@h-ai/iam 0.1.0-alpha5

package/dist/index.js

@@ -0,0 +1,4762 @@
+import { z } from 'zod';
+import { cache } from '@h-ai/cache';
+import { core, err, ok } from '@h-ai/core';
+import { crypto as crypto$1 } from '@h-ai/crypto';
+import { reldb, BaseReldbCrudRepository } from '@h-ai/reldb';
+import { randomBytes } from 'crypto';
+import { audit } from '@h-ai/audit';
+
+// src/iam-config.ts
+var AuthStrategyTypeSchema = z.enum(["password", "otp", "ldap", "apikey"]);
+var PasswordConfigSchema = z.object({
+  /** 最小长度（默认 8） */
+  minLength: z.number().int().min(1).default(8),
+  /** 最大长度（默认 128） */
+  maxLength: z.number().int().max(256).default(128),
+  /** 需要大写字母 */
+  requireUppercase: z.boolean().default(true),
+  /** 需要小写字母 */
+  requireLowercase: z.boolean().default(true),
+  /** 需要数字 */
+  requireNumber: z.boolean().default(true),
+  /** 需要特殊字符 */
+  requireSpecialChar: z.boolean().default(false),
+  /** 密码过期天数（0 表示不过期） */
+  expirationDays: z.number().int().min(0).default(0)
+});
+var OtpConfigSchema = z.object({
+  /** 验证码长度（默认 6） */
+  length: z.number().int().min(4).max(8).default(6),
+  /** 验证码过期时间（秒，默认 300） */
+  expiresIn: z.number().int().min(60).default(300),
+  /** 最大重试次数（默认 3） */
+  maxAttempts: z.number().int().min(1).default(3),
+  /** 发送间隔（秒，默认 60） */
+  resendInterval: z.number().int().min(30).default(60)
+});
+var PasswordResetConfigSchema = z.object({
+  /** 重置令牌有效期（秒，默认 3600 = 1小时） */
+  tokenExpiresIn: z.number().int().min(300).default(3600),
+  /** 最大验证尝试次数（默认 3） */
+  maxAttempts: z.number().int().min(1).default(3)
+});
+var LdapConfigSchema = z.object({
+  /** LDAP 服务器 URL */
+  url: z.string().url(),
+  /** 绑定 DN */
+  bindDn: z.string(),
+  /** 绑定密码 */
+  bindPassword: z.string(),
+  /** 搜索基础 DN */
+  searchBase: z.string(),
+  /** 搜索过滤器（默认使用 uid） */
+  searchFilter: z.string().default("(uid={{username}})"),
+  /** 用户名属性 */
+  usernameAttribute: z.string().default("uid"),
+  /** 邮箱属性 */
+  emailAttribute: z.string().default("mail"),
+  /** 显示名称属性 */
+  displayNameAttribute: z.string().default("cn"),
+  /** 启用 TLS */
+  useTls: z.boolean().default(false),
+  /** 连接超时（毫秒） */
+  connectTimeout: z.number().int().min(1e3).default(5e3)
+});
+var ApiKeyConfigSchema = z.object({
+  /** 单用户最大 API Key 数量（默认 10） */
+  maxKeysPerUser: z.number().int().min(1).default(10),
+  /** API Key 默认有效期（天，0 表示永不过期，默认 0） */
+  defaultExpirationDays: z.number().int().min(0).default(0),
+  /** API Key 前缀（默认 'hai_'） */
+  prefix: z.string().default("hai_")
+});
+var LoginConfigSchema = z.object({
+  /** 是否启用密码登录 */
+  password: z.boolean().default(true),
+  /** 是否启用 OTP 登录 */
+  otp: z.boolean().default(true),
+  /** 是否启用 LDAP 登录 */
+  ldap: z.boolean().default(true),
+  /** 是否启用 API Key 登录 */
+  apikey: z.boolean().default(false)
+});
+var RegisterConfigSchema = z.object({
+  /** 是否启用注册 */
+  enabled: z.boolean().default(true),
+  /** 新注册用户是否默认启用 */
+  defaultEnabled: z.boolean().default(true)
+});
+var SecurityConfigSchema = z.object({
+  /** 最大登录失败次数（默认 5） */
+  maxLoginAttempts: z.number().int().min(1).default(5),
+  /** 锁定时长（秒，默认 900） */
+  lockoutDuration: z.number().int().min(60).default(900)
+});
+var AgreementConfigSchema = z.object({
+  /** 用户协议 URL */
+  userAgreementUrl: z.url().optional(),
+  /** 隐私协议 URL */
+  privacyPolicyUrl: z.url().optional(),
+  /** 注册时展示协议 */
+  showOnRegister: z.boolean().default(true),
+  /** 登录时展示协议 */
+  showOnLogin: z.boolean().default(false)
+});
+var SessionConfigSchema = z.object({
+  /** 会话超时时间（秒，默认 86400 = 24小时） */
+  maxAge: z.number().int().min(60).default(86400),
+  /** 是否滑动窗口（每次访问刷新过期时间） */
+  sliding: z.boolean().default(true),
+  /** 单设备登录（踢掉其他设备） */
+  singleDevice: z.boolean().default(false),
+  /** refreshToken 过期时间（秒，默认 604800 = 7天） */
+  refreshTokenMaxAge: z.number().int().min(3600).default(604800)
+});
+var RbacConfigSchema = z.object({
+  /** 是否启用 RBAC */
+  enabled: z.boolean().default(true),
+  /** 超级管理员角色代码 */
+  superAdminRole: z.string().default("super_admin"),
+  /** 默认用户角色 */
+  defaultRole: z.string().default("user")
+});
+var IamConfigSchema = z.object({
+  // ─── 认证策略配置 ───
+  /** 密码配置 */
+  password: PasswordConfigSchema.optional(),
+  /** OTP 配置 */
+  otp: OtpConfigSchema.optional(),
+  /** LDAP 配置 */
+  ldap: LdapConfigSchema.optional(),
+  /** API Key 配置 */
+  apikey: ApiKeyConfigSchema.optional(),
+  /** 密码重置配置 */
+  passwordReset: PasswordResetConfigSchema.optional(),
+  /** 登录启用配置 */
+  login: LoginConfigSchema.default({
+    password: true,
+    otp: true,
+    ldap: true,
+    apikey: false
+  }),
+  /** 注册配置 */
+  register: RegisterConfigSchema.default({
+    enabled: true,
+    defaultEnabled: true
+  }),
+  /** 协议展示配置 */
+  agreements: AgreementConfigSchema.default({
+    showOnRegister: true,
+    showOnLogin: false
+  }),
+  /** 安全策略配置 */
+  security: SecurityConfigSchema.default({
+    maxLoginAttempts: 5,
+    lockoutDuration: 900
+  }),
+  // ─── 会话配置 ───
+  /** 会话配置 */
+  session: SessionConfigSchema.optional(),
+  // ─── 授权配置 ───
+  /** RBAC 配置 */
+  rbac: RbacConfigSchema.optional(),
+  // ─── 运行时选项 ───
+  /** 是否初始化默认角色和权限（默认 true） */
+  seedDefaultData: z.boolean().default(true)
+});
+
+// messages/en-US.json
+var en_US_default = {
+  $schema: "https://inlang.com/schema/inlang-message-format",
+  iam_passwordMinLength: "Password must be at least {minLength} characters",
+  iam_passwordMaxLength: "Password cannot exceed {maxLength} characters",
+  iam_passwordNeedUppercase: "Password must contain uppercase letters",
+  iam_passwordNeedLowercase: "Password must contain lowercase letters",
+  iam_passwordNeedNumber: "Password must contain numbers",
+  iam_passwordNeedSpecialChar: "Password must contain special characters",
+  iam_credentialTypeMismatch: "Credential type mismatch",
+  iam_userNotExist: "User does not exist",
+  iam_accountDisabled: "Account is disabled",
+  iam_accountLocked: "Account is locked, please try again later",
+  iam_accountNoPassword: "Account has no password set",
+  iam_passwordWrong: "Incorrect password",
+  iam_passwordExpired: "Password has expired, please change your password",
+  iam_otpNotExistOrExpired: "Verification code does not exist or has expired",
+  iam_otpInvalid: "Verification code is invalid, please request a new one",
+  iam_otpWrong: "Incorrect verification code",
+  iam_otpResendTooFast: "Please wait {seconds} seconds before requesting another code",
+  iam_identifierTypeNotSupported: "Unsupported identifier type or delivery method not configured",
+  iam_loginDisabled: "Login via {type} is disabled",
+  iam_registerDisabled: "Registration is disabled",
+  iam_otpStrategyRequired: "OTP authentication requires OTP strategy configuration",
+  iam_otpStrategyRequiredForSend: "OTP requires OTP strategy configuration",
+  iam_userNotExistNoAutoRegister: "User does not exist and auto-registration is not enabled",
+  iam_refreshTokenFailed: "Failed to refresh token",
+  iam_refreshTokenExpired: "Refresh token has expired",
+  iam_refreshTokenRequestFailed: "Refresh token request failed",
+  iam_ldapConnectionFailed: "Unable to connect to LDAP server",
+  iam_ldapAdminBindFailed: "LDAP admin bind failed",
+  iam_ldapSearchFailed: "LDAP search failed",
+  iam_ldapStrategyRequired: "LDAP authentication requires LDAP strategy configuration",
+  iam_tokenExpired: "Token has expired",
+  iam_tokenInvalid: "Invalid token",
+  iam_createSessionFailed: "Failed to create session",
+  iam_sessionExpired: "Session has expired",
+  iam_invalidRefreshToken: "Invalid refresh token",
+  iam_sessionNotExist: "Session does not exist",
+  iam_usernameAlreadyExist: "Username already exists",
+  iam_emailAlreadyUsed: "Email is already in use",
+  iam_originalPasswordWrong: "Original password is incorrect",
+  iam_featureNotImplemented: "Feature not implemented",
+  iam_userAlreadyExist: "User already exists",
+  iam_parseSessionDataFailed: "Failed to parse session data",
+  iam_roleAlreadyExist: "Role already exists",
+  iam_roleNotExist: "Role does not exist",
+  iam_cannotDeleteSystemRole: "Cannot delete system role",
+  iam_permissionAlreadyExist: "Permission already exists",
+  iam_permissionNotExist: "Permission does not exist",
+  iam_notInitialized: "Not initialized, please call iam.init() first",
+  iam_initFailed: "Initialization failed",
+  iam_depsNotInitialized: "Dependency {dep} is not initialized, please call {dep}.init() before iam.init()",
+  iam_initInProgress: "IAM initialization is already in progress",
+  iam_cacheRequired: "Cache service is required for session management",
+  iam_initComponentFailed: "Failed to initialize component",
+  iam_initSeedDataFailed: "Failed to initialize seed data",
+  iam_createUserTableFailed: "Failed to create user table: {message}",
+  iam_queryUserFailed: "Failed to query user: {message}",
+  iam_createUserFailed: "Failed to create user: {message}",
+  iam_queryUserListFailed: "Failed to query user list: {message}",
+  iam_updateUserFailed: "Failed to update user: {message}",
+  iam_deleteUserFailed: "Failed to delete user: {message}",
+  iam_createSessionTableFailed: "Failed to create session table: {message}",
+  iam_createSessionIndexFailed: "Failed to create session index: {message}",
+  iam_createSessionRecordFailed: "Failed to create session record: {message}",
+  iam_querySessionFailed: "Failed to query session: {message}",
+  iam_updateSessionFailed: "Failed to update session: {message}",
+  iam_deleteSessionFailed: "Failed to delete session: {message}",
+  iam_cleanupSessionFailed: "Failed to cleanup session: {message}",
+  iam_createSessionStoreTableFailed: "Failed to create session store table: {message}",
+  iam_createTokenMappingTableFailed: "Failed to create token mapping table: {message}",
+  iam_createUserSessionTableFailed: "Failed to create user session table: {message}",
+  iam_createSessionStoreIndexFailed: "Failed to create session index: {message}",
+  iam_saveSessionFailed: "Failed to save session: {message}",
+  iam_queryTokenMappingFailed: "Failed to query token mapping: {message}",
+  iam_saveTokenMappingFailed: "Failed to save token mapping: {message}",
+  iam_deleteTokenMappingFailed: "Failed to delete token mapping: {message}",
+  iam_deleteUserSessionMappingFailed: "Failed to delete user session mapping: {message}",
+  iam_queryUserSessionFailed: "Failed to query user session: {message}",
+  iam_addUserSessionMappingFailed: "Failed to add user session mapping: {message}",
+  iam_createRoleTableFailed: "Failed to create role table: {message}",
+  iam_queryRoleFailed: "Failed to query role: {message}",
+  iam_queryRoleListFailed: "Failed to query role list: {message}",
+  iam_createRoleFailed: "Failed to create role: {message}",
+  iam_updateRoleFailed: "Failed to update role: {message}",
+  iam_deleteRoleFailed: "Failed to delete role: {message}",
+  iam_createRolePermissionTableFailed: "Failed to create role-permission table: {message}",
+  iam_createRolePermissionIndexFailed: "Failed to create role-permission index: {message}",
+  iam_assignPermissionFailed: "Failed to assign permission: {message}",
+  iam_removePermissionFailed: "Failed to remove permission: {message}",
+  iam_createUserRoleTableFailed: "Failed to create user-role table: {message}",
+  iam_createUserRoleIndexFailed: "Failed to create user-role index: {message}",
+  iam_assignRoleFailed: "Failed to assign role: {message}",
+  iam_removeRoleFailed: "Failed to remove role: {message}",
+  iam_syncRolesFailed: "Failed to sync roles: {message}",
+  iam_createPermissionTableFailed: "Failed to create permission table: {message}",
+  iam_createPermissionFailed: "Failed to create permission: {message}",
+  iam_queryPermissionFailed: "Failed to query permission: {message}",
+  iam_queryPermissionListFailed: "Failed to query permission list: {message}",
+  iam_deletePermissionFailed: "Failed to delete permission: {message}",
+  iam_queryPermissionCacheFailed: "Failed to query permission cache: {message}",
+  iam_setPermissionCacheFailed: "Failed to set permission cache: {message}",
+  iam_clearPermissionCacheFailed: "Failed to clear permission cache: {message}",
+  iam_queryOtpCacheFailed: "Failed to query OTP cache: {message}",
+  iam_saveOtpCacheFailed: "Failed to save OTP cache: {message}",
+  iam_updateOtpCacheFailed: "Failed to update OTP cache: {message}",
+  iam_deleteOtpCacheFailed: "Failed to delete OTP cache: {message}",
+  iam_querySessionMappingCacheFailed: "Failed to query session mapping cache: {message}",
+  iam_saveSessionMappingCacheFailed: "Failed to save session mapping cache: {message}",
+  iam_deleteSessionMappingCacheFailed: "Failed to delete session mapping cache: {message}",
+  iam_queryTokenMappingCacheFailed: "Failed to query token mapping cache: {message}",
+  iam_saveTokenMappingCacheFailed: "Failed to save token mapping cache: {message}",
+  iam_deleteTokenMappingCacheFailed: "Failed to delete token mapping cache: {message}",
+  iam_queryUserSessionCacheFailed: "Failed to query user session cache: {message}",
+  iam_saveUserSessionCacheFailed: "Failed to save user session cache: {message}",
+  iam_deleteUserSessionCacheFailed: "Failed to delete user session cache: {message}",
+  iam_createOtpTableFailed: "Failed to create OTP table: {message}",
+  iam_saveOtpFailed: "Failed to save OTP: {message}",
+  iam_queryOtpFailed: "Failed to query OTP: {message}",
+  iam_updateOtpAttemptsFailed: "Failed to update OTP attempts: {message}",
+  iam_deleteOtpFailed: "Failed to delete OTP: {message}",
+  iam_otpSendFailed: "Failed to send OTP: {message}",
+  iam_resetTokenInvalid: "Invalid or expired password reset token",
+  iam_resetTokenMaxAttempts: "Too many verification attempts, please request a new reset token",
+  iam_saveResetTokenFailed: "Failed to save password reset token: {message}",
+  iam_hashResetTokenFailed: "Failed to hash reset token: {message}",
+  iam_queryResetTokenFailed: "Failed to query password reset token: {message}",
+  iam_passwordResetNotConfigured: "Password reset is not configured",
+  iam_clientFetchNotAvailable: "Fetch is not available in the current environment",
+  iam_clientRequestFailed: "Request failed: {status}",
+  iam_clientNetworkError: "Network request failed",
+  iam_clientNetworkErrorWithDetail: "Network request failed: {message}",
+  iam_seedRoleAdminName: "Administrator",
+  iam_seedRoleAdminDesc: "System administrator with all permissions",
+  iam_seedRoleUserName: "User",
