwordStrategyResult: passwordResult, apiKeyFunctions });
   } catch (error) {
-    logger7.error("Authn sub-feature initialization failed", { error });
+    logger8.error("Authn sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -2430,7 +2573,8 @@ function buildAuthnOperations(deps) {
       avatarUrl: user.avatarUrl,
       ...effective,
       apiKeyId: apiKey?.id,
-      apiKeyScopes: apiKey?.scopes
+      apiKeyScopes: apiKey?.scopes,
+      terminalType: context?.terminalType ?? (apiKey ? "api" : "web")
     });
     if (!sessionResult.success) {
       return sessionResult;
@@ -2444,7 +2588,7 @@ function buildAuthnOperations(deps) {
     if (!recorded.success) {
       const revoked = await sessionFunctions.delete(session.accessToken);
       if (!revoked.success)
-        logger7.error("Failed to revoke session after login timestamp write failure", { userId: user.id, error: revoked.error });
+        logger8.error("Failed to revoke session after login timestamp write failure", { userId: user.id, error: revoked.error });
       return recorded;
     }
     const { credentialVersion, ...publicUser } = user;
@@ -2473,12 +2617,14 @@ function buildAuthnOperations(deps) {
       ...credentials
     });
     if (!authResult.success) {
-      logger7.warn("Login failed", { type, reason: authResult.error.code });
+      logger8.warn("Login failed", { type, reason: authResult.error.code });
       return authResult;
     }
+    if (credentials.expectedUserId && credentials.expectedUserId !== authResult.data.id)
+      return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
     const result = await buildAuthResult(authResult.data, void 0, context);
     if (result.success) {
-      logger7.info("Login succeeded", { type, userId: authResult.data.id });
+      logger8.info("Login succeeded", { type, userId: authResult.data.id });
     }
     return result;
   }
@@ -2486,24 +2632,24 @@ function buildAuthnOperations(deps) {
     const session = await sessionFunctions.verifyToken(accessToken);
     if (!session.success)
       return session;
-    const [user, authorization] = await Promise.all([
-      userRepository.findById(session.data.userId),
-      authzFunctions.getUserAuthorization(session.data.userId)
-    ]);
-    if (!user.success)
-      return user;
-    if (!user.data?.enabled)
-      return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-    if (session.data.credentialVersion !== (user.data.credentialVersion ?? ""))
-      return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
+    const authorization = await authzFunctions.getUserAuthorization(session.data.userId);
     if (!authorization.success)
       return authorization;
-    const current = { ...session.data, username: user.data.username, displayName: user.data.displayName, avatarUrl: user.data.avatarUrl, ...authorization.data };
+    const current = { ...session.data, ...authorization.data };
     return ok(current.apiKeyId ? applyApiKeyScopes(current, current.apiKeyScopes ?? []) : current);
   }
   const tickets = createTicketOperations();
   const sensitive = config.reauthentication;
-  const requiresProof = (operation) => sensitive?.enabled && sensitive.operations.includes(operation);
+  async function requiresProof(operation) {
+    if (!sensitive?.enabled)
+      return ok(false);
+    if (sensitive.operations.includes(operation))
+      return ok(true);
+    const configured = await authzFunctions.getSensitiveOperations(operation);
+    if (!configured.success)
+      return configured;
+    return ok(sensitive.operations.includes(operation) || configured.data.includes(operation));
+  }
   return { loginRegisteredUser: async (user, context) => {
     const stored = await userRepository.findById(user.id);
     if (!stored.success)
@@ -2514,7 +2660,10 @@ function buildAuthnOperations(deps) {
   }, authn: {
     createCaptcha: (input) => createIamCaptcha(config.captcha, input),
     async reauthenticate(accessToken, password, operation) {
-      if (!requiresProof(operation))
+      const required = await requiresProof(operation);
+      if (!required.success)
+        return required;
+      if (!required.data)
         return err(HaiIamError.PERMISSION_DENIED, iamM("iam_reauthenticationRequired"));
       const current = await verifyCurrentSession(accessToken);
       if (!current.success)
@@ -2535,7 +2684,10 @@ function buildAuthnOperations(deps) {
       const current = await verifyCurrentSession(accessToken);
       if (!current.success)
         return current;
-      if (!requiresProof(operation))
+      const required = await requiresProof(operation);
+      if (!required.success)
+        return required;
+      if (!required.data)
         return ok(void 0);
       if (!ticket)
         return err(HaiIamError.REAUTHENTICATION_REQUIRED, iamM("iam_reauthenticationRequired"));
@@ -2590,6 +2742,7 @@ function buildAuthnOperations(deps) {
 }
 var TABLE_NAME3 = "hai_iam_permissions";
 var PERMISSION_FIELDS = [
+  { fieldName: "sensitiveOperations", columnName: "sensitive_operations", def: { type: "JSON" }, select: true, create: true, update: true },
   {
     fieldName: "id",
     columnName: "id",
@@ -2679,6 +2832,32 @@ async function createDbPermissionRepository() {
   return repo;
 }
 var DbPermissionRepository = class extends BaseReldbCrudRepository {
+  async getSensitiveOperations(operation) {
+    if (operation !== void 0 && (typeof operation !== "string" || !operation.trim() || operation.length > 128))
+      return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
+    const match = reldb.config?.type === "postgresql" ? "sensitive_operations::jsonb @> CAST(? AS jsonb)" : reldb.config?.type === "mysql" ? "JSON_CONTAINS(sensitive_operations, JSON_QUOTE(?))" : "EXISTS (SELECT 1 FROM json_each(sensitive_operations) WHERE type = 'text' AND value = ?)";
+    const params = operation === void 0 ? [] : [reldb.config?.type === "postgresql" ? JSON.stringify([operation]) : operation];
+    const result = await reldb.sql.query(`SELECT sensitive_operations FROM hai_iam_permissions WHERE sensitive_operations IS NOT NULL${operation === void 0 ? "" : ` AND ${match} LIMIT 1`}`, params);
+    if (!result.success)
+      return result;
+    const operations = /* @__PURE__ */ new Set();
+    try {
+      for (const row of result.data) {
+        const values = typeof row.sensitive_operations === "string" ? JSON.parse(row.sensitive_operations) : row.sensitive_operations;
+        if (!Array.isArray(values) || values.length > 1e3)