+  iam_seedRoleUserDesc: "Standard user",
+  iam_seedRoleGuestName: "Guest",
+  iam_seedRoleGuestDesc: "Guest with read-only access",
+  iam_seedPermUserRead: "View Users",
+  iam_seedPermUserCreate: "Create Users",
+  iam_seedPermUserUpdate: "Update Users",
+  iam_seedPermUserDelete: "Delete Users",
+  iam_seedPermUserList: "List Users API",
+  iam_seedPermUserApiCreate: "Create User API",
+  iam_seedPermUserApiUpdate: "Update User API",
+  iam_seedPermUserApiDelete: "Delete User API",
+  iam_seedPermRoleRead: "View Roles",
+  iam_seedPermRoleCreate: "Create Roles",
+  iam_seedPermRoleUpdate: "Update Roles",
+  iam_seedPermRoleDelete: "Delete Roles",
+  iam_seedPermRoleList: "List Roles API",
+  iam_seedPermRoleApiCreate: "Create Role API",
+  iam_seedPermRoleApiUpdate: "Update Role API",
+  iam_seedPermRoleApiDelete: "Delete Role API",
+  iam_seedPermPermRead: "View Permissions",
+  iam_seedPermPermManage: "Manage Permissions",
+  iam_seedPermPermCreate: "Create Permissions",
+  iam_seedPermPermDelete: "Delete Permissions",
+  iam_seedPermPermList: "List Permissions API",
+  iam_seedPermPermApiCreate: "Create Permission API",
+  iam_seedPermPermApiDelete: "Delete Permission API",
+  iam_seedPermSystemSettings: "System Settings",
+  iam_seedPermSystemLogs: "View Logs",
+  iam_seedPermSystemModules: "Module Management",
+  iam_seedPermDashboardView: "Dashboard",
+  iam_seedPermProfileRead: "Profile",
+  iam_seedPermAuditRead: "Audit Logs",
+  iam_configError: "IAM config validation failed: {error}",
+  iam_apikeyInvalid: "Invalid API Key",
+  iam_apikeyExpired: "API Key has expired",
+  iam_apikeyDisabled: "API Key is disabled",
+  iam_apikeyMaxKeysReached: "Maximum number of API Keys ({max}) reached",
+  iam_apikeyCreateFailed: "Failed to create API Key: {message}",
+  iam_apikeyUpdateFailed: "Failed to update API Key: {message}",
+  iam_apikeyDeleteFailed: "Failed to delete API Key: {message}",
+  iam_apikeyQueryFailed: "Failed to query API Key: {message}",
+  iam_apikeyStrategyRequired: "API Key authentication requires API Key strategy configuration"
+};
+
+// messages/zh-CN.json
+var zh_CN_default = {
+  $schema: "https://inlang.com/schema/inlang-message-format",
+  iam_passwordMinLength: "\u5BC6\u7801\u957F\u5EA6\u81F3\u5C11\u4E3A {minLength} \u4E2A\u5B57\u7B26",
+  iam_passwordMaxLength: "\u5BC6\u7801\u957F\u5EA6\u4E0D\u80FD\u8D85\u8FC7 {maxLength} \u4E2A\u5B57\u7B26",
+  iam_passwordNeedUppercase: "\u5BC6\u7801\u5FC5\u987B\u5305\u542B\u5927\u5199\u5B57\u6BCD",
+  iam_passwordNeedLowercase: "\u5BC6\u7801\u5FC5\u987B\u5305\u542B\u5C0F\u5199\u5B57\u6BCD",
+  iam_passwordNeedNumber: "\u5BC6\u7801\u5FC5\u987B\u5305\u542B\u6570\u5B57",
+  iam_passwordNeedSpecialChar: "\u5BC6\u7801\u5FC5\u987B\u5305\u542B\u7279\u6B8A\u5B57\u7B26",
+  iam_credentialTypeMismatch: "\u51ED\u8BC1\u7C7B\u578B\u4E0D\u5339\u914D",
+  iam_userNotExist: "\u7528\u6237\u4E0D\u5B58\u5728",
+  iam_accountDisabled: "\u8D26\u6237\u5DF2\u7981\u7528",
+  iam_accountLocked: "\u8D26\u6237\u5DF2\u9501\u5B9A\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  iam_accountNoPassword: "\u8D26\u6237\u672A\u8BBE\u7F6E\u5BC6\u7801",
+  iam_passwordWrong: "\u5BC6\u7801\u9519\u8BEF",
+  iam_passwordExpired: "\u5BC6\u7801\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u4FEE\u6539\u5BC6\u7801",
+  iam_otpNotExistOrExpired: "\u9A8C\u8BC1\u7801\u4E0D\u5B58\u5728\u6216\u5DF2\u8FC7\u671F",
+  iam_otpInvalid: "\u9A8C\u8BC1\u7801\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u83B7\u53D6",
+  iam_otpWrong: "\u9A8C\u8BC1\u7801\u9519\u8BEF",
+  iam_otpResendTooFast: "\u8BF7\u7B49\u5F85 {seconds} \u79D2\u540E\u518D\u83B7\u53D6\u9A8C\u8BC1\u7801",
+  iam_identifierTypeNotSupported: "\u4E0D\u652F\u6301\u7684\u6807\u8BC6\u7B26\u7C7B\u578B\u6216\u53D1\u9001\u65B9\u5F0F\u672A\u914D\u7F6E",
+  iam_loginDisabled: "{type} \u767B\u5F55\u5DF2\u7981\u7528",
+  iam_registerDisabled: "\u6CE8\u518C\u529F\u80FD\u5DF2\u7981\u7528",
+  iam_otpStrategyRequired: "OTP \u8BA4\u8BC1\u9700\u8981\u914D\u7F6E OTP \u7B56\u7565",
+  iam_otpStrategyRequiredForSend: "OTP \u9700\u8981\u914D\u7F6E OTP \u7B56\u7565",
+  iam_userNotExistNoAutoRegister: "\u7528\u6237\u4E0D\u5B58\u5728\u4E14\u672A\u542F\u7528\u81EA\u52A8\u6CE8\u518C",
+  iam_refreshTokenFailed: "\u5237\u65B0\u4EE4\u724C\u5931\u8D25",
+  iam_refreshTokenExpired: "\u5237\u65B0\u4EE4\u724C\u5DF2\u8FC7\u671F",
+  iam_refreshTokenRequestFailed: "\u5237\u65B0\u4EE4\u724C\u8BF7\u6C42\u5931\u8D25",
+  iam_ldapConnectionFailed: "\u65E0\u6CD5\u8FDE\u63A5\u5230 LDAP \u670D\u52A1\u5668",
+  iam_ldapAdminBindFailed: "LDAP \u7BA1\u7406\u5458\u7ED1\u5B9A\u5931\u8D25",
+  iam_ldapSearchFailed: "LDAP \u641C\u7D22\u5931\u8D25",
+  iam_ldapStrategyRequired: "LDAP \u8BA4\u8BC1\u9700\u8981\u914D\u7F6E LDAP \u7B56\u7565",
+  iam_tokenExpired: "\u4EE4\u724C\u5DF2\u8FC7\u671F",
+  iam_tokenInvalid: "\u4EE4\u724C\u65E0\u6548",
+  iam_createSessionFailed: "\u521B\u5EFA\u4F1A\u8BDD\u5931\u8D25",
+  iam_sessionExpired: "\u4F1A\u8BDD\u5DF2\u5931\u6548",
+  iam_invalidRefreshToken: "\u65E0\u6548\u7684\u5237\u65B0\u4EE4\u724C",
+  iam_sessionNotExist: "\u4F1A\u8BDD\u4E0D\u5B58\u5728",
+  iam_usernameAlreadyExist: "\u7528\u6237\u540D\u5DF2\u5B58\u5728",
+  iam_emailAlreadyUsed: "\u90AE\u7BB1\u5DF2\u88AB\u4F7F\u7528",
+  iam_originalPasswordWrong: "\u539F\u5BC6\u7801\u9519\u8BEF",
+  iam_featureNotImplemented: "\u529F\u80FD\u6682\u672A\u5B9E\u73B0",
+  iam_userAlreadyExist: "\u7528\u6237\u5DF2\u5B58\u5728",
+  iam_parseSessionDataFailed: "\u89E3\u6790\u4F1A\u8BDD\u6570\u636E\u5931\u8D25",
+  iam_roleAlreadyExist: "\u89D2\u8272\u5DF2\u5B58\u5728",
+  iam_roleNotExist: "\u89D2\u8272\u4E0D\u5B58\u5728",
+  iam_cannotDeleteSystemRole: "\u4E0D\u80FD\u5220\u9664\u7CFB\u7EDF\u89D2\u8272",
+  iam_permissionAlreadyExist: "\u6743\u9650\u5DF2\u5B58\u5728",
+  iam_permissionNotExist: "\u6743\u9650\u4E0D\u5B58\u5728",
+  iam_notInitialized: "\u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 iam.init()",
+  iam_initFailed: "\u521D\u59CB\u5316\u5931\u8D25",
+  iam_depsNotInitialized: "\u4F9D\u8D56 {dep} \u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5728 iam.init() \u4E4B\u524D\u8C03\u7528 {dep}.init()",
+  iam_initInProgress: "IAM \u521D\u59CB\u5316\u6B63\u5728\u8FDB\u884C\u4E2D",
+  iam_cacheRequired: "\u4F1A\u8BDD\u7BA1\u7406\u9700\u8981\u63D0\u4F9B\u7F13\u5B58\u670D\u52A1",
+  iam_initComponentFailed: "\u521D\u59CB\u5316\u7EC4\u4EF6\u5931\u8D25",
+  iam_initSeedDataFailed: "\u521D\u59CB\u5316\u79CD\u5B50\u6570\u636E\u5931\u8D25",
+  iam_createUserTableFailed: "\u521B\u5EFA\u7528\u6237\u8868\u5931\u8D25: {message}",
+  iam_queryUserFailed: "\u67E5\u8BE2\u7528\u6237\u5931\u8D25: {message}",
+  iam_createUserFailed: "\u521B\u5EFA\u7528\u6237\u5931\u8D25: {message}",
+  iam_queryUserListFailed: "\u67E5\u8BE2\u7528\u6237\u5217\u8868\u5931\u8D25: {message}",
+  iam_updateUserFailed: "\u66F4\u65B0\u7528\u6237\u5931\u8D25: {message}",
+  iam_deleteUserFailed: "\u5220\u9664\u7528\u6237\u5931\u8D25: {message}",
+  iam_createSessionTableFailed: "\u521B\u5EFA\u4F1A\u8BDD\u8868\u5931\u8D25: {message}",
+  iam_createSessionIndexFailed: "\u521B\u5EFA\u4F1A\u8BDD\u7D22\u5F15\u5931\u8D25: {message}",
+  iam_createSessionRecordFailed: "\u521B\u5EFA\u4F1A\u8BDD\u5931\u8D25: {message}",
+  iam_querySessionFailed: "\u67E5\u8BE2\u4F1A\u8BDD\u5931\u8D25: {message}",
+  iam_updateSessionFailed: "\u66F4\u65B0\u4F1A\u8BDD\u5931\u8D25: {message}",
+  iam_deleteSessionFailed: "\u5220\u9664\u4F1A\u8BDD\u5931\u8D25: {message}",
+  iam_cleanupSessionFailed: "\u6E05\u7406\u4F1A\u8BDD\u5931\u8D25: {message}",
+  iam_createSessionStoreTableFailed: "\u521B\u5EFA\u4F1A\u8BDD\u5B58\u50A8\u8868\u5931\u8D25: {message}",
+  iam_createTokenMappingTableFailed: "\u521B\u5EFA\u4EE4\u724C\u6620\u5C04\u8868\u5931\u8D25: {message}",
+  iam_createUserSessionTableFailed: "\u521B\u5EFA\u7528\u6237\u4F1A\u8BDD\u8868\u5931\u8D25: {message}",
+  iam_createSessionStoreIndexFailed: "\u521B\u5EFA\u4F1A\u8BDD\u7D22\u5F15\u5931\u8D25: {message}",
+  iam_saveSessionFailed: "\u4FDD\u5B58\u4F1A\u8BDD\u5931\u8D25: {message}",
+  iam_queryTokenMappingFailed: "\u67E5\u8BE2\u4EE4\u724C\u6620\u5C04\u5931\u8D25: {message}",
+  iam_saveTokenMappingFailed: "\u4FDD\u5B58\u4EE4\u724C\u6620\u5C04\u5931\u8D25: {message}",
+  iam_deleteTokenMappingFailed: "\u5220\u9664\u4EE4\u724C\u6620\u5C04\u5931\u8D25: {message}",
+  iam_deleteUserSessionMappingFailed: "\u5220\u9664\u7528\u6237\u4F1A\u8BDD\u6620\u5C04\u5931\u8D25: {message}",
+  iam_queryUserSessionFailed: "\u67E5\u8BE2\u7528\u6237\u4F1A\u8BDD\u5931\u8D25: {message}",
+  iam_addUserSessionMappingFailed: "\u6DFB\u52A0\u7528\u6237\u4F1A\u8BDD\u6620\u5C04\u5931\u8D25: {message}",
+  iam_createRoleTableFailed: "\u521B\u5EFA\u89D2\u8272\u8868\u5931\u8D25: {message}",
+  iam_queryRoleFailed: "\u67E5\u8BE2\u89D2\u8272\u5931\u8D25: {message}",
+  iam_queryRoleListFailed: "\u67E5\u8BE2\u89D2\u8272\u5217\u8868\u5931\u8D25: {message}",
+  iam_createRoleFailed: "\u521B\u5EFA\u89D2\u8272\u5931\u8D25: {message}",
+  iam_updateRoleFailed: "\u66F4\u65B0\u89D2\u8272\u5931\u8D25: {message}",
+  iam_deleteRoleFailed: "\u5220\u9664\u89D2\u8272\u5931\u8D25: {message}",
+  iam_createRolePermissionTableFailed: "\u521B\u5EFA\u89D2\u8272-\u6743\u9650\u5173\u8054\u8868\u5931\u8D25: {message}",
+  iam_createRolePermissionIndexFailed: "\u521B\u5EFA\u89D2\u8272-\u6743\u9650\u7D22\u5F15\u5931\u8D25: {message}",
+  iam_assignPermissionFailed: "\u5206\u914D\u6743\u9650\u5931\u8D25: {message}",
+  iam_removePermissionFailed: "\u79FB\u9664\u6743\u9650\u5931\u8D25: {message}",
+  iam_createUserRoleTableFailed: "\u521B\u5EFA\u7528\u6237-\u89D2\u8272\u5173\u8054\u8868\u5931\u8D25: {message}",
+  iam_createUserRoleIndexFailed: "\u521B\u5EFA\u7528\u6237-\u89D2\u8272\u7D22\u5F15\u5931\u8D25: {message}",
+  iam_assignRoleFailed: "\u5206\u914D\u89D2\u8272\u5931\u8D25: {message}",
+  iam_removeRoleFailed: "\u79FB\u9664\u89D2\u8272\u5931\u8D25: {message}",
+  iam_syncRolesFailed: "\u540C\u6B65\u89D2\u8272\u5931\u8D25: {message}",
+  iam_createPermissionTableFailed: "\u521B\u5EFA\u6743\u9650\u8868\u5931\u8D25: {message}",
+  iam_createPermissionFailed: "\u521B\u5EFA\u6743\u9650\u5931\u8D25: {message}",
+  iam_queryPermissionFailed: "\u67E5\u8BE2\u6743\u9650\u5931\u8D25: {message}",
+  iam_queryPermissionListFailed: "\u67E5\u8BE2\u6743\u9650\u5217\u8868\u5931\u8D25: {message}",
+  iam_deletePermissionFailed: "\u5220\u9664\u6743\u9650\u5931\u8D25: {message}",
+  iam_queryPermissionCacheFailed: "\u67E5\u8BE2\u6743\u9650\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_setPermissionCacheFailed: "\u8BBE\u7F6E\u6743\u9650\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_clearPermissionCacheFailed: "\u6E05\u9664\u6743\u9650\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_queryOtpCacheFailed: "\u67E5\u8BE2 OTP \u7F13\u5B58\u5931\u8D25: {message}",
+  iam_saveOtpCacheFailed: "\u4FDD\u5B58 OTP \u7F13\u5B58\u5931\u8D25: {message}",
+  iam_updateOtpCacheFailed: "\u66F4\u65B0 OTP \u7F13\u5B58\u5931\u8D25: {message}",
+  iam_deleteOtpCacheFailed: "\u5220\u9664 OTP \u7F13\u5B58\u5931\u8D25: {message}",
+  iam_querySessionMappingCacheFailed: "\u67E5\u8BE2\u4F1A\u8BDD\u6620\u5C04\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_saveSessionMappingCacheFailed: "\u4FDD\u5B58\u4F1A\u8BDD\u6620\u5C04\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_deleteSessionMappingCacheFailed: "\u5220\u9664\u4F1A\u8BDD\u6620\u5C04\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_queryTokenMappingCacheFailed: "\u67E5\u8BE2\u4EE4\u724C\u6620\u5C04\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_saveTokenMappingCacheFailed: "\u4FDD\u5B58\u4EE4\u724C\u6620\u5C04\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_deleteTokenMappingCacheFailed: "\u5220\u9664\u4EE4\u724C\u6620\u5C04\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_queryUserSessionCacheFailed: "\u67E5\u8BE2\u7528\u6237\u4F1A\u8BDD\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_saveUserSessionCacheFailed: "\u4FDD\u5B58\u7528\u6237\u4F1A\u8BDD\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_deleteUserSessionCacheFailed: "\u5220\u9664\u7528\u6237\u4F1A\u8BDD\u7F13\u5B58\u5931\u8D25: {message}",
+  iam_createOtpTableFailed: "\u521B\u5EFA OTP \u8868\u5931\u8D25: {message}",
+  iam_saveOtpFailed: "\u4FDD\u5B58 OTP \u5931\u8D25: {message}",
+  iam_queryOtpFailed: "\u67E5\u8BE2 OTP \u5931\u8D25: {message}",
+  iam_updateOtpAttemptsFailed: "\u66F4\u65B0 OTP \u5C1D\u8BD5\u6B21\u6570\u5931\u8D25: {message}",
+  iam_deleteOtpFailed: "\u5220\u9664 OTP \u5931\u8D25: {message}",
+  iam_otpSendFailed: "\u9A8C\u8BC1\u7801\u53D1\u9001\u5931\u8D25: {message}",
+  iam_resetTokenInvalid: "\u5BC6\u7801\u91CD\u7F6E\u4EE4\u724C\u65E0\u6548\u6216\u5DF2\u8FC7\u671F",
+  iam_resetTokenMaxAttempts: "\u9A8C\u8BC1\u6B21\u6570\u8FC7\u591A\uFF0C\u8BF7\u91CD\u65B0\u7533\u8BF7\u91CD\u7F6E\u4EE4\u724C",
+  iam_saveResetTokenFailed: "\u4FDD\u5B58\u5BC6\u7801\u91CD\u7F6E\u4EE4\u724C\u5931\u8D25: {message}",
+  iam_hashResetTokenFailed: "\u5BC6\u7801\u91CD\u7F6E\u4EE4\u724C\u54C8\u5E0C\u5931\u8D25: {message}",
+  iam_queryResetTokenFailed: "\u67E5\u8BE2\u5BC6\u7801\u91CD\u7F6E\u4EE4\u724C\u5931\u8D25: {message}",
+  iam_passwordResetNotConfigured: "\u5BC6\u7801\u91CD\u7F6E\u529F\u80FD\u672A\u914D\u7F6E",
+  iam_clientFetchNotAvailable: "\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301 Fetch",
+  iam_clientRequestFailed: "\u8BF7\u6C42\u5931\u8D25: {status}",
+  iam_clientNetworkError: "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25",
+  iam_clientNetworkErrorWithDetail: "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25: {message}",
+  iam_seedRoleAdminName: "\u7BA1\u7406\u5458",
+  iam_seedRoleAdminDesc: "\u7CFB\u7EDF\u7BA1\u7406\u5458\uFF0C\u62E5\u6709\u6240\u6709\u6743\u9650",
+  iam_seedRoleUserName: "\u666E\u901A\u7528\u6237",
+  iam_seedRoleUserDesc: "\u666E\u901A\u7528\u6237",
+  iam_seedRoleGuestName: "\u8BBF\u5BA2",
+  iam_seedRoleGuestDesc: "\u8BBF\u5BA2\uFF0C\u53EA\u8BFB\u6743\u9650",
+  iam_seedPermUserRead: "\u67E5\u770B\u7528\u6237",
+  iam_seedPermUserCreate: "\u521B\u5EFA\u7528\u6237",
+  iam_seedPermUserUpdate: "\u66F4\u65B0\u7528\u6237",
+  iam_seedPermUserDelete: "\u5220\u9664\u7528\u6237",
+  iam_seedPermUserList: "\u7528\u6237\u5217\u8868 API",
+  iam_seedPermUserApiCreate: "\u521B\u5EFA\u7528\u6237 API",
+  iam_seedPermUserApiUpdate: "\u66F4\u65B0\u7528\u6237 API",
+  iam_seedPermUserApiDelete: "\u5220\u9664\u7528\u6237 API",
+  iam_seedPermRoleRead: "\u67E5\u770B\u89D2\u8272",
+  iam_seedPermRoleCreate: "\u521B\u5EFA\u89D2\u8272",
+  iam_seedPermRoleUpdate: "\u66F4\u65B0\u89D2\u8272",
+  iam_seedPermRoleDelete: "\u5220\u9664\u89D2\u8272",
+  iam_seedPermRoleList: "\u89D2\u8272\u5217\u8868 API",
+  iam_seedPermRoleApiCreate: "\u521B\u5EFA\u89D2\u8272 API",
+  iam_seedPermRoleApiUpdate: "\u66F4\u65B0\u89D2\u8272 API",
+  iam_seedPermRoleApiDelete: "\u5220\u9664\u89D2\u8272 API",
+  iam_seedPermPermRead: "\u67E5\u770B\u6743\u9650",
+  iam_seedPermPermManage: "\u7BA1\u7406\u6743\u9650",
+  iam_seedPermPermCreate: "\u521B\u5EFA\u6743\u9650",
+  iam_seedPermPermDelete: "\u5220\u9664\u6743\u9650",
+  iam_seedPermPermList: "\u6743\u9650\u5217\u8868 API",
+  iam_seedPermPermApiCreate: "\u521B\u5EFA\u6743\u9650 API",
+  iam_seedPermPermApiDelete: "\u5220\u9664\u6743\u9650 API",
+  iam_seedPermSystemSettings: "\u7CFB\u7EDF\u8BBE\u7F6E",
+  iam_seedPermSystemLogs: "\u67E5\u770B\u65E5\u5FD7",
+  iam_seedPermSystemModules: "\u6A21\u5757\u7BA1\u7406",
+  iam_seedPermDashboardView: "\u4EEA\u8868\u76D8",
+  iam_seedPermProfileRead: "\u4E2A\u4EBA\u4E2D\u5FC3",
+  iam_seedPermAuditRead: "\u5BA1\u8BA1\u65E5\u5FD7",
+  iam_configError: "IAM \u914D\u7F6E\u6821\u9A8C\u5931\u8D25\uFF1A{error}",
+  iam_apikeyInvalid: "API Key \u65E0\u6548",
+  iam_apikeyExpired: "API Key \u5DF2\u8FC7\u671F",
+  iam_apikeyDisabled: "API Key \u5DF2\u7981\u7528",
+  iam_apikeyMaxKeysReached: "API Key \u6570\u91CF\u5DF2\u8FBE\u4E0A\u9650\uFF08{max}\uFF09",
+  iam_apikeyCreateFailed: "\u521B\u5EFA API Key \u5931\u8D25\uFF1A{message}",
+  iam_apikeyUpdateFailed: "\u66F4\u65B0 API Key \u5931\u8D25\uFF1A{message}",
+  iam_apikeyDeleteFailed: "\u5220\u9664 API Key \u5931\u8D25\uFF1A{message}",
+  iam_apikeyQueryFailed: "\u67E5\u8BE2 API Key \u5931\u8D25\uFF1A{message}",
+  iam_apikeyStrategyRequired: "API Key \u8BA4\u8BC1\u9700\u8981 API Key \u7B56\u7565\u914D\u7F6E"
+};
+
+// src/iam-i18n.ts
+var iamM = core.i18n.createMessageGetter({
+  "zh-CN": zh_CN_default,
+  "en-US": en_US_default
+});
+var IamErrorInfo = {
+  AUTH_FAILED: "001:401",
+  INVALID_CREDENTIALS: "002:401",
+  USER_NOT_FOUND: "003:404",
+  USER_DISABLED: "004:403",
+  USER_LOCKED: "005:403",
+  USER_ALREADY_EXISTS: "006:409",
+  PASSWORD_EXPIRED: "007:401",
+  PASSWORD_POLICY_VIOLATION: "008:400",
+  OTP_INVALID: "009:400",
+  OTP_EXPIRED: "010:400",
+  OTP_RESEND_TOO_FAST: "011:429",
+  LOGIN_DISABLED: "012:400",
+  REGISTER_DISABLED: "013:403",
+  STRATEGY_NOT_SUPPORTED: "014:400",
+  APIKEY_INVALID: "015:401",
+  APIKEY_EXPIRED: "016:401",
+  APIKEY_DISABLED: "017:403",
+  APIKEY_NOT_FOUND: "018:404",
+  RESET_TOKEN_INVALID: "019:400",
+  RESET_TOKEN_EXPIRED: "020:400",
+  RESET_TOKEN_MAX_ATTEMPTS: "021:429",
+  SESSION_NOT_FOUND: "101:401",
+  SESSION_EXPIRED: "102:401",
+  SESSION_INVALID: "103:401",
+  SESSION_CREATE_FAILED: "104:500",
+  TOKEN_EXPIRED: "105:401",
+  TOKEN_INVALID: "106:401",
+  TOKEN_REFRESH_FAILED: "107:401",
+  PERMISSION_DENIED: "201:403",
+  ROLE_NOT_FOUND: "202:404",
+  PERMISSION_NOT_FOUND: "203:404",
+  ROLE_ALREADY_EXISTS: "204:409",
+  PERMISSION_ALREADY_EXISTS: "205:409",
+  LDAP_CONNECTION_FAILED: "301:500",
+  LDAP_BIND_FAILED: "302:401",
+  LDAP_SEARCH_FAILED: "303:500",
+  REPOSITORY_ERROR: "401:500",
+  NOT_FOUND: "402:404",
+  CONFLICT: "403:409",
+  FORBIDDEN: "501:403",
+  INVALID_ARGUMENT: "502:400",
+  CONFIG_ERROR: "901:500",
+  NOT_INITIALIZED: "910:500",
+  INTERNAL_ERROR: "999:500"
+};
+var HaiIamError = core.error.buildHaiErrorsDef("iam", IamErrorInfo);
+
+// src/authn/apikey/iam-authn-apikey-repository.ts
+var TABLE_NAME = "hai_iam_api_keys";
+var API_KEY_FIELDS = [
+  {
+    fieldName: "id",
+    columnName: "id",
+    def: { type: "TEXT", primaryKey: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "userId",
+    columnName: "user_id",
+    def: { type: "TEXT", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "name",
+    columnName: "name",
+    def: { type: "TEXT", notNull: true },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "keyHash",
+    columnName: "key_hash",
+    def: { type: "TEXT", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "keyPrefix",
+    columnName: "key_prefix",
+    def: { type: "TEXT", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "enabled",
+    columnName: "enabled",
+    def: { type: "BOOLEAN", notNull: true, defaultValue: 1 },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "expiresAt",
+    columnName: "expires_at",
+    def: { type: "TIMESTAMP" },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "createdAt",
+    columnName: "created_at",
+    def: { type: "TIMESTAMP", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "lastUsedAt",
+    columnName: "last_used_at",
+    def: { type: "TIMESTAMP" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "scopes",
+    columnName: "scopes",
+    def: { type: "JSON" },
+    select: true,
+    create: true,
+    update: true
+  }
+];
+var apiKeyRepoInstance = null;
+var apiKeyRepoDbConfig = null;
+function resetApiKeyRepoSingleton() {
+  apiKeyRepoInstance = null;
+  apiKeyRepoDbConfig = null;
+}
+async function createDbApiKeyRepository() {
+  if (apiKeyRepoInstance && apiKeyRepoDbConfig === reldb.config)
+    return apiKeyRepoInstance;
+  const repo = new DbApiKeyRepository();
+  await repo.count();
+  apiKeyRepoInstance = repo;
+  apiKeyRepoDbConfig = reldb.config;
+  return repo;
+}
+var DbApiKeyRepository = class extends BaseReldbCrudRepository {
+  constructor() {
+    super(reldb, {
+      table: TABLE_NAME,
+      fields: API_KEY_FIELDS
+    });
+  }
+  async insert(data, tx) {
+    const result = await this.create(data, tx);
+    if (!result.success) {
+      return err(
+        HaiIamError.REPOSITORY_ERROR,
+        iamM("iam_apikeyCreateFailed", { params: { message: result.error.message } }),
+        result.error
+      );
+    }
+    return ok(void 0);
+  }
+  async findOneById(id, tx) {
+    const result = await this.findById(id, tx);
+    if (!result.success) {
+      return this.buildQueryError(result.error);
+    }
+    return ok(result.data);
+  }
+  async findByKeyPrefix(prefix, tx) {
+    const result = await this.findAll({ where: "key_prefix = ?", params: [prefix] }, tx);
+    if (!result.success) {
+      return this.buildQueryError(result.error);
+    }
+    return ok(result.data);
+  }
+  async findByUserId(userId, tx) {
+    const result = await this.findAll({ where: "user_id = ?", params: [userId] }, tx);
+    if (!result.success) {
+      return this.buildQueryError(result.error);
+    }
+    return ok(result.data);
+  }
+  async countByUserId(userId, tx) {
+    const result = await this.count({ where: "user_id = ?", params: [userId] }, tx);
+    if (!result.success) {
+      return this.buildQueryError(result.error);
+    }
+    return ok(result.data);
+  }
+  async updateFields(id, data, tx) {
+    const result = await this.updateById(id, data, tx);
+    if (!result.success) {
+      return err(
+        HaiIamError.REPOSITORY_ERROR,
+        iamM("iam_apikeyUpdateFailed", { params: { message: result.error.message } }),
+        result.error
+      );
+    }
+    return ok(void 0);
+  }
+  async removeById(id, tx) {
+    const result = await this.deleteById(id, tx);
+    if (!result.success) {
+      return err(
+        HaiIamError.REPOSITORY_ERROR,
+        iamM("iam_apikeyDeleteFailed", { params: { message: result.error.message } }),
+        result.error
+      );
+    }
+    return ok(void 0);
+  }
+  buildQueryError(error) {
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      iamM("iam_apikeyQueryFailed", { params: { message: error.message } }),
+      error
+    );
+  }
+};
+var TABLE_NAME2 = "hai_iam_users";
+var USER_FIELDS = [
+  {
+    fieldName: "id",
+    columnName: "id",
+    def: { type: "TEXT", primaryKey: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "username",
+    columnName: "username",
+    def: { type: "TEXT", notNull: true, unique: true },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "email",
+    columnName: "email",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "phone",
+    columnName: "phone",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "displayName",
+    columnName: "display_name",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "avatarUrl",
+    columnName: "avatar_url",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "enabled",
+    columnName: "enabled",
+    def: { type: "BOOLEAN", notNull: true, defaultValue: 1 },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "emailVerified",
+    columnName: "email_verified",
+    def: { type: "BOOLEAN", defaultValue: 0 },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "phoneVerified",
+    columnName: "phone_verified",
+    def: { type: "BOOLEAN", defaultValue: 0 },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "passwordHash",
+    columnName: "password_hash",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "passwordUpdatedAt",
+    columnName: "password_updated_at",
+    def: { type: "TIMESTAMP" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "loginFailedCount",
+    columnName: "login_failed_count",
+    def: { type: "INTEGER", defaultValue: 0 },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "lastLoginFailedAt",
+    columnName: "last_login_failed_at",
+    def: { type: "TIMESTAMP" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "lockedUntil",
+    columnName: "locked_until",
+    def: { type: "TIMESTAMP" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "metadata",
+    columnName: "metadata",
+    def: { type: "JSON" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "createdAt",
+    columnName: "created_at",
+    def: { type: "TIMESTAMP", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "updatedAt",
+    columnName: "updated_at",
+    def: { type: "TIMESTAMP", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  }
+];
+var userRepoInstance = null;
+var userRepoDbConfig = null;
+function resetUserRepoSingleton() {
+  userRepoInstance = null;
+  userRepoDbConfig = null;
+}
+async function createDbUserRepository() {
+  if (userRepoInstance && userRepoDbConfig === reldb.config)
+    return userRepoInstance;
+  const repo = new DbUserRepository();
+  await repo.count();
+  userRepoInstance = repo;
+  userRepoDbConfig = reldb.config;
+  return repo;
+}
+var DbUserRepository = class extends BaseReldbCrudRepository {
+  constructor() {
+    super(reldb, {
+      table: TABLE_NAME2,
+      fields: USER_FIELDS
+    });
+  }
+  /** 根据用户名查找用户 */
+  async findByUsername(username, tx) {
+    return this.findOneBy("username = ?", [username], tx);
+  }
+  /** 根据邮箱查找用户 */
+  async findByEmail(email, tx) {
+    return this.findOneBy("email = ?", [email], tx);
+  }
+  /** 根据手机号查找用户 */
+  async findByPhone(phone, tx) {
+    return this.findOneBy("phone = ?", [phone], tx);
+  }
+  /** 根据标识符查找用户（同时匹配用户名、邮箱、手机号） */
+  async findByIdentifier(identifier, tx) {
+    return this.findOneBy("username = ? OR email = ? OR phone = ?", [identifier, identifier, identifier], tx);
+  }
+  /** 检查用户名是否已存在 */
+  async existsByUsername(username, tx) {
+    return this.existsBy("username = ?", [username], tx);
+  }
+  /** 检查邮箱是否已存在 */
+  async existsByEmail(email, tx) {
+    return this.existsBy("email = ?", [email], tx);
+  }
+  /**
+   * 构建查询错误响应
+   *
+   * @param error - 原始错误对象
+   * @param error.message - 错误消息
+   * @param cause - 错误原因
+   */
+  buildQueryError(error, cause) {
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      iamM("iam_queryUserFailed", { params: { message: error.message } }),
+      cause
+    );
+  }
+  /**
+   * 按条件检查是否存在
+   *
+   * @param where - SQL WHERE 条件
+   * @param params - 绑定参数
+   * @param tx - 可选事务句柄
+   */
+  async existsBy(where, params, tx) {
+    const result = await this.exists({ where, params }, tx);
+    if (!result.success) {
+      return this.buildQueryError(result.error, result.error);
+    }
+    return ok(result.data);
+  }
+  /**
+   * 按条件查找单条记录
+   *
+   * @param where - SQL WHERE 条件
+   * @param params - 绑定参数
+   * @param tx - 可选事务句柄
+   * @returns 单条用户记录，或 null
+   */
+  async findOneBy(where, params, tx) {
+    const result = await this.findAll({ where, params, limit: 1 }, tx);
+    if (!result.success) {
+      return this.buildQueryError(result.error, result.error);
+    }
+    return ok(result.data[0] ?? null);
+  }
+};
+
+// src/user/iam-user-utils.ts
+function toUser(storedUser) {
+  return {
+    id: storedUser.id,
+    username: storedUser.username,
+    email: storedUser.email,
+    phone: storedUser.phone,
+    displayName: storedUser.displayName,
+    avatarUrl: storedUser.avatarUrl,
+    enabled: storedUser.enabled,
+    emailVerified: storedUser.emailVerified,
+    phoneVerified: storedUser.phoneVerified,
+    createdAt: storedUser.createdAt,
+    updatedAt: storedUser.updatedAt,
+    metadata: storedUser.metadata
+  };
+}
+function ensureCredentialType(credentials, type) {
+  if (credentials.type !== type) {
+    return err(
+      HaiIamError.INVALID_CREDENTIALS,
+      iamM("iam_credentialTypeMismatch")
+    );
+  }
+  return ok(credentials);
+}
+function isAccountLocked(user) {
+  if (!user.lockedUntil) {
+    return false;
+  }
+  return /* @__PURE__ */ new Date() < user.lockedUntil;
+}
+async function recordLoginFailure(userRepository, user, policy) {
+  const failedCount = (user.loginFailedCount || 0) + 1;
+  const updateData = {
+    loginFailedCount: failedCount,
+    lastLoginFailedAt: /* @__PURE__ */ new Date()
+  };
+  if (failedCount >= policy.maxLoginAttempts) {
+    updateData.lockedUntil = new Date(Date.now() + policy.lockoutDuration * 1e3);
+  }
+  await userRepository.updateById(user.id, updateData);
+}
+async function resetLoginFailures(userRepository, user) {
+  if (user.loginFailedCount && user.loginFailedCount > 0) {
+    await userRepository.updateById(user.id, {
+      loginFailedCount: 0,
+      lastLoginFailedAt: void 0,
+      lockedUntil: void 0
+    });
+  }
+}
+
+// src/authn/apikey/iam-authn-apikey-strategy.ts
+var logger = core.logger.child({ module: "iam", scope: "apikey-strategy" });
+var KEY_PREFIX_LENGTH = 12;
+function generateRawKey(prefix) {
+  const hex = randomBytes(32).toString("hex");
+  return `${prefix}${hex}`;
+}
+function extractKeyPrefix(rawKey) {
+  return rawKey.slice(0, KEY_PREFIX_LENGTH);
+}
+function toApiKey(stored) {
+  return {
+    id: stored.id,
+    userId: stored.userId,