+          return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+        for (const value of values) {
+          if (typeof value !== "string" || !value.trim() || value.length > 128)
+            return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+          if (operation === void 0 || value.trim() === operation)
+            operations.add(value.trim());
+        }
+      }
+      return ok([...operations].sort());
+    } catch {
+      return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+    }
+  }
   constructor() {
     super(reldb, {
       table: TABLE_NAME3,
@@ -3247,7 +3426,7 @@ var DbRoleRepository = class extends BaseReldbCrudRepository {
 };
 
 // src/authz/iam-authz-functions.ts
-var logger8 = core.logger.child({ module: "iam", scope: "authz" });
+var logger9 = core.logger.child({ module: "iam", scope: "authz" });
 async function createAuthzOperations(deps) {
   try {
     const { config, session } = deps;
@@ -3269,10 +3448,23 @@ async function createAuthzOperations(deps) {
       userRoleRepository: userRoleResult.data,
       session
     });
-    logger8.info("Authz sub-feature initialized");
-    return ok(manager);
+    logger9.info("Authz sub-feature initialized");
+    return ok({
+      ...manager,
+      assignRole: guardIamMutation(manager.assignRole, 2),
+      removeRole: guardIamMutation(manager.removeRole, 2),
+      syncRoles: guardIamMutation(manager.syncRoles, 2),
+      createRole: guardIamMutation(manager.createRole, 1),
+      updateRole: guardIamMutation(manager.updateRole, 2),
+      deleteRole: guardIamMutation(manager.deleteRole, 1),
+      createPermission: guardIamMutation(manager.createPermission, 1),
+      deletePermission: guardIamMutation(manager.deletePermission, 1),
+      assignPermissionToRole: guardIamMutation(manager.assignPermissionToRole, 2),
+      removePermissionFromRole: guardIamMutation(manager.removePermissionFromRole, 2),
+      setPermissionSensitiveOperations: guardIamMutation(manager.setPermissionSensitiveOperations)
+    });
   } catch (error) {
-    logger8.error("Authz sub-feature initialization failed", { error });
+    logger9.error("Authz sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -3289,18 +3481,6 @@ function createRbacManager(config) {
     userRoleRepository,
     session
   } = config;
-  let superAdminRoleId;
-  async function resolveSuperAdminRoleId() {
-    if (superAdminRoleId !== void 0) {
-      return ok(superAdminRoleId);
-    }
-    const roleResult = await roleRepository.findByCode(rbacConfig.superAdminRole);
-    if (!roleResult.success) {
-      return mapRepositoryError2("iam_queryRoleFailed", roleResult.error.message);
-    }
-    superAdminRoleId = roleResult.data?.id ?? null;
-    return ok(superAdminRoleId);
-  }
   function mapRepositoryError2(messageKey, message) {
     return err(
       HaiIamError.REPOSITORY_ERROR,
@@ -3317,16 +3497,6 @@ function createRbacManager(config) {
     }
     return false;
   }
-  async function hasPermissionInRoles(roleIds, permission) {
-    const codesResult = await rolePermissionRepository.getPermissionCodesForRoles(roleIds);
-    if (!codesResult.success)
-      return codesResult;
-    for (const code of codesResult.data) {
-      if (matchesPermission(permission, code))
-        return ok(true);
-    }
-    return ok(false);
-  }
   async function getUserPermissionsInternal(userId) {
     const roleIdsResult = await userRoleRepository.getRoleIds(userId);
     if (!roleIdsResult.success)
@@ -3368,19 +3538,19 @@ function createRbacManager(config) {
   async function syncSessionPermissionsForRole(roleId) {
     const userIdsResult = await userRoleRepository.getUserIdsByRoleId(roleId);
     if (!userIdsResult.success) {
-      logger8.error("Failed to query users for permission sync", { roleId, error: userIdsResult.error.message });
+      logger9.error("Failed to query users for permission sync", { roleId, error: userIdsResult.error.message });
       return;
     }
     await Promise.allSettled(
       userIdsResult.data.map(async (userId) => {
         const permResult = await resolveUserPermissionCodes(userId);
         if (!permResult.success) {
-          logger8.error("Failed to resolve permissions for session sync", { userId, roleId, error: permResult.error.message });
+          logger9.error("Failed to resolve permissions for session sync", { userId, roleId, error: permResult.error.message });
           return;
         }
         const syncResult = await session.patchUserSessions(userId, { permissions: permResult.data });
         if (!syncResult.success) {
-          logger8.error("Failed to sync session permissions", { userId, roleId, error: syncResult.error.message });
+          logger9.error("Failed to sync session permissions", { userId, roleId, error: syncResult.error.message });
         }
       })
     );
@@ -3394,17 +3564,17 @@ function createRbacManager(config) {
     if (roleCodesResult.success) {
       updates.roles = roleCodesResult.data;
     } else {
-      logger8.error("Failed to resolve roles for session sync", { userId, error: roleCodesResult.error.message });
+      logger9.error("Failed to resolve roles for session sync", { userId, error: roleCodesResult.error.message });
     }
     if (permCodesResult.success) {
       updates.permissions = permCodesResult.data;
     } else {
-      logger8.error("Failed to resolve permissions for session sync", { userId, error: permCodesResult.error.message });
+      logger9.error("Failed to resolve permissions for session sync", { userId, error: permCodesResult.error.message });
     }
     if (updates.roles !== void 0 || updates.permissions !== void 0) {
       const syncResult = await session.patchUserSessions(userId, updates);
       if (!syncResult.success) {
-        logger8.error("Failed to patch user sessions", { userId, error: syncResult.error.message });
+        logger9.error("Failed to patch user sessions", { userId, error: syncResult.error.message });
       }
     }
   }
@@ -3427,38 +3597,42 @@ function createRbacManager(config) {
     }
     return ok(void 0);
   }
+  async function getUserAuthorization(userId) {
+    return readIamCache(`authorization:${userId}`, async () => {
+      const rows = await reldb.sql.query("SELECT r.code AS role_code, p.code AS permission_code FROM hai_iam_user_roles ur JOIN hai_iam_roles r ON r.id = ur.role_id LEFT JOIN hai_iam_role_permissions rp ON rp.role_id = r.id LEFT JOIN hai_iam_permissions p ON p.id = rp.permission_id WHERE ur.user_id = ?", [userId]);