+    name: stored.name,
+    keyPrefix: stored.keyPrefix,
+    enabled: stored.enabled,
+    expiresAt: stored.expiresAt,
+    createdAt: stored.createdAt,
+    lastUsedAt: stored.lastUsedAt,
+    scopes: stored.scopes
+  };
+}
+function createApiKeyStrategy(config) {
+  const apikeyConfig = config.apikeyConfig ? ApiKeyConfigSchema.parse(config.apikeyConfig) : ApiKeyConfigSchema.parse({});
+  const { userRepository, apiKeyRepository } = config;
+  const passwordOps = crypto$1.password;
+  async function verifyRawKey(rawKey) {
+    const prefix = extractKeyPrefix(rawKey);
+    const candidatesResult = await apiKeyRepository.findByKeyPrefix(prefix);
+    if (!candidatesResult.success) {
+      return candidatesResult;
+    }
+    for (const candidate of candidatesResult.data) {
+      const verifyResult = passwordOps.verify(rawKey, candidate.keyHash);
+      if (!verifyResult.success)
+        continue;
+      if (!verifyResult.data)
+        continue;
+      if (!candidate.enabled) {
+        return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
+      }
+      if (candidate.expiresAt && /* @__PURE__ */ new Date() > candidate.expiresAt) {
+        return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
+      }
+      apiKeyRepository.updateFields(candidate.id, { lastUsedAt: /* @__PURE__ */ new Date() }).catch(() => {
+        logger.warn("Failed to update API Key lastUsedAt", { keyId: candidate.id });
+      });
+      return ok(toApiKey(candidate));
+    }
+    return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
+  }
+  const strategy = {
+    type: "apikey",
+    name: "apikey-strategy",
+    async authenticate(credentials) {
+      const credentialResult = ensureCredentialType(credentials, "apikey");
+      if (!credentialResult.success) {
+        return credentialResult;
+      }
+      const { key } = credentialResult.data;
+      const verifyResult = await verifyRawKey(key);
+      if (!verifyResult.success) {
+        return verifyResult;
+      }
+      const apiKey = verifyResult.data;
+      const userResult = await userRepository.findById(apiKey.userId);
+      if (!userResult.success) {
+        return err(HaiIamError.REPOSITORY_ERROR, userResult.error.message, userResult.error);
+      }
+      if (!userResult.data) {
+        return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
+      }
+      if (!userResult.data.enabled) {
+        return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+      }
+      logger.info("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
+      return ok(toUser(userResult.data));
+    }
+  };
+  const apiKeyFunctions = {
+    async createApiKey(userId, options) {
+      try {
+        const countResult = await apiKeyRepository.countByUserId(userId);
+        if (!countResult.success)
+          return countResult;
+        if (countResult.data >= apikeyConfig.maxKeysPerUser) {
+          return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_apikeyMaxKeysReached", { params: { max: apikeyConfig.maxKeysPerUser } }));
+        }
+        const rawKey = generateRawKey(apikeyConfig.prefix);
+        const hashResult = passwordOps.hash(rawKey);
+        if (!hashResult.success) {
+          return err(HaiIamError.INTERNAL_ERROR, hashResult.error.message);
+        }
+        const expirationDays = options.expirationDays ?? apikeyConfig.defaultExpirationDays;
+        const expiresAt = expirationDays > 0 ? new Date(Date.now() + expirationDays * 864e5) : null;
+        const id = core.id.generate();
+        const now = /* @__PURE__ */ new Date();
+        const storedApiKey = {
+          id,
+          userId,
+          name: options.name,
+          keyHash: hashResult.data,
+          keyPrefix: extractKeyPrefix(rawKey),
+          enabled: true,
+          expiresAt,
+          createdAt: now,
+          lastUsedAt: null,
+          scopes: options.scopes ?? []
+        };
+        const insertResult = await apiKeyRepository.insert(storedApiKey);
+        if (!insertResult.success)
+          return insertResult;
+        logger.info("API Key created", { userId, keyId: id, name: options.name });
+        return ok({ apiKey: toApiKey(storedApiKey), rawKey });
+      } catch (error) {
+        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_apikeyCreateFailed", { params: { message: String(error) } }), error);
+      }
+    },
+    async listApiKeys(userId) {
+      const result = await apiKeyRepository.findByUserId(userId);
+      if (!result.success)
+        return result;
+      return ok(result.data.map(toApiKey));
+    },
+    async getApiKey(keyId) {
+      const result = await apiKeyRepository.findOneById(keyId);
+      if (!result.success)
+        return result;
+      return ok(result.data ? toApiKey(result.data) : null);
+    },
+    async revokeApiKey(keyId) {
+      const result = await apiKeyRepository.removeById(keyId);
+      if (!result.success)
+        return result;
+      logger.info("API Key revoked", { keyId });
+      return ok(void 0);
+    },
+    async verifyApiKey(rawKey) {
+      return verifyRawKey(rawKey);
+    }
+  };
+  return { strategy, apiKeyFunctions };
+}
+var logger2 = core.logger.child({ module: "iam", scope: "ldap-strategy" });
+function escapeLdapFilterValue(value) {
+  return value.replace(/[\\*()/\0]/g, (ch) => {
+    const hex = ch.charCodeAt(0).toString(16).padStart(2, "0");
+    return `\\${hex}`;
+  });
+}
+function createLdapStrategy(config) {
+  const {
+    ldapConfig,
+    userRepository,
+    ldapClientFactory,
+    syncUser = true,
+    maxLoginAttempts = 5,
+    lockoutDuration = 900
+  } = config;
+  function getAttributeValue(entry, attr) {
+    const value = entry.attributes[attr];
+    if (Array.isArray(value)) {
+      return value[0];
+    }
+    return value;
+  }
+  function buildLdapUser(entry, ldapUsername, ldapEmail, ldapDisplayName) {
+    const now = /* @__PURE__ */ new Date();
+    return {
+      id: entry.dn,
+      username: ldapUsername,
+      email: ldapEmail,
+      displayName: ldapDisplayName,
+      enabled: true,
+      createdAt: now,
+      updatedAt: now,
+      metadata: {
+        ldapDn: entry.dn,
+        authSource: "ldap"
+      }
+    };
+  }
+  return {
+    type: "ldap",
+    name: "ldap-strategy",
+    async authenticate(credentials) {
+      const credentialResult = ensureCredentialType(credentials, "ldap");
+      if (!credentialResult.success) {
+        return credentialResult;
+      }
+      const { username, password } = credentialResult.data;
+      const clientResult = await ldapClientFactory(ldapConfig);
+      if (!clientResult.success) {
+        return err(
+          HaiIamError.LDAP_CONNECTION_FAILED,
+          iamM("iam_ldapConnectionFailed"),
+          clientResult.error
+        );
+      }
+      const client = clientResult.data;
+      try {
+        const adminBindResult = await client.bind(ldapConfig.bindDn, ldapConfig.bindPassword);
+        if (!adminBindResult.success) {
+          return err(
+            HaiIamError.LDAP_BIND_FAILED,
+            iamM("iam_ldapAdminBindFailed"),
+            adminBindResult.error
+          );
+        }
+        const searchFilter = ldapConfig.searchFilter.replace("{{username}}", escapeLdapFilterValue(username));
+        const searchResult = await client.search(
+          ldapConfig.searchBase,
+          searchFilter,
+          [ldapConfig.usernameAttribute, ldapConfig.emailAttribute, ldapConfig.displayNameAttribute]
+        );
+        if (!searchResult.success) {
+          return err(
+            HaiIamError.LDAP_SEARCH_FAILED,
+            iamM("iam_ldapSearchFailed"),
+            searchResult.error
+          );
+        }
+        const entries = searchResult.data;
+        if (entries.length === 0) {
+          return err(
+            HaiIamError.USER_NOT_FOUND,
+            iamM("iam_userNotExist")
+          );
+        }
+        const entry = entries[0];
+        const ldapUsername = getAttributeValue(entry, ldapConfig.usernameAttribute) || username;
+        const ldapEmail = getAttributeValue(entry, ldapConfig.emailAttribute);
+        const ldapDisplayName = getAttributeValue(entry, ldapConfig.displayNameAttribute);
+        const localUserResult = await userRepository.findByUsername(ldapUsername);
+        if (!localUserResult.success) {
+          return localUserResult;
+        }
+        let storedUser = localUserResult.data;
+        if (storedUser) {
+          if (!storedUser.enabled) {
+            return err(
+              HaiIamError.USER_DISABLED,
+              iamM("iam_accountDisabled")
+            );
+          }
+          if (isAccountLocked(storedUser)) {
+            return err(
+              HaiIamError.USER_LOCKED,
+              iamM("iam_accountLocked")
+            );
+          }
+        }
+        const userBindResult = await client.bind(entry.dn, password);
+        if (!userBindResult.success) {
+          if (storedUser) {
+            await recordLoginFailure(userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+          }
+          logger2.warn("LDAP authentication failed", { username });
+          return err(
+            HaiIamError.INVALID_CREDENTIALS,
+            iamM("iam_passwordWrong")
+          );
+        }
+        if (!storedUser && syncUser) {
+          const createResult = await userRepository.create({
+            username: ldapUsername,
+            email: ldapEmail,
+            displayName: ldapDisplayName,
+            enabled: true,
+            emailVerified: !!ldapEmail,
+            metadata: {
+              ldapDn: entry.dn,
+              authSource: "ldap"
+            }
+          });
+          if (!createResult.success) {
+            return err(
+              HaiIamError.REPOSITORY_ERROR,
+              iamM("iam_createUserFailed", { params: { message: createResult.error.message } }),
+              createResult.error
+            );
+          }
+          const createdResult = await userRepository.findByUsername(ldapUsername);
+          if (!createdResult.success) {
+            return createdResult;
+          }
+          storedUser = createdResult.data;
+          if (storedUser && config.onUserAutoRegistered) {
+            try {
+              await config.onUserAutoRegistered(storedUser.id);
+            } catch (callbackError) {
+              logger2.warn("onUserAutoRegistered callback failed", { userId: storedUser?.id, error: callbackError });
+            }
+          }
+        } else if (storedUser && syncUser) {
+          const updateResult = await userRepository.updateById(storedUser.id, {
+            email: ldapEmail || storedUser.email,
+            displayName: ldapDisplayName || storedUser.displayName,
+            metadata: {
+              ...storedUser.metadata,
+              ldapDn: entry.dn,
+              authSource: "ldap"
+            }
+          });
+          if (updateResult.success) {
+            const refreshed = await userRepository.findByUsername(ldapUsername);
+            if (refreshed.success) {
+              storedUser = refreshed.data ?? storedUser;
+            }
+          }
+        }
+        if (!storedUser) {
+          const ldapUser = buildLdapUser(entry, ldapUsername, ldapEmail, ldapDisplayName);
+          return ok(ldapUser);
+        }
+        await resetLoginFailures(userRepository, storedUser);
+        logger2.info("LDAP authentication succeeded", { userId: storedUser.id });
+        return ok(toUser(storedUser));
+      } finally {
+        await client.unbind();
+      }
+    }
+  };
+}
+var OTP_KEY_PREFIX = "hai:iam:otp:";
+function buildOtpKey(identifier) {
+  return `${OTP_KEY_PREFIX}${identifier}`;
+}
+function restoreOtpDates(record) {
+  return {
+    ...record,
+    expiresAt: record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt),
+    createdAt: record.createdAt instanceof Date ? record.createdAt : new Date(record.createdAt)
+  };
+}
+var otpRepoInstance = null;
+function resetOtpRepoSingleton() {
+  otpRepoInstance = null;
+}
+function createCacheOtpRepository() {
+  if (otpRepoInstance)
+    return otpRepoInstance;
+  const repo = {
+    async saveOtp(identifier, code, expiresIn) {
+      const now = Date.now();
+      const record = {
+        identifier,
+        code,
+        expiresAt: new Date(now + expiresIn * 1e3),
+        attempts: 0,
+        createdAt: new Date(now)
+      };
+      const result = await cache.kv.set(buildOtpKey(identifier), record, { ex: expiresIn });
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_saveOtpFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    },
+    async fetchOtp(identifier) {
+      const result = await cache.kv.get(buildOtpKey(identifier));
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryOtpFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      if (!result.data) {
+        return ok(null);
+      }
+      return ok(restoreOtpDates(result.data));
+    },
+    async incrementOtpAttempts(identifier) {
+      const otpKey = buildOtpKey(identifier);
+      const current = await cache.kv.get(otpKey);
+      if (!current.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryOtpFailed", { params: { message: current.error.message } }),
+          current.error
+        );
+      }
+      if (!current.data) {
+        return ok(0);
+      }
+      const record = restoreOtpDates(current.data);
+      const nextAttempts = record.attempts + 1;
+      const ttlResult = await cache.kv.ttl(otpKey);
+      const ttl = ttlResult.success && ttlResult.data > 0 ? ttlResult.data : 1;
+      const updateResult = await cache.kv.set(otpKey, { ...record, attempts: nextAttempts }, { ex: ttl });
+      if (!updateResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_updateOtpAttemptsFailed", { params: { message: updateResult.error.message } }),
+          updateResult.error
+        );
+      }
+      return ok(nextAttempts);
+    },
+    async removeOtp(identifier) {
+      const result = await cache.kv.del(buildOtpKey(identifier));
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_deleteOtpFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    }
+  };
+  otpRepoInstance = repo;
+  return repo;
+}
+var logger3 = core.logger.child({ module: "iam", scope: "otp-strategy" });
+function generateOtpCode(length) {
+  let code = "";
+  const threshold = 250;
+  while (code.length < length) {
+    const randomValues = new Uint8Array(length - code.length);
+    crypto.getRandomValues(randomValues);
+    for (const byte of randomValues) {
+      if (byte < threshold && code.length < length) {
+        code += String(byte % 10);
+      }
+    }
+  }
+  return code;
+}
+function identifierType(identifier) {
+  if (identifier.includes("@")) {
+    return "email";
+  }
+  if (/^\+?\d{8,}$/.test(identifier.replace(/[\s-]/g, ""))) {
+    return "phone";
+  }
+  return "unknown";
+}
+function createOtpStrategy(config) {
+  const otpConfig = config.otpConfig ? OtpConfigSchema.parse(config.otpConfig) : OtpConfigSchema.parse({});
+  const maxLoginAttempts = config.maxLoginAttempts ?? 5;
+  const lockoutDuration = config.lockoutDuration ?? 900;
+  const registerConfig = config.registerConfig;
+  const allowAutoRegister = registerConfig?.enabled ?? config.autoRegister ?? false;
+  const defaultEnabled = registerConfig?.defaultEnabled ?? true;
+  function buildChallengeResult(expiresAt) {
+    return { expiresAt };
+  }
+  const strategy = {
+    type: "otp",
+    name: "otp-strategy",
+    async authenticate(credentials) {
+      const credentialResult = ensureCredentialType(credentials, "otp");
+      if (!credentialResult.success) {
+        return credentialResult;
+      }
+      const { identifier, code } = credentialResult.data;
+      const userResult = await config.userRepository.findByIdentifier(identifier);
+      if (!userResult.success) {
+        return userResult;
+      }
+      let storedUser = userResult.data;
+      if (storedUser) {
+        if (!storedUser.enabled) {
+          return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+        }
+        if (isAccountLocked(storedUser)) {
+          return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
+        }
+      }
+      const storedOtpResult = await config.otpRepository.fetchOtp(identifier);
+      if (!storedOtpResult.success) {
+        return storedOtpResult;
+      }
+      const storedOtp = storedOtpResult.data;
+      if (!storedOtp) {
+        return err(HaiIamError.OTP_INVALID, iamM("iam_otpNotExistOrExpired"));
+      }
+      if (storedOtp.attempts >= otpConfig.maxAttempts) {
+        await config.otpRepository.removeOtp(identifier);
+        if (storedUser) {
+          await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+        }
+        return err(HaiIamError.OTP_INVALID, iamM("iam_otpInvalid"));
+      }
+      if (!core.string.constantTimeEqual(storedOtp.code, code)) {
+        await config.otpRepository.incrementOtpAttempts(identifier);
+        if (storedUser) {
+          await recordLoginFailure(config.userRepository, storedUser, { maxLoginAttempts, lockoutDuration });
+        }
+        return err(HaiIamError.OTP_INVALID, iamM("iam_otpWrong"));
+      }
+      await config.otpRepository.removeOtp(identifier);
+      if (!storedUser && allowAutoRegister) {
+        const type = identifierType(identifier);
+        const createResult = await config.userRepository.create({
+          username: identifier,
+          email: type === "email" ? identifier : void 0,
+          phone: type === "phone" ? identifier : void 0,
+          enabled: defaultEnabled,
+          emailVerified: type === "email",
+          phoneVerified: type === "phone"
+        });
+        if (!createResult.success) {
+          return err(
+            HaiIamError.REPOSITORY_ERROR,
+            iamM("iam_createUserFailed", { params: { message: createResult.error.message } }),
+            createResult.error
+          );
+        }
+        const createdResult = await config.userRepository.findByIdentifier(identifier);
+        if (!createdResult.success) {
+          return createdResult;
+        }
+        storedUser = createdResult.data;
+        if (storedUser && config.onUserAutoRegistered) {
+          try {
+            await config.onUserAutoRegistered(storedUser.id);
+          } catch (callbackError) {
+            logger3.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
+          }
+        }
+      }
+      if (!storedUser) {
+        return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
+      }
+      await resetLoginFailures(config.userRepository, storedUser);
+      logger3.info("OTP authentication succeeded", { userId: storedUser.id });
+      return ok(toUser(storedUser));
+    }
+  };
+  async function challenge(identifier) {
+    const existingResult = await config.otpRepository.fetchOtp(identifier);
+    if (existingResult.success && existingResult.data) {
+      const elapsedSeconds = Math.floor((Date.now() - existingResult.data.createdAt.getTime()) / 1e3);
+      if (elapsedSeconds < otpConfig.resendInterval) {
+        return err(
+          HaiIamError.OTP_RESEND_TOO_FAST,
+          iamM("iam_otpResendTooFast", { params: { seconds: otpConfig.resendInterval - elapsedSeconds } })
+        );
+      }
+    }
+    const code = generateOtpCode(otpConfig.length);
+    const expiresAt = new Date(Date.now() + otpConfig.expiresIn * 1e3);
+    const storeResult = await config.otpRepository.saveOtp(identifier, code, otpConfig.expiresIn);
+    if (!storeResult.success) {
+      return storeResult;
+    }
+    const type = identifierType(identifier);
+    if (type === "email" && config.onOtpSendEmail) {
+      try {
+        await config.onOtpSendEmail(identifier, code);
+      } catch (error) {
+        return err(
+          HaiIamError.INTERNAL_ERROR,
+          iamM("iam_otpSendFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+    } else if (type === "phone" && config.onOtpSendSms) {
+      try {
+        await config.onOtpSendSms(identifier, code);
+      } catch (error) {
+        return err(
+          HaiIamError.INTERNAL_ERROR,
+          iamM("iam_otpSendFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+    } else {
+      return err(
+        HaiIamError.INTERNAL_ERROR,
+        iamM("iam_identifierTypeNotSupported")
+      );
+    }
+    const result = buildChallengeResult(expiresAt);
+    logger3.debug("OTP challenge sent", { identifier, expiresAt });
+    return ok(result);
+  }
+  return { strategy, challenge };
+}
+var logger4 = core.logger.child({ module: "iam", scope: "password-strategy" });
+function createPasswordStrategy(config) {
+  const passwordConfig = config.passwordConfig ? PasswordConfigSchema.parse(config.passwordConfig) : PasswordConfigSchema.parse({});
+  const maxLoginAttempts = config.maxLoginAttempts ?? 5;
+  const lockoutDuration = config.lockoutDuration ?? 900;
+  const passwordOps = crypto$1.password;
+  function mapPasswordError(message) {
+    return err(
+      HaiIamError.INTERNAL_ERROR,
+      message
+    );
+  }
+  function validatePasswordStrength(password) {
+    if (password.length < passwordConfig.minLength) {
+      return err(
+        HaiIamError.PASSWORD_POLICY_VIOLATION,
+        iamM("iam_passwordMinLength", { params: { minLength: passwordConfig.minLength } })
+      );
+    }
+    if (password.length > passwordConfig.maxLength) {
+      return err(
+        HaiIamError.PASSWORD_POLICY_VIOLATION,
+        iamM("iam_passwordMaxLength", { params: { maxLength: passwordConfig.maxLength } })
+      );
+    }
+    if (passwordConfig.requireUppercase && !/[A-Z]/.test(password)) {
+      return err(
+        HaiIamError.PASSWORD_POLICY_VIOLATION,
+        iamM("iam_passwordNeedUppercase")
+      );
+    }
+    if (passwordConfig.requireLowercase && !/[a-z]/.test(password)) {
+      return err(
+        HaiIamError.PASSWORD_POLICY_VIOLATION,
+        iamM("iam_passwordNeedLowercase")
+      );
+    }
+    if (passwordConfig.requireNumber && !/\d/.test(password)) {
+      return err(
+        HaiIamError.PASSWORD_POLICY_VIOLATION,
+        iamM("iam_passwordNeedNumber")
+      );
+    }
+    if (passwordConfig.requireSpecialChar && !/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(password)) {
+      return err(
+        HaiIamError.PASSWORD_POLICY_VIOLATION,
+        iamM("iam_passwordNeedSpecialChar")
+      );
+    }
+    return ok(void 0);
+  }
+  function isPasswordExpired(user) {
+    if (passwordConfig.expirationDays <= 0 || !user.passwordUpdatedAt) {
+      return false;
+    }
+    const expirationDate = new Date(user.passwordUpdatedAt);
+    expirationDate.setDate(expirationDate.getDate() + passwordConfig.expirationDays);
+    return /* @__PURE__ */ new Date() > expirationDate;
+  }
+  function checkAccountStatus(user) {
+    if (!user.enabled) {
+      return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
+    }
+    if (isAccountLocked(user)) {
+      return err(HaiIamError.USER_LOCKED, iamM("iam_accountLocked"));
+    }
+    return ok(void 0);
+  }
+  async function verifyUserPassword(user, password) {
+    if (!user.passwordHash) {
+      return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_accountNoPassword"));
+    }
+    const verifyResult = passwordOps.verify(password, user.passwordHash);
+    if (!verifyResult.success) {
+      return mapPasswordError(verifyResult.error.message);
+    }
+    if (!verifyResult.data) {
+      await recordLoginFailure(config.userRepository, user, { maxLoginAttempts, lockoutDuration });
+      logger4.warn("Password verification failed", { userId: user.id });
+      return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
+    }
+    return ok(void 0);
+  }
+  const strategy = {
+    type: "password",
+    name: "password-strategy",
+    async authenticate(credentials) {
+      const credentialResult = ensureCredentialType(credentials, "password");
+      if (!credentialResult.success) {
+        return credentialResult;
+      }
+      const { identifier, password } = credentialResult.data;
+      const userResult = await config.userRepository.findByIdentifier(identifier);
+      if (!userResult.success)
+        return userResult;
+      const storedUser = userResult.data;
+      if (!storedUser) {
+        await passwordOps.hash("dummy-password-to-prevent-timing-leak");
+        return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
+      }
+      const statusResult = checkAccountStatus(storedUser);
+      if (!statusResult.success)
+        return statusResult;
+      const pwResult = await verifyUserPassword(storedUser, password);
+      if (!pwResult.success)
+        return pwResult;
+      if (isPasswordExpired(storedUser)) {
+        return err(HaiIamError.PASSWORD_EXPIRED, iamM("iam_passwordExpired"));
+      }
+      await resetLoginFailures(config.userRepository, storedUser);
+      logger4.info("Password authentication succeeded", { userId: storedUser.id });
+      return ok(toUser(storedUser));
+    }
+  };
+  function hashPassword(password) {
+    const hashResult = passwordOps.hash(password);
+    if (!hashResult.success) {
+      return mapPasswordError(hashResult.error.message);
+    }
+    return ok(hashResult.data);
+  }
+  return {
+    strategy,
+    validatePassword: validatePasswordStrength,
+    hashPassword,
+    passwordConfig
+  };
+}
+
+// src/authn/iam-authn-functions.ts
+var logger5 = core.logger.child({ module: "iam", scope: "authn" });
+async function createAuthnOperations(deps) {
+  try {
+    const { config, sessionFunctions, authzFunctions, ldapClientFactory, ldapSyncUser, onOtpSendEmail, onOtpSendSms } = deps;
+    const userRepository = await createDbUserRepository();
+    const securityConfig = SecurityConfigSchema.parse(config.security ?? {});
+    const loginConfig = LoginConfigSchema.parse(config.login ?? {});
+    async function onUserAutoRegistered(userId) {
+      if (!config.rbac?.defaultRole)
+        return;
+      const roleResult = await authzFunctions.getRoleByCode(config.rbac.defaultRole);
+      if (roleResult.success && roleResult.data) {
+        await authzFunctions.assignRole(userId, roleResult.data.id);
+      }
+    }
+    const passwordResult = createPasswordStrategy({
+      passwordConfig: config.password,
+      userRepository,
+      maxLoginAttempts: securityConfig.maxLoginAttempts,
+      lockoutDuration: securityConfig.lockoutDuration
+    });
+    let otpResult;
+    const otpConfig = config.otp ? OtpConfigSchema.parse(config.otp) : void 0;
+    if (loginConfig.otp && otpConfig) {
+      const otpRepository = createCacheOtpRepository();
+      otpResult = createOtpStrategy({
+        otpConfig,
+        userRepository,
+        otpRepository,
+        autoRegister: true,
+        registerConfig: config.register,
+        maxLoginAttempts: securityConfig.maxLoginAttempts,
+        lockoutDuration: securityConfig.lockoutDuration,
+        onUserAutoRegistered,
+        onOtpSendEmail,
+        onOtpSendSms
+      });
+    }
+    let ldapStrategy;
+    if (loginConfig.ldap && config.ldap && ldapClientFactory) {
+      ldapStrategy = createLdapStrategy({
+        ldapConfig: config.ldap,
+        userRepository,
+        ldapClientFactory,
+        syncUser: ldapSyncUser ?? true,
+        maxLoginAttempts: securityConfig.maxLoginAttempts,
+        lockoutDuration: securityConfig.lockoutDuration,
+        onUserAutoRegistered
+      });
+    }
+    let apiKeyStrategy;
+    let apiKeyFunctions = null;
+    if (loginConfig.apikey) {
+      const apiKeyConfig = config.apikey ? ApiKeyConfigSchema.parse(config.apikey) : void 0;
+      const apiKeyRepository = await createDbApiKeyRepository();
+      const apiKeyResult = createApiKeyStrategy({
+        apikeyConfig: apiKeyConfig,
+        userRepository,
+        apiKeyRepository
+      });
+      apiKeyStrategy = apiKeyResult.strategy;
+      apiKeyFunctions = apiKeyResult.apiKeyFunctions;
+    }
+    const operations = buildAuthnOperations({
+      passwordStrategy: passwordResult.strategy,
+      otpStrategy: otpResult?.strategy,
+      otpChallenge: otpResult?.challenge,
+      ldapStrategy,
+      apiKeyStrategy,
+      sessionFunctions,
+      authzFunctions,
+      config
+    });
+    logger5.info("Authn sub-feature initialized");
+    return ok({ authn: operations, passwordStrategyResult: passwordResult, apiKeyFunctions });
+  } catch (error) {
+    logger5.error("Authn sub-feature initialization failed", { error });
+    return err(
+      HaiIamError.CONFIG_ERROR,
+      iamM("iam_initComponentFailed"),
+      error
+    );
+  }
+}
+function buildAuthnOperations(deps) {
+  const {
+    passwordStrategy,
+    otpStrategy,
+    otpChallenge,
+    ldapStrategy,
+    apiKeyStrategy,
+    sessionFunctions,
+    authzFunctions,
+    config
+  } = deps;
+  const loginConfig = LoginConfigSchema.parse(config.login ?? {});