+      return rows.success ? ok({ roles: [...new Set(rows.data.map((row) => row.role_code))], permissions: [...new Set(rows.data.flatMap((row) => row.permission_code ? [row.permission_code] : []))] }) : rows;
+    });
+  }
   return {
+    getSensitiveOperations: (operation) => rbacConfig.enabled ? readIamCache(`sensitive:${operation ?? "*"}`, () => permissionRepository.getSensitiveOperations(operation)) : Promise.resolve(ok([])),
+    async setPermissionSensitiveOperations(permissionId, operations) {
+      if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
+        return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
+      const updated = await permissionRepository.updateById(permissionId, { sensitiveOperations: [...new Set(operations.map((value) => value.trim()))] });
+      if (!updated.success)
+        return updated;
+      if (updated.data.changes === 0) {
+        const existing = await permissionRepository.findById(permissionId);
+        if (!existing.success)
+          return existing;
+        if (!existing.data)
+          return err(HaiIamError.PERMISSION_NOT_FOUND, iamM("iam_permissionNotExist"));
+      }
+      return ok(void 0);
+    },
     async checkPermission(userId, permission) {
       if (!rbacConfig.enabled) {
         return ok(true);
       }
-      const roleIdsResult = await userRoleRepository.getRoleIds(userId);
-      if (!roleIdsResult.success)
-        return roleIdsResult;
-      const roleIds = roleIdsResult.data;
-      if (roleIds.length === 0) {
-        return ok(false);
-      }
-      const superAdminResult = await resolveSuperAdminRoleId();
-      if (!superAdminResult.success)
-        return superAdminResult;
-      if (superAdminResult.data && roleIds.includes(superAdminResult.data)) {
-        return ok(true);
-      }
-      return hasPermissionInRoles(roleIds, permission);
+      const authorization = await getUserAuthorization(userId);
+      if (!authorization.success)
+        return authorization;
+      return ok(authorization.data.roles.includes(rbacConfig.superAdminRole) || authorization.data.permissions.some((code) => matchesPermission(permission, code)));
     },
     async getUserPermissions(userId) {
       return getUserPermissionsInternal(userId);
     },
-    async getUserAuthorization(userId) {
-      const roles = await userRoleRepository.getRoleSummaries(userId);
-      if (!roles.success)
-        return roles;
-      const permissions = roles.data.length ? await rolePermissionRepository.getPermissionCodesForRoles(roles.data.map((role) => role.id)) : ok([]);
-      if (!permissions.success)
-        return permissions;
-      return ok({ roles: roles.data.map((role) => role.code), permissions: permissions.data });
-    },
+    getUserAuthorization,
     async getUserRoles(userId) {
       return userRoleRepository.getRoles(userId);
     },
@@ -3472,7 +3646,7 @@ function createRbacManager(config) {
       }
       const result = await userRoleRepository.assign(userId, roleId, tx);
       if (result.success) {
-        logger8.info("Role assigned to user", { userId, roleId });
+        logger9.info("Role assigned to user", { userId, roleId });
         if (!tx) {
           await syncUserSessionAfterRoleChange(userId);
         }
@@ -3482,7 +3656,7 @@ function createRbacManager(config) {
     async removeRole(userId, roleId, tx) {
       const result = await userRoleRepository.remove(userId, roleId, tx);
       if (result.success) {
-        logger8.info("Role removed from user", { userId, roleId });
+        logger9.info("Role removed from user", { userId, roleId });
         if (!tx) {
           await syncUserSessionAfterRoleChange(userId);
         }
@@ -3550,7 +3724,7 @@ function createRbacManager(config) {
           error
         );
       }
-      logger8.info("Roles synced for user", { userId, added: toAdd.length, removed: toRemove.length });
+      logger9.info("Roles synced for user", { userId, added: toAdd.length, removed: toRemove.length });
       if (ownTx) {
         await syncUserSessionAfterRoleChange(userId);
       }
@@ -3602,10 +3776,7 @@ function createRbacManager(config) {
             return mapRepositoryError2("iam_createRoleFailed", commitResult.error.message);
           }
         }
-        logger8.info("Role created", { roleId: createdResult.data.id, code: role.code });
-        if (role.code === rbacConfig.superAdminRole) {
-          superAdminRoleId = void 0;
-        }
+        logger9.info("Role created", { roleId: createdResult.data.id, code: role.code });
         return ok(createdResult.data);
       } catch (error) {
         if (ownTx)
@@ -3691,7 +3862,6 @@ function createRbacManager(config) {
             return mapRepositoryError2("iam_updateRoleFailed", commitResult.error.message);
           }
         }
-        superAdminRoleId = void 0;
         if (ownTx) {
           const affectedUsersResult = await userRoleRepository.getUserIdsByRoleId(roleId);
           if (affectedUsersResult.success) {
@@ -3699,7 +3869,7 @@ function createRbacManager(config) {
               affectedUsersResult.data.map((userId) => syncUserSessionAfterRoleChange(userId))
             );
           } else {
-            logger8.error("Failed to query affected users after updateRole", { roleId, error: affectedUsersResult.error.message });
+            logger9.error("Failed to query affected users after updateRole", { roleId, error: affectedUsersResult.error.message });
           }
         }
         return ok(updatedResult.data);
@@ -3773,12 +3943,15 @@ function createRbacManager(config) {
           affectedUserIds.map((userId) => syncUserSessionAfterRoleChange(userId))
         );
       }
-      superAdminRoleId = void 0;
-      logger8.info("Role deleted", { roleId });
+      logger9.info("Role deleted", { roleId });
       return ok(void 0);
     },
     // ─── 权限管理 ───
     async createPermission(permission, tx) {
+      const operations = permission.sensitiveOperations ?? [];
+      if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
+        return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
+      permission = { ...permission, sensitiveOperations: [...new Set(operations.map((value) => value.trim()))] };
       const ownTx = !tx;
       if (!tx) {
         const txResult = await reldb.tx.begin();
@@ -3814,7 +3987,7 @@ function createRbacManager(config) {
             return mapRepositoryError2("iam_createPermissionFailed", commitResult.error.message);