+  const agreementConfig = AgreementConfigSchema.parse(config.agreements ?? {});
+  function buildAgreementDisplay() {
+    if (!agreementConfig.showOnLogin) {
+      return void 0;
+    }
+    if (!agreementConfig.userAgreementUrl && !agreementConfig.privacyPolicyUrl) {
+      return void 0;
+    }
+    return {
+      userAgreementUrl: agreementConfig.userAgreementUrl,
+      privacyPolicyUrl: agreementConfig.privacyPolicyUrl,
+      showOnRegister: agreementConfig.showOnRegister,
+      showOnLogin: agreementConfig.showOnLogin
+    };
+  }
+  function loginDisabled(type) {
+    if (!loginConfig[type]) {
+      return err(
+        HaiIamError.LOGIN_DISABLED,
+        iamM("iam_loginDisabled", { params: { type } })
+      );
+    }
+    return null;
+  }
+  async function resolveUserRoleCodes(userId) {
+    const rolesResult = await authzFunctions.getUserRoles(userId);
+    if (!rolesResult.success) {
+      return rolesResult;
+    }
+    return ok(rolesResult.data.map((role) => role.code));
+  }
+  async function resolveUserPermissionCodes(userId) {
+    const permissionsResult = await authzFunctions.getUserPermissions(userId);
+    if (!permissionsResult.success) {
+      return permissionsResult;
+    }
+    return ok(permissionsResult.data.map((p) => p.code));
+  }
+  function resolveStrategy(type, strategy) {
+    if (strategy) {
+      return ok(strategy);
+    }
+    if (type === "otp") {
+      return err(
+        HaiIamError.STRATEGY_NOT_SUPPORTED,
+        iamM("iam_otpStrategyRequired")
+      );
+    }
+    if (type === "ldap") {
+      return err(
+        HaiIamError.STRATEGY_NOT_SUPPORTED,
+        iamM("iam_ldapStrategyRequired")
+      );
+    }
+    return err(
+      HaiIamError.STRATEGY_NOT_SUPPORTED,
+      iamM("iam_featureNotImplemented")
+    );
+  }
+  async function buildAuthResult(user) {
+    const [roleCodesResult, permCodesResult] = await Promise.all([
+      resolveUserRoleCodes(user.id),
+      resolveUserPermissionCodes(user.id)
+    ]);
+    if (!roleCodesResult.success) {
+      return roleCodesResult;
+    }
+    if (!permCodesResult.success) {
+      return permCodesResult;
+    }
+    const sessionResult = await sessionFunctions.create({
+      userId: user.id,
+      username: user.username,
+      displayName: user.displayName,
+      avatarUrl: user.avatarUrl,
+      roles: roleCodesResult.data,
+      permissions: permCodesResult.data
+    });
+    if (!sessionResult.success) {
+      return sessionResult;
+    }
+    const session = sessionResult.data;
+    const tokenPair = session.data?._tokenPair;
+    if (!tokenPair) {
+      return err(HaiIamError.SESSION_CREATE_FAILED, iamM("iam_createSessionFailed"));
+    }
+    return ok({
+      user,
+      tokens: tokenPair,
+      roles: roleCodesResult.data,
+      permissions: permCodesResult.data,
+      agreements: buildAgreementDisplay()
+    });
+  }
+  async function loginWithStrategy(type, credentials, strategy) {
+    const disabled = loginDisabled(type);
+    if (disabled)
+      return disabled;
+    const strategyResult = resolveStrategy(type, strategy);
+    if (!strategyResult.success)
+      return strategyResult;
+    const authResult = await strategyResult.data.authenticate({
+      type,
+      ...credentials
+    });
+    if (!authResult.success) {
+      logger5.warn("Login failed", { type, reason: authResult.error.code });
+      return authResult;
+    }
+    const result = await buildAuthResult(authResult.data);
+    if (result.success) {
+      logger5.info("Login succeeded", { type, userId: authResult.data.id });
+    }
+    return result;
+  }
+  return {
+    async login(credentials) {
+      return loginWithStrategy("password", credentials, passwordStrategy);
+    },
+    async loginWithOtp(credentials) {
+      return loginWithStrategy("otp", credentials, otpStrategy);
+    },
+    async loginWithLdap(credentials) {
+      return loginWithStrategy("ldap", credentials, ldapStrategy);
+    },
+    async loginWithApiKey(credentials) {
+      return loginWithStrategy("apikey", credentials, apiKeyStrategy);
+    },
+    async logout(accessToken) {
+      const sessionResult = await sessionFunctions.get(accessToken);
+      if (sessionResult.success && sessionResult.data) {
+        const tokenPair = sessionResult.data.data?._tokenPair;
+        if (tokenPair?.refreshToken) {
+          await sessionFunctions.revokeRefresh(tokenPair.refreshToken);
+        }
+        await sessionFunctions.delete(sessionResult.data.accessToken);
+        logger5.info("User logged out", { userId: sessionResult.data.userId });
+      }
+      return ok(void 0);
+    },
+    async verifyToken(accessToken) {
+      return sessionFunctions.verifyToken(accessToken);
+    },
+    async sendOtp(identifier) {
+      const disabled = loginDisabled("otp");
+      if (disabled) {
+        return disabled;
+      }
+      if (!otpChallenge) {
+        return err(
+          HaiIamError.STRATEGY_NOT_SUPPORTED,
+          iamM("iam_otpStrategyRequiredForSend")
+        );
+      }
+      return otpChallenge(identifier);
+    }
+  };
+}
+var TABLE_NAME3 = "hai_iam_permissions";
+var PERMISSION_FIELDS = [
+  {
+    fieldName: "id",
+    columnName: "id",
+    def: { type: "TEXT", primaryKey: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "code",
+    columnName: "code",
+    def: { type: "TEXT", notNull: true, unique: true },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "name",
+    columnName: "name",
+    def: { type: "TEXT", notNull: true },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "description",
+    columnName: "description",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "resource",
+    columnName: "resource",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "action",
+    columnName: "action",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "type",
+    columnName: "type",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "createdAt",
+    columnName: "created_at",
+    def: { type: "TIMESTAMP", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "updatedAt",
+    columnName: "updated_at",
+    def: { type: "TIMESTAMP", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  }
+];
+var permRepoInstance = null;
+var permRepoDbConfig = null;
+function resetPermissionRepoSingleton() {
+  permRepoInstance = null;
+  permRepoDbConfig = null;
+}
+async function createDbPermissionRepository() {
+  if (permRepoInstance && permRepoDbConfig === reldb.config)
+    return permRepoInstance;
+  const repo = new DbPermissionRepository();
+  await repo.count();
+  permRepoInstance = repo;
+  permRepoDbConfig = reldb.config;
+  return repo;
+}
+var DbPermissionRepository = class extends BaseReldbCrudRepository {
+  constructor() {
+    super(reldb, {
+      table: TABLE_NAME3,
+      fields: PERMISSION_FIELDS
+    });
+  }
+  /** 根据权限代码查找权限 */
+  async findByCode(code, tx) {
+    return this.findOneBy("code = ?", [code], tx);
+  }
+  buildQueryError(error, cause) {
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      iamM("iam_queryPermissionFailed", { params: { message: error.message } }),
+      cause
+    );
+  }
+  async findOneBy(where, params, tx) {
+    const result = await this.findAll({ where, params, limit: 1 }, tx);
+    if (!result.success) {
+      return this.buildQueryError(result.error, result.error);
+    }
+    return ok(result.data[0] ?? null);
+  }
+};
+var ROLE_PERMISSION_TABLE = "hai_iam_role_permissions";
+var PERMISSION_TABLE = "hai_iam_permissions";
+var ROLE_PERMISSION_SCHEMA = {
+  role_id: { type: "TEXT", notNull: true },
+  permission_id: { type: "TEXT", notNull: true }
+};
+async function createDbRolePermissionRepository() {
+  async function ensureTable() {
+    const result = await reldb.ddl.createTable(ROLE_PERMISSION_TABLE, ROLE_PERMISSION_SCHEMA, true);
+    if (!result.success) {
+      return err(
+        HaiIamError.REPOSITORY_ERROR,
+        iamM("iam_createRolePermissionTableFailed", { params: { message: result.error.message } }),
+        result.error
+      );
+    }
+    const indexResults = await Promise.all([
+      reldb.ddl.createIndex(ROLE_PERMISSION_TABLE, "idx_role_perm_role_perm", { columns: ["role_id", "permission_id"], unique: true }),
+      reldb.ddl.createIndex(ROLE_PERMISSION_TABLE, "idx_role_perm_role", { columns: ["role_id"] })
+    ]);
+    for (const indexResult of indexResults) {
+      if (!indexResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_createRolePermissionIndexFailed", { params: { message: indexResult.error.message } }),
+          indexResult.error
+        );
+      }
+    }
+    return ok(void 0);
+  }
+  const initResult = await ensureTable();
+  if (!initResult.success) {
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      initResult.error.message,
+      initResult.error
+    );
+  }
+  async function getPermissionIdsInternal(roleId, tx) {
+    const runner = tx ?? reldb.sql;
+    const result = await runner.query(
+      `SELECT permission_id FROM ${ROLE_PERMISSION_TABLE} WHERE role_id = ?`,
+      [roleId]
+    );
+    if (!result.success) {
+      return err(
+        HaiIamError.REPOSITORY_ERROR,
+        iamM("iam_queryPermissionFailed", { params: { message: result.error.message } }),
+        result.error
+      );
+    }
+    return ok(result.data.map((r) => r.permission_id));
+  }
+  return ok({
+    async assign(roleId, permissionId, tx) {
+      const runner = tx ?? reldb.sql;
+      const result = await runner.execute(
+        `INSERT INTO ${ROLE_PERMISSION_TABLE} (role_id, permission_id) VALUES (?, ?) ON CONFLICT DO NOTHING`,
+        [roleId, permissionId]
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_assignPermissionFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    },
+    async remove(roleId, permissionId, tx) {
+      const runner = tx ?? reldb.sql;
+      const result = await runner.execute(
+        `DELETE FROM ${ROLE_PERMISSION_TABLE} WHERE role_id = ? AND permission_id = ?`,
+        [roleId, permissionId]
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_removePermissionFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    },
+    async getPermissions(roleId, tx) {
+      const idsResult = await getPermissionIdsInternal(roleId, tx);
+      if (!idsResult.success)
+        return idsResult;
+      if (idsResult.data.length === 0) {
+        return ok([]);
+      }
+      const placeholders = idsResult.data.map(() => "?").join(", ");
+      const result = await reldb.sql.query(
+        `SELECT * FROM ${PERMISSION_TABLE} WHERE id IN (${placeholders})`,
+        idsResult.data
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryPermissionFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(result.data);
+    },
+    async getPermissionCodesForRoles(roleIds) {
+      if (roleIds.length === 0) {
+        return ok([]);
+      }
+      const placeholders = roleIds.map(() => "?").join(", ");
+      const result = await reldb.sql.query(
+        `SELECT DISTINCT p.code FROM ${ROLE_PERMISSION_TABLE} rp JOIN ${PERMISSION_TABLE} p ON rp.permission_id = p.id WHERE rp.role_id IN (${placeholders})`,
+        roleIds
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryPermissionFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(result.data.map((r) => r.code));
+    },
+    async removeByRoleId(roleId, tx) {
+      const runner = tx ?? reldb.sql;
+      const result = await runner.execute(
+        `DELETE FROM ${ROLE_PERMISSION_TABLE} WHERE role_id = ?`,
+        [roleId]
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_removePermissionFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    },
+    async removeByPermissionId(permissionId, tx) {
+      const runner = tx ?? reldb.sql;
+      const result = await runner.execute(
+        `DELETE FROM ${ROLE_PERMISSION_TABLE} WHERE permission_id = ?`,
+        [permissionId]
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_removePermissionFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    },
+    async getRoleIdsByPermissionId(permissionId) {
+      const result = await reldb.sql.query(
+        `SELECT role_id FROM ${ROLE_PERMISSION_TABLE} WHERE permission_id = ?`,
+        [permissionId]
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryPermissionFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(result.data.map((r) => r.role_id));
+    },
+    async getPermissionsForRoles(roleIds) {
+      const result = /* @__PURE__ */ new Map();
+      if (roleIds.length === 0) {
+        return ok(result);
+      }
+      const placeholders = roleIds.map(() => "?").join(", ");
+      const relationsResult = await reldb.sql.query(
+        `SELECT role_id, permission_id FROM ${ROLE_PERMISSION_TABLE} WHERE role_id IN (${placeholders})`,
+        roleIds
+      );
+      if (!relationsResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryPermissionFailed", { params: { message: relationsResult.error.message } }),
+          relationsResult.error
+        );
+      }
+      for (const rid of roleIds) {
+        result.set(rid, []);
+      }
+      if (relationsResult.data.length === 0) {
+        return ok(result);
+      }
+      const uniquePermIds = [...new Set(relationsResult.data.map((r) => r.permission_id))];
+      const permPlaceholders = uniquePermIds.map(() => "?").join(", ");
+      const permsResult = await reldb.sql.query(
+        `SELECT * FROM ${PERMISSION_TABLE} WHERE id IN (${permPlaceholders})`,
+        uniquePermIds
+      );
+      if (!permsResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryPermissionFailed", { params: { message: permsResult.error.message } }),
+          permsResult.error
+        );
+      }
+      const permMap = /* @__PURE__ */ new Map();
+      for (const perm of permsResult.data) {
+        permMap.set(perm.id, perm);
+      }
+      for (const rel of relationsResult.data) {
+        const perm = permMap.get(rel.permission_id);
+        if (perm) {
+          result.get(rel.role_id).push(perm);
+        }
+      }
+      return ok(result);
+    }
+  });
+}
+var USER_ROLE_TABLE = "hai_iam_user_roles";
+var USER_ROLE_SCHEMA = {
+  user_id: { type: "TEXT", notNull: true },
+  role_id: { type: "TEXT", notNull: true }
+};
+async function createDbUserRoleRepository(roleRepository) {
+  async function ensureTable() {
+    const result = await reldb.ddl.createTable(USER_ROLE_TABLE, USER_ROLE_SCHEMA, true);
+    if (!result.success) {
+      return err(
+        HaiIamError.REPOSITORY_ERROR,
+        iamM("iam_createUserRoleTableFailed", { params: { message: result.error.message } }),
+        result.error
+      );
+    }
+    const indexResults = await Promise.all([
+      reldb.ddl.createIndex(USER_ROLE_TABLE, "idx_user_role_user_role", { columns: ["user_id", "role_id"], unique: true }),
+      reldb.ddl.createIndex(USER_ROLE_TABLE, "idx_user_role_user", { columns: ["user_id"] })
+    ]);
+    for (const indexResult of indexResults) {
+      if (!indexResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_createUserRoleIndexFailed", { params: { message: indexResult.error.message } }),
+          indexResult.error
+        );
+      }
+    }
+    return ok(void 0);
+  }
+  const initResult = await ensureTable();
+  if (!initResult.success) {
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      initResult.error.message,
+      initResult.error
+    );
+  }
+  async function getRoleIdsInternal(userId, tx) {
+    const runner = tx ?? reldb.sql;
+    const result = await runner.query(
+      `SELECT role_id FROM ${USER_ROLE_TABLE} WHERE user_id = ?`,
+      [userId]
+    );
+    if (!result.success) {
+      return err(
+        HaiIamError.REPOSITORY_ERROR,
+        iamM("iam_queryRoleFailed", { params: { message: result.error.message } }),
+        result.error
+      );
+    }
+    return ok(result.data.map((r) => r.role_id));
+  }
+  return ok({
+    async assign(userId, roleId, tx) {
+      const runner = tx ?? reldb.sql;
+      const result = await runner.execute(
+        `INSERT INTO ${USER_ROLE_TABLE} (user_id, role_id) VALUES (?, ?) ON CONFLICT DO NOTHING`,
+        [userId, roleId]
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_assignRoleFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    },
+    async remove(userId, roleId, tx) {
+      const runner = tx ?? reldb.sql;
+      const result = await runner.execute(
+        `DELETE FROM ${USER_ROLE_TABLE} WHERE user_id = ? AND role_id = ?`,
+        [userId, roleId]
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_removeRoleFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    },
+    async getRoleIds(userId, tx) {
+      return getRoleIdsInternal(userId, tx);
+    },
+    async getRoles(userId, tx) {
+      const idsResult = await getRoleIdsInternal(userId, tx);
+      if (!idsResult.success)
+        return idsResult;
+      if (idsResult.data.length === 0) {
+        return ok([]);
+      }
+      const placeholders = idsResult.data.map(() => "?").join(", ");
+      const roleResult = await roleRepository.findAll({
+        where: `id IN (${placeholders})`,
+        params: idsResult.data
+      }, tx);
+      if (!roleResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryRoleFailed", { params: { message: roleResult.error.message } }),
+          roleResult.error
+        );
+      }
+      return ok(roleResult.data);
+    },
+    async removeByRoleId(roleId, tx) {
+      const runner = tx ?? reldb.sql;
+      const usersResult = await runner.query(
+        `SELECT user_id FROM ${USER_ROLE_TABLE} WHERE role_id = ?`,
+        [roleId]
+      );
+      if (!usersResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryRoleFailed", { params: { message: usersResult.error.message } }),
+          usersResult.error
+        );
+      }
+      const deleteResult = await runner.execute(
+        `DELETE FROM ${USER_ROLE_TABLE} WHERE role_id = ?`,
+        [roleId]
+      );
+      if (!deleteResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_removeRoleFailed", { params: { message: deleteResult.error.message } }),
+          deleteResult.error
+        );
+      }
+      return ok(usersResult.data.map((r) => r.user_id));
+    },
+    async getUserIdsByRoleId(roleId) {
+      const result = await reldb.sql.query(
+        `SELECT user_id FROM ${USER_ROLE_TABLE} WHERE role_id = ?`,
+        [roleId]
+      );
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryRoleFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(result.data.map((r) => r.user_id));
+    },
+    async getRolesForUsers(userIds) {
+      const result = /* @__PURE__ */ new Map();
+      if (userIds.length === 0) {
+        return ok(result);
+      }
+      const placeholders = userIds.map(() => "?").join(", ");
+      const relationsResult = await reldb.sql.query(
+        `SELECT user_id, role_id FROM ${USER_ROLE_TABLE} WHERE user_id IN (${placeholders})`,
+        userIds
+      );
+      if (!relationsResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryRoleFailed", { params: { message: relationsResult.error.message } }),
+          relationsResult.error
+        );
+      }
+      for (const uid of userIds) {
+        result.set(uid, []);
+      }
+      if (relationsResult.data.length === 0) {
+        return ok(result);
+      }
+      const uniqueRoleIds = [...new Set(relationsResult.data.map((r) => r.role_id))];
+      const rolePlaceholders = uniqueRoleIds.map(() => "?").join(", ");
+      const rolesResult = await roleRepository.findAll({
+        where: `id IN (${rolePlaceholders})`,
+        params: uniqueRoleIds
+      });
+      if (!rolesResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryRoleFailed", { params: { message: rolesResult.error.message } }),
+          rolesResult.error
+        );
+      }
+      const roleMap = /* @__PURE__ */ new Map();
+      for (const role of rolesResult.data) {
+        roleMap.set(role.id, role);
+      }
+      for (const rel of relationsResult.data) {
+        const role = roleMap.get(rel.role_id);
+        if (role) {
+          result.get(rel.user_id).push(role);
+        }
+      }
+      return ok(result);
+    }
+  });
+}
+var TABLE_NAME4 = "hai_iam_roles";
+var ROLE_FIELDS = [
+  {
+    fieldName: "id",
+    columnName: "id",
+    def: { type: "TEXT", primaryKey: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "code",
+    columnName: "code",
+    def: { type: "TEXT", notNull: true, unique: true },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "name",
+    columnName: "name",
+    def: { type: "TEXT", notNull: true },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "description",
+    columnName: "description",
+    def: { type: "TEXT" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "isSystem",
+    columnName: "is_system",
+    def: { type: "BOOLEAN", defaultValue: 0 },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "createdAt",
+    columnName: "created_at",
+    def: { type: "TIMESTAMP", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "updatedAt",
+    columnName: "updated_at",
+    def: { type: "TIMESTAMP", notNull: true },
+    select: true,
+    create: true,
+    update: false
+  }
+];
+var roleRepoInstance = null;
+var roleRepoDbConfig = null;
+function resetRoleRepoSingleton() {
+  roleRepoInstance = null;
+  roleRepoDbConfig = null;
+}
+async function createDbRoleRepository() {
+  if (roleRepoInstance && roleRepoDbConfig === reldb.config)
+    return roleRepoInstance;
+  const repo = new DbRoleRepository();
+  await repo.count();
+  roleRepoInstance = repo;
+  roleRepoDbConfig = reldb.config;
+  return repo;
+}
+var DbRoleRepository = class extends BaseReldbCrudRepository {
+  constructor() {
+    super(reldb, {
+      table: TABLE_NAME4,
+      fields: ROLE_FIELDS
+    });
+  }
+  /** 根据角色代码查找角色 */
+  async findByCode(code, tx) {
+    return this.findOneBy("code = ?", [code], tx);
+  }
+  buildQueryError(error, cause) {
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      iamM("iam_queryRoleFailed", { params: { message: error.message } }),
+      cause
+    );
+  }
+  async findOneBy(where, params, tx) {
+    const result = await this.findAll({ where, params, limit: 1 }, tx);
+    if (!result.success) {
+      return this.buildQueryError(result.error, result.error);
+    }
+    return ok(result.data[0] ?? null);
+  }
+};
+
+// src/authz/iam-authz-functions.ts
+var logger6 = core.logger.child({ module: "iam", scope: "authz" });
+async function createAuthzOperations(deps) {
+  try {
+    const { config, session } = deps;
+    const roleRepository = await createDbRoleRepository();
+    const permissionRepository = await createDbPermissionRepository();
+    const rolePermResult = await createDbRolePermissionRepository();
+    if (!rolePermResult.success) {
+      return rolePermResult;
+    }
+    const userRoleResult = await createDbUserRoleRepository(roleRepository);
+    if (!userRoleResult.success) {
+      return userRoleResult;
+    }
+    const manager = createRbacManager({
+      rbacConfig: config.rbac,
+      roleRepository,
+      permissionRepository,
+      rolePermissionRepository: rolePermResult.data,
+      userRoleRepository: userRoleResult.data,
+      session
+    });
+    logger6.info("Authz sub-feature initialized");
+    return ok(manager);
+  } catch (error) {
+    logger6.error("Authz sub-feature initialization failed", { error });
+    return err(
+      HaiIamError.CONFIG_ERROR,
+      iamM("iam_initComponentFailed"),
+      error
+    );
+  }
+}
+function createRbacManager(config) {
+  const rbacConfig = config.rbacConfig ? RbacConfigSchema.parse(config.rbacConfig) : RbacConfigSchema.parse({});
+  const {
+    roleRepository,
+    permissionRepository,
+    rolePermissionRepository,
+    userRoleRepository,
+    session
+  } = config;
+  let superAdminRoleId;
+  async function resolveSuperAdminRoleId() {
+    if (superAdminRoleId !== void 0) {
+      return ok(superAdminRoleId);
+    }
+    const roleResult = await roleRepository.findByCode(rbacConfig.superAdminRole);
+    if (!roleResult.success) {
+      return mapRepositoryError2("iam_queryRoleFailed", roleResult.error.message);
+    }
+    superAdminRoleId = roleResult.data?.id ?? null;
+    return ok(superAdminRoleId);
+  }
+  function mapRepositoryError2(messageKey, message) {
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      iamM(messageKey, { params: { message } })
+    );
+  }
+  function matchesPermission(permission, code) {
+    if (code === permission) {
+      return true;
+    }
+    if (code.endsWith(":*")) {
+      const prefix = code.slice(0, -1);
+      return permission.startsWith(prefix);
+    }
+    return false;
+  }
+  async function hasPermissionInRoles(roleIds, permission) {
+    const codesResult = await rolePermissionRepository.getPermissionCodesForRoles(roleIds);
+    if (!codesResult.success)
+      return codesResult;
+    for (const code of codesResult.data) {
+      if (matchesPermission(permission, code))
+        return ok(true);
+    }
+    return ok(false);
+  }
+  async function getUserPermissionsInternal(userId) {
+    const roleIdsResult = await userRoleRepository.getRoleIds(userId);
+    if (!roleIdsResult.success)
+      return roleIdsResult;
+    if (roleIdsResult.data.length === 0)
+      return ok([]);
+    const permMapResult = await rolePermissionRepository.getPermissionsForRoles(roleIdsResult.data);
+    if (!permMapResult.success)
+      return permMapResult;
+    const permissions = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const perms of permMapResult.data.values()) {
+      for (const perm of perms) {
+        if (!seen.has(perm.id)) {
+          permissions.push(perm);
+          seen.add(perm.id);
+        }
+      }
+    }
+    return ok(permissions);
+  }
+  async function resolveUserPermissionCodes(userId) {
+    const roleIdsResult = await userRoleRepository.getRoleIds(userId);
+    if (!roleIdsResult.success) {
+      return roleIdsResult;
+    }
+    if (roleIdsResult.data.length === 0) {
+      return ok([]);
+    }
+    return rolePermissionRepository.getPermissionCodesForRoles(roleIdsResult.data);
+  }
+  async function resolveUserRoleCodes(userId) {
+    const rolesResult = await userRoleRepository.getRoles(userId);
+    if (!rolesResult.success) {
+      return rolesResult;
+    }
+    return ok(rolesResult.data.map((r) => r.code));
+  }
+  async function syncSessionPermissionsForRole(roleId) {
+    const userIdsResult = await userRoleRepository.getUserIdsByRoleId(roleId);
+    if (!userIdsResult.success) {
+      logger6.error("Failed to query users for permission sync", { roleId, error: userIdsResult.error.message });
+      return;
+    }
+    await Promise.allSettled(
+      userIdsResult.data.map(async (userId) => {
+        const permResult = await resolveUserPermissionCodes(userId);
+        if (!permResult.success) {
+          logger6.error("Failed to resolve permissions for session sync", { userId, roleId, error: permResult.error.message });
+          return;
+        }
+        const syncResult = await session.patchUserSessions(userId, { permissions: permResult.data });
+        if (!syncResult.success) {
+          logger6.error("Failed to sync session permissions", { userId, roleId, error: syncResult.error.message });
+        }
+      })
+    );
+  }
+  async function syncUserSessionAfterRoleChange(userId) {
+    const [roleCodesResult, permCodesResult] = await Promise.all([
+      resolveUserRoleCodes(userId),
+      resolveUserPermissionCodes(userId)
+    ]);
+    const updates = {};
+    if (roleCodesResult.success) {
+      updates.roles = roleCodesResult.data;
+    } else {
+      logger6.error("Failed to resolve roles for session sync", { userId, error: roleCodesResult.error.message });
+    }
+    if (permCodesResult.success) {
+      updates.permissions = permCodesResult.data;
+    } else {
+      logger6.error("Failed to resolve permissions for session sync", { userId, error: permCodesResult.error.message });
+    }
+    if (updates.roles !== void 0 || updates.permissions !== void 0) {
+      const syncResult = await session.patchUserSessions(userId, updates);
+      if (!syncResult.success) {
+        logger6.error("Failed to patch user sessions", { userId, error: syncResult.error.message });
+      }
+    }
+  }
+  return {
+    async checkPermission(userId, permission) {
+      if (!rbacConfig.enabled) {
+        return ok(true);
+      }
+      const roleIdsResult = await userRoleRepository.getRoleIds(userId);
+      if (!roleIdsResult.success)
+        return roleIdsResult;
+      const roleIds = roleIdsResult.data;
+      if (roleIds.length === 0) {
+        return ok(false);
+      }
+      const superAdminResult = await resolveSuperAdminRoleId();
+      if (!superAdminResult.success)
+        return superAdminResult;
+      if (superAdminResult.data && roleIds.includes(superAdminResult.data)) {