           }
         }
-        logger8.info("Permission created", { permissionId: createdResult.data.id, code: permission.code });
+        logger9.info("Permission created", { permissionId: createdResult.data.id, code: permission.code });
         return ok(createdResult.data);
       } catch (error) {
         if (ownTx)
@@ -3918,7 +4091,7 @@ function createRbacManager(config) {
           affectedRoleIds.map((roleId) => syncSessionPermissionsForRole(roleId))
         );
       }
-      logger8.info("Permission deleted", { permissionId });
+      logger9.info("Permission deleted", { permissionId });
       return ok(void 0);
     },
     async assignPermissionToRole(roleId, permissionId, tx) {
@@ -3940,7 +4113,7 @@ function createRbacManager(config) {
       }
       const assignResult = await rolePermissionRepository.assign(roleId, permissionId, tx);
       if (assignResult.success) {
-        logger8.info("Permission assigned to role", { roleId, permissionId });
+        logger9.info("Permission assigned to role", { roleId, permissionId });
         if (!tx) {
           await syncSessionPermissionsForRole(roleId);
         }
@@ -3969,7 +4142,7 @@ function createRbacManager(config) {
       }
       const removeResult = await rolePermissionRepository.remove(roleId, permissionId, tx);
       if (removeResult.success) {
-        logger8.info("Permission removed from role", { roleId, permissionId });
+        logger9.info("Permission removed from role", { roleId, permissionId });
         if (!tx) {
           await syncSessionPermissionsForRole(roleId);
         }
@@ -3987,14 +4160,16 @@ function createRbacManager(config) {
     }
   };
 }
-var logger9 = core.logger.child({ module: "iam", scope: "audit" });
+var logger10 = core.logger.child({ module: "iam", scope: "audit" });
 async function observe(operation, event, tx) {
   const result = await operation();
+  if (!audit.isInitialized)
+    return result;
   const fields = typeof event === "function" ? event(result) : event;
   if (!fields)
     return result;
   if (tx && !result.success) {
-    logger9.warn("IAM transactional operation failed", { action: fields.action, resource: fields.resource, reasonCode: result.error.code });
+    logger10.warn("IAM transactional operation failed", { action: fields.action, resource: fields.resource, reasonCode: result.error.code });
     return result;
   }
   const recorded = await audit.capture({
@@ -4004,7 +4179,7 @@ async function observe(operation, event, tx) {
     details: { ...fields.details, ...!result.success ? { reasonCode: result.error.code } : {} }
   }, { tx });
   if (!recorded.success) {
-    logger9.error("IAM event audit failed", { action: fields.action, resource: fields.resource, error: recorded.error });
+    logger10.error("IAM event audit failed", { action: fields.action, resource: fields.resource, error: recorded.error });
     if (tx)
       return recorded;
   }
@@ -4065,6 +4240,7 @@ function observeAuthorization(operations) {
     updateRole: (id, data, tx) => observe(() => operations.updateRole(id, data, tx), { action: "role.update", resource: "iam.roles", resourceId: id, details: { fields: Object.keys(data), permissionIds: data.permissionIds } }, tx),
     deleteRole: (id, tx) => observe(() => operations.deleteRole(id, tx), { action: "role.delete", resource: "iam.roles", resourceId: id }, tx),
     createPermission: (input, tx) => observe(() => operations.createPermission(input, tx), (result) => ({ action: "permission.create", resource: "iam.permissions", resourceId: result.success ? result.data.id : void 0, details: { code: input.code } }), tx),
+    setPermissionSensitiveOperations: (id, operationIds) => observe(() => operations.setPermissionSensitiveOperations(id, operationIds), { action: "permission.sensitive-operations", resource: "iam.permissions", resourceId: id, details: { operations: operationIds } }),
     deletePermission: (id, tx) => observe(() => operations.deletePermission(id, tx), { action: "permission.delete", resource: "iam.permissions", resourceId: id }, tx),
     assignPermissionToRole: (id, permissionId, tx) => observe(() => operations.assignPermissionToRole(id, permissionId, tx), { action: "permission.assign", resource: "iam.role-permissions", resourceId: id, details: { permissionId } }, tx),
     removePermissionFromRole: (id, permissionId, tx) => observe(() => operations.removePermissionFromRole(id, permissionId, tx), { action: "permission.remove", resource: "iam.role-permissions", resourceId: id, details: { permissionId } }, tx)
@@ -4151,6 +4327,17 @@ var steps = [{
     const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN first_login_failed_at TIMESTAMP");
     return added.success ? ok(void 0) : added;
   }
+}, {
+  version: 5,
+  name: "permission-sensitive-operations",
+  async needed(sql) {
+    const found = await schemaColumns(reldb, "hai_iam_permissions", sql);
+    return found.success ? ok(found.data.length > 0 && !found.data.includes("sensitive_operations")) : found;
+  },
+  async apply(sql) {
+    const added = await sql.execute("ALTER TABLE hai_iam_permissions ADD COLUMN sensitive_operations JSON");
+    return added.success ? ok(void 0) : added;
+  }
 }];
 function migrateIam(options = {}) {
   return migrateSchema(reldb, "iam", steps, options);
@@ -4215,7 +4402,29 @@ function buildIamPublicConfig(config, runtime) {
     initialCredentials: { enabled: Boolean(config.initialCredentials?.enabled && config.passwordReset?.enabled !== false && runtime.onPasswordResetRequest) }
   };
 }
-var logger10 = core.logger.child({ module: "iam", scope: "seed" });
+async function readIamUserSecurity(repository, userId) {
+  const found = await readIamCache(`user:${userId}`, async () => {
+    const row = await repository.findById(userId);
+    if (!row.success)
+      return row;
+    const user = row.data;
+    return ok(user ? {
+      username: user.username,
+      displayName: user.displayName,
+      avatarUrl: user.avatarUrl,
+      enabled: user.enabled,
+      accountType: user.accountType,
+      accountStatus: user.accountStatus,
+      accountExpiresAt: user.accountExpiresAt ? new Date(user.accountExpiresAt).getTime() : null,
+      credentialVersion: user.credentialVersion ?? "",
+      mustChangePassword: user.mustChangePassword,
+      hasPassword: !!user.passwordHash,
+      passwordUpdatedAt: user.passwordUpdatedAt?.getTime() ?? null
+    } : null);
+  });
+  return found.success ? ok(found.data ? { ...found.data, accountExpiresAt: found.data.accountExpiresAt === null ? null : new Date(found.data.accountExpiresAt), passwordUpdatedAt: found.data.passwordUpdatedAt === null ? void 0 : new Date(found.data.passwordUpdatedAt), passwordHash: found.data.hasPassword ? "present" : void 0 } : null) : found;
+}
+var logger11 = core.logger.child({ module: "iam", scope: "seed" });
 var DEFAULT_ROLES = [
   { code: "admin", name: () => iamM("iam_seedRoleAdminName"), description: () => iamM("iam_seedRoleAdminDesc"), isSystem: true },
   { code: "user", name: () => iamM("iam_seedRoleUserName"), description: () => iamM("iam_seedRoleUserDesc"), isSystem: true },
@@ -4259,12 +4468,11 @@ var USER_ROLE_PERMISSIONS = ["dashboard:view", "profile:read"];
 async function seedIamData(authz) {
   try {
     const existingRoles = await authz.getAllRoles({ page: 1, pageSize: 1e3 });
+    if (!existingRoles.success)
+      return existingRoles;
     const existingRoleMap = /* @__PURE__ */ new Map();
-    if (existingRoles.success) {
-      for (const role of existingRoles.data.items) {
-        existingRoleMap.set(role.code, role.id);
-      }
-    }
+    for (const role of existingRoles.data.items)
+      existingRoleMap.set(role.code, role.id);
     const roleMap = /* @__PURE__ */ new Map();
     for (const role of DEFAULT_ROLES) {
       const existingId = existingRoleMap.get(role.code);
@@ -4275,17 +4483,23 @@ async function seedIamData(authz) {
       const result = await authz.createRole({ code: role.code, name: role.name(), description: role.description(), isSystem: role.isSystem });
       if (result.success) {
         roleMap.set(role.code, result.data.id);
+      } else if (result.error.code === HaiIamError.ROLE_ALREADY_EXISTS.code) {
+        const concurrent = await authz.getRoleByCode(role.code);
+        if (!concurrent.success)
+          return concurrent;
+        if (!concurrent.data)
+          return result;
+        roleMap.set(role.code, concurrent.data.id);
       } else {
         return result;
       }
     }
     const existingPerms = await authz.getAllPermissions({ page: 1, pageSize: 1e3 });
+    if (!existingPerms.success)
+      return existingPerms;
     const existingPermMap = /* @__PURE__ */ new Map();
-    if (existingPerms.success) {
-      for (const perm of existingPerms.data.items) {
-        existingPermMap.set(perm.code, perm.id);
-      }
-    }
+    for (const perm of existingPerms.data.items)
+      existingPermMap.set(perm.code, perm.id);
     const permMap = /* @__PURE__ */ new Map();
     for (const perm of DEFAULT_PERMISSIONS) {
       const existingId = existingPermMap.get(perm.code);
@@ -4296,6 +4510,13 @@ async function seedIamData(authz) {
       const result = await authz.createPermission({ code: perm.code, name: perm.name(), type: perm.type, resource: perm.resource, action: perm.action });
       if (result.success) {
         permMap.set(perm.code, result.data.id);
+      } else if (result.error.code === HaiIamError.PERMISSION_ALREADY_EXISTS.code) {
+        const concurrent = await authz.getPermissionByCode(perm.code);
+        if (!concurrent.success)
+          return concurrent;
+        if (!concurrent.data)
+          return result;
+        permMap.set(perm.code, concurrent.data.id);
       } else {
         return result;
       }
@@ -4303,7 +4524,9 @@ async function seedIamData(authz) {
     const adminRoleId = roleMap.get("admin");
     if (adminRoleId) {
       for (const [, permId] of permMap) {
-        await authz.assignPermissionToRole(adminRoleId, permId);
+        const assigned = await authz.assignPermissionToRole(adminRoleId, permId);
+        if (!assigned.success)
+          return assigned;
       }
     }
     const userRoleId = roleMap.get("user");
@@ -4311,14 +4534,16 @@ async function seedIamData(authz) {
       for (const permCode of USER_ROLE_PERMISSIONS) {
         const permId = permMap.get(permCode);
         if (permId) {
-          await authz.assignPermissionToRole(userRoleId, permId);
+          const assigned = await authz.assignPermissionToRole(userRoleId, permId);
+          if (!assigned.success)
+            return assigned;
         }
       }
     }
-    logger10.info("IAM seed data initialized");
+    logger11.info("IAM seed data initialized");
     return ok(void 0);
   } catch (error) {
-    logger10.error("Failed to seed IAM data", { error });
+    logger11.error("Failed to seed IAM data", { error });
     return err(
       HaiIamError.REPOSITORY_ERROR,
       iamM("iam_initSeedDataFailed"),
@@ -4331,7 +4556,7 @@ function retainedUntil(entry) {
 }
 function restoreSession(session) {
   const result = { ...session, createdAt: new Date(session.createdAt), startedAt: new Date(session.startedAt ?? session.createdAt), lastActiveAt: new Date(session.lastActiveAt), expiresAt: new Date(session.expiresAt) };
-  if (typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![result.createdAt, result.startedAt, result.lastActiveAt, result.expiresAt].every((date) => Number.isFinite(date.getTime()))) {
+  if (result.terminalType !== void 0 && !["web", "app", "desktop", "api"].includes(result.terminalType) || typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![result.createdAt, result.startedAt, result.lastActiveAt, result.expiresAt].every((date) => Number.isFinite(date.getTime()))) {
     throw new TypeError("Invalid session state");
   }
   return result;
@@ -4410,12 +4635,29 @@ function createCacheSessionRepository(refreshTokenMaxAge, policy = {}) {
   }
   return {
     save: (session, tokens, singleDevice = false) => mutate(getUserSessionScope(session.userId), (state) => {
-      const count = Object.values(state.sessions).filter((entry) => entry.session.credentialVersion === session.credentialVersion).length;
-      if (singleDevice && policy.singleDeviceMode !== "reject") {
-        state.sessions = {};
-      } else if (singleDevice && count > 0 || maxSessions > 0 && count >= maxSessions) {
+      const active = Object.entries(state.sessions).filter(([, entry]) => entry.session.credentialVersion === session.credentialVersion);
+      const terminal = session.terminalType ?? "web";
+      const limits = policy.terminalLimits ?? {};
+      const cap = limits[terminal];
+      if (Object.keys(limits).length && cap === void 0)
         return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+      const removed = /* @__PURE__ */ new Set();
+      if (singleDevice) {
+        if (policy.singleDeviceMode === "reject" && active.length)
+          return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+        if (policy.singleDeviceMode !== "reject")
+          Object.keys(state.sessions).forEach((token) => removed.add(token));
+      } else if (cap) {
+        const same = active.filter(([, entry]) => (entry.session.terminalType ?? "web") === terminal).sort(([firstToken, first], [secondToken, second]) => new Date(first.session.startedAt ?? first.session.createdAt).getTime() - new Date(second.session.startedAt ?? second.session.createdAt).getTime() || firstToken.localeCompare(secondToken));
+        if (same.length >= cap) {
+          if (policy.terminalLimitMode !== "replace")
+            return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+          same.slice(0, same.length - cap + 1).forEach(([token]) => removed.add(token));
+        }
       }
+      if (maxSessions > 0 && active.filter(([token]) => !removed.has(token)).length >= maxSessions)
+        return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+      removed.forEach((token) => delete state.sessions[token]);
       return storeSession(state, session, tokens);
     }),
     rotate: (previous, refreshToken, session, tokens) => mutate(getUserSessionScope(previous.userId), (state) => {
@@ -4466,6 +4708,8 @@ function createCacheSessionRepository(refreshTokenMaxAge, policy = {}) {
           return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
         if (!expectedVersion || entry.session.version !== expectedVersion)
           return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+        if (patch.terminalType !== void 0 && patch.terminalType !== (entry.session.terminalType ?? "web"))
+          return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
         const updated = applySessionPatch(restoreSession(entry.session), patch);
         if (![updated.expiresAt, updated.lastActiveAt].every((date) => Number.isFinite(date.getTime())))
           return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sessionMaxAgeInvalid"));
@@ -4545,7 +4789,7 @@ function stripInternalSessionFields(session) {
   const hasExtraKeys = Object.keys(rest).length > 0;
   return { ...session, data: hasExtraKeys ? rest : void 0 };
 }
-var logger11 = core.logger.child({ module: "iam", scope: "session" });
+var logger12 = core.logger.child({ module: "iam", scope: "session" });
 async function createSessionOperations(deps) {
   try {
     const { config } = deps;
@@ -4563,10 +4807,10 @@ async function createSessionOperations(deps) {
       sessionRepository,
       apiKeyRepository: config.login.apikey ? await createDbApiKeyRepository() : void 0
     });
-    logger11.info("Session sub-feature initialized");
+    logger12.info("Session sub-feature initialized");
     return ok(functions);
   } catch (error) {
-    logger11.error("Session sub-feature initialization failed", { error });
+    logger12.error("Session sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -4580,6 +4824,8 @@ function buildSessionFunctions(config) {
   const singleDevice = config.singleDevice ?? false;
   const repo = config.sessionRepository;
   function candidate(options, credentialVersion) {
+    if (options.terminalType !== void 0 && !["web", "app", "desktop", "api"].includes(options.terminalType))
+      return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_terminalTypeInvalid"));
     const now = /* @__PURE__ */ new Date();
     const ttl = options.maxAge ?? maxAge;
     if (!Number.isSafeInteger(ttl) || ttl <= 0 || !Number.isFinite(new Date(now.getTime() + ttl * 1e3).getTime()))
@@ -4599,7 +4845,7 @@ function buildSessionFunctions(config) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       if (typeof current.data.version !== "string" || expected !== void 0 && current.data.version !== expected)
         return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
-      return ok(current.data.version);
+      return ok(current.data);
     } catch {
       return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_sessionExpired"));
     }
@@ -4609,7 +4855,10 @@ function buildSessionFunctions(config) {
       return ok(session);
     if (!config.apiKeyRepository)
       return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
-    const found = await config.apiKeyRepository.findOneById(session.apiKeyId);
+    const found = await readIamCache(`apikey:${session.apiKeyId}`, async () => {
+      const row = await config.apiKeyRepository.findOneById(session.apiKeyId);
+      return row.success ? ok(row.data ? { userId: row.data.userId, enabled: row.data.enabled, expiresAt: row.data.expiresAt?.getTime() ?? null, scopes: row.data.scopes } : null) : row;
+    });
     if (!found.success)
       return found;
     const key = found.data;
@@ -4617,7 +4866,7 @@ function buildSessionFunctions(config) {
       return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
     if (!key.enabled)
       return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
-    if (key.expiresAt && /* @__PURE__ */ new Date() >= key.expiresAt)
+    if (key.expiresAt && Date.now() >= key.expiresAt)
       return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
     return ok(applyApiKeyScopes({ ...session, apiKeyScopes: key.scopes }, key.scopes));
   }
@@ -4627,7 +4876,7 @@ function buildSessionFunctions(config) {
         const bound = await credential(options.userId, options.expectedCredentialVersion);
         if (!bound.success)
           return bound;
-        const built = candidate(options, bound.data);
+        const built = candidate(options, bound.data.version);
         if (!built.success)
           return built;
         const { session, tokens } = built.data;
@@ -4635,7 +4884,7 @@ function buildSessionFunctions(config) {
         if (!saveResult.success) {
           return saveResult;
         }
-        logger11.debug("Session created", { userId: options.userId });
+        logger12.debug("Session created", { userId: options.userId });
         return ok(session);
       } catch (error) {
         return err(
@@ -4666,7 +4915,7 @@ function buildSessionFunctions(config) {
       const bound = await credential(session.userId, session.credentialVersion);
       if (!bound.success)
         return bound;
-      const validated = await validateApiKey(session);
+      const validated = await validateApiKey({ ...session, ...bound.data.profile });
       if (!validated.success)
         return validated;
       let output = validated.data;
@@ -4696,7 +4945,7 @@ function buildSessionFunctions(config) {
       return repo.updateByAccessToken(accessToken, data, expectedVersion);
     },
     async delete(accessToken) {
-      logger11.debug("Session delete requested");
+      logger12.debug("Session delete requested");
       return repo.removeByAccessToken(accessToken);
     },
     async deleteByUserId(userId) {
@@ -4738,6 +4987,7 @@ function buildSessionFunctions(config) {
           apiKeyId: effectiveSession.apiKeyId,
           apiKeyScopes: effectiveSession.apiKeyScopes,
           source: oldSession.source,
+          terminalType: oldSession.terminalType ?? "web",
           maxAge: oldSession.maxAge,
           data: oldSession.data ? { ...oldSession.data, _tokenPair: void 0 } : void 0
         }, oldSession.credentialVersion);
@@ -4749,7 +4999,7 @@ function buildSessionFunctions(config) {
         const current = await credential(oldSession.userId, oldSession.credentialVersion);
         if (!current.success)
           return current;
-        logger11.debug("Token refreshed", { userId: oldSession.userId });
+        logger12.debug("Token refreshed", { userId: oldSession.userId });
         return ok(next.data.tokens);
       } catch (error) {
         return err(
@@ -4767,7 +5017,7 @@ function buildSessionFunctions(config) {
     }
   };
 }
-var logger12 = core.logger.child({ module: "iam", scope: "user" });
+var logger13 = core.logger.child({ module: "iam", scope: "user" });
 var USER_SORT_COLUMNS = {
   /** 用户名列。 */
   username: "username",
@@ -4792,10 +5042,10 @@ async function createUserOperations(deps) {
       config,
       onPasswordResetRequest
     });
-    logger12.info("User sub-feature initialized");
+    logger13.info("User sub-feature initialized");
     return ok(functions);
   } catch (error) {
-    logger12.error("User sub-feature initialization failed", { error });
+    logger13.error("User sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -4964,7 +5214,7 @@ function buildRegistrationOps(ctx) {
       await userRepository.deleteById(createdUser.id);
       return assigned;
     }
-    logger12.info("User registered", { userId: createdUser.id, username: options.username });
+    logger13.info("User registered", { userId: createdUser.id, username: options.username });
     return ok({
       user: toUser(createdUser),
       agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnRegister)
@@ -5213,7 +5463,7 @@ function buildUserMutationOps(ctx) {
       if (tx) {
         const revoked = await sessionFunctions.deleteByUserId(userId);
         if (!revoked.success)
-          logger12.warn("Account credentials revoked; session cache cleanup failed", { userId, error: revoked.error });
+          logger13.warn("Account credentials revoked; session cache cleanup failed", { userId, error: revoked.error });
       }
       const updatedResult = await userRepository.findById(userId);
       if (!updatedResult.success) {
@@ -5228,7 +5478,7 @@ function buildUserMutationOps(ctx) {
       return ok(toUser(updatedResult.data));
     },
     async deleteUser(userId) {
-      logger12.debug("Deleting user", { userId });
+      logger13.debug("Deleting user", { userId });
       const userResult = await userRepository.findById(userId);
       if (!userResult.success) {
         return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
@@ -5268,7 +5518,7 @@ function buildUserMutationOps(ctx) {
         );
       }
       await sessionFunctions.deleteByUserId(userId);
-      logger12.info("User deleted", { userId });
+      logger13.info("User deleted", { userId });
       return ok(void 0);
     }
   };
@@ -5278,7 +5528,7 @@ function buildPasswordChangeOps(ctx) {
   const { hashPassword } = ctx;
   return {
     async adminResetPassword(userId, newPassword) {
-      logger12.debug("Admin resetting user password", { userId });
+      logger13.debug("Admin resetting user password", { userId });
       const userResult = await userRepository.findById(userId);
       if (!userResult.success) {
         return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
@@ -5303,7 +5553,7 @@ function buildPasswordChangeOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(userId);
       if (!revoked.success)
         return revoked;
-      logger12.info("Admin reset password", { userId });
+      logger13.info("Admin reset password", { userId });
       return ok(void 0);
     },
     async changePassword(userId, oldPassword, newPassword) {
@@ -5357,7 +5607,7 @@ function buildPasswordChangeOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(userId);
       if (!revoked.success)
         return revoked;
-      logger12.info("Password changed", { userId });
+      logger13.info("Password changed", { userId });
       return ok(void 0);
     },
     /**
@@ -5395,10 +5645,10 @@ async function issuePasswordReset(ctx, stored) {
   try {
     await onPasswordResetRequest(user, token, { expiresAt, idempotencyKey: `iam-reset:${tokenHash.data}` });
   } catch {
-    logger12.error("Password reset callback failed", { userId: user.id });
+    logger13.error("Password reset callback failed", { userId: user.id });
     return err(HaiIamError.INTERNAL_ERROR, iamM("iam_notificationDeliveryUnknown"));
   }
-  logger12.info("Password reset token generated", { userId: user.id });
+  logger13.info("Password reset token generated", { userId: user.id });
   return ok(void 0);
 }
 function buildPasswordResetOps(ctx) {
@@ -5409,17 +5659,17 @@ function buildPasswordResetOps(ctx) {
       const captcha = await verifyIamCaptcha(ctx.config.captcha, "passwordReset", options?.captcha);
       if (!captcha.success)
         return captcha;
-      logger12.debug("Password reset requested", { identifier });
+      logger13.debug("Password reset requested", { identifier });
       const resetConfig = ctx.resetConfig;
       if (!resetConfig.enabled || !onPasswordResetRequest)
         return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
       const userResult = await userRepository.findByIdentifier(identifier);
       if (!userResult.success) {
-        logger12.warn("Failed to look up user for password reset", { identifier });
+        logger13.warn("Failed to look up user for password reset", { identifier });
         return ok(void 0);
       }
       if (!userResult.data) {
-        logger12.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
+        logger13.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
         return ok(void 0);
       }
       const user = toUser(userResult.data);
@@ -5428,7 +5678,7 @@ function buildPasswordResetOps(ctx) {
       return issuePasswordReset(ctx, userResult.data);
     },
     async confirmPasswordReset(token, newPassword) {
-      logger12.debug("Confirming password reset");
+      logger13.debug("Confirming password reset");
       const resetConfig = ctx.resetConfig;
       if (!resetConfig.enabled)
         return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
@@ -5452,7 +5702,7 @@ function buildPasswordResetOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(claimed.data.id);
       if (!revoked.success)
         return revoked;
-      logger12.info("Password reset confirmed", { userId: claimed.data.id });
+      logger13.info("Password reset confirmed", { userId: claimed.data.id });
       return ok(void 0);
     }
   };
@@ -5517,7 +5767,7 @@ function buildUserFunctions(deps) {
 }
 
 // src/iam-main.ts
-var logger13 = core.logger.child({ module: "iam", scope: "main" });
+var logger14 = core.logger.child({ module: "iam", scope: "main" });
 var initInProgress = false;
 var currentConfig = null;
 var currentPublicConfig = null;
@@ -5548,7 +5798,7 @@ var notInitializedUser = new Proxy({}, {
 var iam = {
   async init(config) {
     if (initInProgress) {
-      logger13.warn("IAM init already in progress, skipping concurrent call");
+      logger14.warn("IAM init already in progress, skipping concurrent call");
       return err(
         HaiIamError.CONFIG_ERROR,
         iamM("iam_initInProgress")
@@ -5557,11 +5807,11 @@ var iam = {
     initInProgress = true;
     try {
       if (currentConfig !== null) {
-        logger13.warn("IAM module is already initialized, reinitializing");
+        logger14.warn("IAM module is already initialized, reinitializing");
         await iam.close();
       }
       const { ldapClientFactory, ldapSyncUser } = config;
-      logger13.info("Initializing IAM module");
+      logger14.info("Initializing IAM module");
       if (!reldb.isInitialized) {
         return err(
           HaiIamError.CONFIG_ERROR,
@@ -5586,7 +5836,7 @@ var iam = {
       }
       const parseResult = IamConfigSchema.safeParse(config);
       if (!parseResult.success) {
-        logger13.error("IAM config validation failed", { error: parseResult.error.message });
+        logger14.error("IAM config validation failed", { error: parseResult.error.message });
         return err(
           HaiIamError.CONFIG_ERROR,
           iamM("iam_configError", { params: { error: parseResult.error.message } }),
@@ -5595,7 +5845,7 @@ var iam = {
       }
       const parsed = parseResult.data;
       const { onPasswordResetRequest, onOtpSendEmail, onOtpSendSms } = await resolveIamNotifications(config);
-      logger13.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
+      logger14.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
       const migration = await migrateIam();
       if (!migration.success)
         return migration;
@@ -5603,7 +5853,7 @@ var iam = {
       const sessionResult = await createSessionOperations({
         config: parsed,
         readCredential: async (userId) => {
-          const found = await credentialUsers.findById(userId);
+          const found = await readIamUserSecurity(credentialUsers, userId);
           if (!found.success)
             return found;
           if (found.data) {
@@ -5611,7 +5861,7 @@ var iam = {
             if (!passwordState.success)
               return passwordState;
           }
-          return ok(found.data ? { version: found.data.credentialVersion ?? "", enabled: isUserActive(found.data) } : null);
+          return ok(found.data ? { version: found.data.credentialVersion ?? "", enabled: isUserActive(found.data), profile: { username: found.data.username, displayName: found.data.displayName, avatarUrl: found.data.avatarUrl } } : null);
         }
       });
       if (!sessionResult.success) {
@@ -5676,19 +5926,19 @@ var iam = {
             return;
           accountScanRunning = users.scanInactiveAccounts().then((result) => {
             if (!result.success)
-              logger13.error("Inactive account scan failed", { error: result.error });
+              logger14.error("Inactive account scan failed", { error: result.error });
           }).catch((error) => {
-            logger13.error("Inactive account scan failed", { error });
+            logger14.error("Inactive account scan failed", { error });
           }).finally(() => {
             accountScanRunning = void 0;
           });
         }, (parsed.accounts?.scanIntervalSeconds ?? 3600) * 1e3);
         accountScanTimer.unref();
       }
-      logger13.info("IAM module initialized");
+      logger14.info("IAM module initialized");
       return ok(void 0);
     } catch (error) {
-      logger13.error("IAM module initialization failed", { error });
+      logger14.error("IAM module initialization failed", { error });
       return err(
         HaiIamError.CONFIG_ERROR,
         iamM("iam_initFailed"),
@@ -5701,6 +5951,18 @@ var iam = {
   get auth() {
     return currentAuth ?? notInitializedAuth;
   },
+  async getPublicConfig() {
+    const snapshot = currentPublicConfig ? structuredClone(currentPublicConfig) : null;
+    const authz = currentAuthz;
+    if (!snapshot || !authz)
+      return notInitialized.result();
+    if (!snapshot.reauthentication.enabled)
+      return ok(snapshot);
+    const configured = await authz.getSensitiveOperations();
+    if (!configured.success)
+      return configured;
+    return ok({ ...snapshot, reauthentication: { ...snapshot.reauthentication, operations: [.../* @__PURE__ */ new Set([...snapshot.reauthentication.operations, ...configured.data])].sort() } });
+  },
   get user() {
     return currentUser ?? notInitializedUser;
   },
@@ -5730,10 +5992,10 @@ var iam = {
   },
   async close() {
     if (currentConfig === null && currentAuth === null && currentUser === null && currentAuthz === null && currentSession === null) {
-      logger13.info("IAM module already closed, skipping");
+      logger14.info("IAM module already closed, skipping");
       return;
     }
-    logger13.info("Closing IAM module");
+    logger14.info("Closing IAM module");
     clearInterval(accountScanTimer);
     accountScanTimer = void 0;
     await accountScanRunning;
@@ -5750,7 +6012,7 @@ var iam = {
     resetUserRepoSingleton();
     resetRoleRepoSingleton();
     resetPermissionRepoSingleton();
-    logger13.info("IAM module closed");
+    logger14.info("IAM module closed");
   }
 };