+        return ok(true);
+      }
+      return hasPermissionInRoles(roleIds, permission);
+    },
+    async getUserPermissions(userId) {
+      return getUserPermissionsInternal(userId);
+    },
+    async getUserRoles(userId) {
+      return userRoleRepository.getRoles(userId);
+    },
+    async assignRole(userId, roleId, tx) {
+      const roleExistsResult = await roleRepository.existsById(roleId, tx);
+      if (!roleExistsResult.success) {
+        return mapRepositoryError2("iam_queryRoleFailed", roleExistsResult.error.message);
+      }
+      if (!roleExistsResult.data) {
+        return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+      }
+      const result = await userRoleRepository.assign(userId, roleId, tx);
+      if (result.success) {
+        logger6.info("Role assigned to user", { userId, roleId });
+        void audit.log({ action: "role.assign", resource: "iam_user_role", resourceId: userId, details: { roleId } });
+        if (!tx) {
+          await syncUserSessionAfterRoleChange(userId);
+        }
+      }
+      return result;
+    },
+    async removeRole(userId, roleId, tx) {
+      const result = await userRoleRepository.remove(userId, roleId, tx);
+      if (result.success) {
+        logger6.info("Role removed from user", { userId, roleId });
+        void audit.log({ action: "role.remove", resource: "iam_user_role", resourceId: userId, details: { roleId } });
+        if (!tx) {
+          await syncUserSessionAfterRoleChange(userId);
+        }
+      }
+      return result;
+    },
+    async syncRoles(userId, roleIds, tx) {
+      const currentResult = await userRoleRepository.getRoles(userId, tx);
+      if (!currentResult.success) {
+        return currentResult;
+      }
+      const currentIds = new Set(currentResult.data.map((r) => r.id));
+      const targetIds = new Set(roleIds);
+      const toRemove = [...currentIds].filter((id) => !targetIds.has(id));
+      const toAdd = [...targetIds].filter((id) => !currentIds.has(id));
+      if (toRemove.length === 0 && toAdd.length === 0) {
+        return ok(void 0);
+      }
+      for (const roleId of toAdd) {
+        const existsResult = await roleRepository.existsById(roleId, tx);
+        if (!existsResult.success) {
+          return mapRepositoryError2("iam_queryRoleFailed", existsResult.error.message);
+        }
+        if (!existsResult.data) {
+          return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+        }
+      }
+      const ownTx = !tx;
+      if (!tx) {
+        const txResult = await reldb.tx.begin();
+        if (!txResult.success) {
+          return mapRepositoryError2("iam_syncRolesFailed", txResult.error.message);
+        }
+        tx = txResult.data;
+      }
+      try {
+        for (const roleId of toRemove) {
+          const result = await userRoleRepository.remove(userId, roleId, tx);
+          if (!result.success) {
+            if (ownTx)
+              await tx.rollback();
+            return result;
+          }
+        }
+        for (const roleId of toAdd) {
+          const result = await userRoleRepository.assign(userId, roleId, tx);
+          if (!result.success) {
+            if (ownTx)
+              await tx.rollback();
+            return result;
+          }
+        }
+        if (ownTx) {
+          const commitResult = await tx.commit();
+          if (!commitResult.success) {
+            return mapRepositoryError2("iam_syncRolesFailed", commitResult.error.message);
+          }
+        }
+      } catch (error) {
+        if (ownTx)
+          await tx.rollback();
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_syncRolesFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+      logger6.info("Roles synced for user", { userId, added: toAdd.length, removed: toRemove.length });
+      void audit.log({ action: "roles.sync", resource: "iam_user_role", resourceId: userId, details: { added: toAdd, removed: toRemove } });
+      if (ownTx) {
+        await syncUserSessionAfterRoleChange(userId);
+      }
+      return ok(void 0);
+    },
+    // ─── 角色管理 ───
+    async createRole(role, tx) {
+      const ownTx = !tx;
+      if (!tx) {
+        const txResult = await reldb.tx.begin();
+        if (!txResult.success) {
+          return mapRepositoryError2("iam_createRoleFailed", txResult.error.message);
+        }
+        tx = txResult.data;
+      }
+      try {
+        const createResult = await roleRepository.create(role, tx);
+        if (!createResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          const msg = createResult.error.message.toLowerCase();
+          if (msg.includes("unique") || msg.includes("duplicate")) {
+            return err(HaiIamError.ROLE_ALREADY_EXISTS, iamM("iam_roleAlreadyExist"));
+          }
+          return mapRepositoryError2("iam_createRoleFailed", createResult.error.message);
+        }
+        const createdResult = await roleRepository.findByCode(role.code, tx);
+        if (!createdResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return mapRepositoryError2("iam_queryRoleFailed", createdResult.error.message);
+        }
+        if (!createdResult.data) {
+          if (ownTx)
+            await tx.rollback();
+          return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+        }
+        if (ownTx) {
+          const commitResult = await tx.commit();
+          if (!commitResult.success) {
+            return mapRepositoryError2("iam_createRoleFailed", commitResult.error.message);
+          }
+        }
+        logger6.info("Role created", { roleId: createdResult.data.id, code: role.code });
+        void audit.helper.crud({ action: "create", resource: "iam_role", resourceId: createdResult.data.id, details: { code: role.code } });
+        if (role.code === rbacConfig.superAdminRole) {
+          superAdminRoleId = void 0;
+        }
+        return ok(createdResult.data);
+      } catch (error) {
+        if (ownTx)
+          await tx.rollback();
+        const msg = String(error).toLowerCase();
+        if (msg.includes("unique") || msg.includes("duplicate")) {
+          return err(HaiIamError.ROLE_ALREADY_EXISTS, iamM("iam_roleAlreadyExist"));
+        }
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_createRoleFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+    },
+    async getRole(roleId) {
+      const result = await roleRepository.findById(roleId);
+      if (!result.success) {
+        return mapRepositoryError2("iam_queryRoleFailed", result.error.message);
+      }
+      return ok(result.data);
+    },
+    async getRoleByCode(code) {
+      const result = await roleRepository.findByCode(code);
+      if (!result.success) {
+        return mapRepositoryError2("iam_queryRoleFailed", result.error.message);
+      }
+      return ok(result.data);
+    },
+    async getAllRoles(options) {
+      const result = await roleRepository.findPage({
+        orderBy: "created_at DESC",
+        pagination: options
+      });
+      if (!result.success) {
+        return mapRepositoryError2("iam_queryRoleListFailed", result.error.message);
+      }
+      return ok(result.data);
+    },
+    async updateRole(roleId, data, tx) {
+      const ownTx = !tx;
+      if (!tx) {
+        const txResult = await reldb.tx.begin();
+        if (!txResult.success) {
+          return mapRepositoryError2("iam_updateRoleFailed", txResult.error.message);
+        }
+        tx = txResult.data;
+      }
+      try {
+        const updateResult = await roleRepository.updateById(roleId, data, tx);
+        if (!updateResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return mapRepositoryError2("iam_updateRoleFailed", updateResult.error.message);
+        }
+        if (updateResult.data.changes === 0) {
+          if (ownTx)
+            await tx.rollback();
+          return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+        }
+        const updatedResult = await roleRepository.findById(roleId, tx);
+        if (!updatedResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return mapRepositoryError2("iam_queryRoleFailed", updatedResult.error.message);
+        }
+        if (!updatedResult.data) {
+          if (ownTx)
+            await tx.rollback();
+          return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+        }
+        if (ownTx) {
+          const commitResult = await tx.commit();
+          if (!commitResult.success) {
+            return mapRepositoryError2("iam_updateRoleFailed", commitResult.error.message);
+          }
+        }
+        superAdminRoleId = void 0;
+        if (ownTx) {
+          const affectedUsersResult = await userRoleRepository.getUserIdsByRoleId(roleId);
+          if (affectedUsersResult.success) {
+            for (const userId of affectedUsersResult.data) {
+              await syncUserSessionAfterRoleChange(userId);
+            }
+          } else {
+            logger6.error("Failed to query affected users after updateRole", { roleId, error: affectedUsersResult.error.message });
+          }
+        }
+        void audit.helper.crud({ action: "update", resource: "iam_role", resourceId: roleId, details: data });
+        return ok(updatedResult.data);
+      } catch (error) {
+        if (ownTx)
+          await tx.rollback();
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_updateRoleFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+    },
+    async deleteRole(roleId, tx) {
+      const roleResult = await roleRepository.findById(roleId, tx);
+      if (!roleResult.success) {
+        return mapRepositoryError2("iam_queryRoleFailed", roleResult.error.message);
+      }
+      if (!roleResult.data) {
+        return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+      }
+      if (roleResult.data.isSystem) {
+        return err(HaiIamError.PERMISSION_DENIED, iamM("iam_cannotDeleteSystemRole"));
+      }
+      const ownTx = !tx;
+      if (!tx) {
+        const txResult = await reldb.tx.begin();
+        if (!txResult.success) {
+          return mapRepositoryError2("iam_deleteRoleFailed", txResult.error.message);
+        }
+        tx = txResult.data;
+      }
+      let affectedUserIds = [];
+      try {
+        const userIdsResult = await userRoleRepository.removeByRoleId(roleId, tx);
+        if (!userIdsResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return userIdsResult;
+        }
+        affectedUserIds = userIdsResult.data;
+        const rpResult = await rolePermissionRepository.removeByRoleId(roleId, tx);
+        if (!rpResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return rpResult;
+        }
+        const delResult = await roleRepository.deleteById(roleId, tx);
+        if (!delResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return mapRepositoryError2("iam_deleteRoleFailed", delResult.error.message);
+        }
+        if (ownTx) {
+          const commitResult = await tx.commit();
+          if (!commitResult.success) {
+            return mapRepositoryError2("iam_deleteRoleFailed", commitResult.error.message);
+          }
+        }
+      } catch (error) {
+        if (ownTx)
+          await tx.rollback();
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_deleteRoleFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+      if (ownTx) {
+        for (const userId of affectedUserIds) {
+          await syncUserSessionAfterRoleChange(userId);
+        }
+      }
+      superAdminRoleId = void 0;
+      logger6.info("Role deleted", { roleId });
+      void audit.helper.crud({ action: "delete", resource: "iam_role", resourceId: roleId });
+      return ok(void 0);
+    },
+    // ─── 权限管理 ───
+    async createPermission(permission, tx) {
+      const ownTx = !tx;
+      if (!tx) {
+        const txResult = await reldb.tx.begin();
+        if (!txResult.success) {
+          return mapRepositoryError2("iam_createPermissionFailed", txResult.error.message);
+        }
+        tx = txResult.data;
+      }
+      try {
+        const createResult = await permissionRepository.create(permission, tx);
+        if (!createResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          const msg = createResult.error.message.toLowerCase();
+          if (msg.includes("unique") || msg.includes("duplicate")) {
+            return err(HaiIamError.PERMISSION_ALREADY_EXISTS, iamM("iam_permissionAlreadyExist"));
+          }
+          return mapRepositoryError2("iam_createPermissionFailed", createResult.error.message);
+        }
+        const createdResult = await permissionRepository.findByCode(permission.code, tx);
+        if (!createdResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return mapRepositoryError2("iam_queryPermissionFailed", createdResult.error.message);
+        }
+        if (!createdResult.data) {
+          if (ownTx)
+            await tx.rollback();
+          return err(HaiIamError.PERMISSION_NOT_FOUND, iamM("iam_permissionNotExist"));
+        }
+        if (ownTx) {
+          const commitResult = await tx.commit();
+          if (!commitResult.success) {
+            return mapRepositoryError2("iam_createPermissionFailed", commitResult.error.message);
+          }
+        }
+        logger6.info("Permission created", { permissionId: createdResult.data.id, code: permission.code });
+        void audit.helper.crud({ action: "create", resource: "iam_permission", resourceId: createdResult.data.id, details: { code: permission.code } });
+        return ok(createdResult.data);
+      } catch (error) {
+        if (ownTx)
+          await tx.rollback();
+        const msg = String(error).toLowerCase();
+        if (msg.includes("unique") || msg.includes("duplicate")) {
+          return err(HaiIamError.PERMISSION_ALREADY_EXISTS, iamM("iam_permissionAlreadyExist"));
+        }
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_createPermissionFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+    },
+    async getPermission(permissionId) {
+      const result = await permissionRepository.findById(permissionId);
+      if (!result.success) {
+        return mapRepositoryError2("iam_queryPermissionFailed", result.error.message);
+      }
+      return ok(result.data);
+    },
+    async getPermissionByCode(code) {
+      const result = await permissionRepository.findByCode(code);
+      if (!result.success) {
+        return mapRepositoryError2("iam_queryPermissionFailed", result.error.message);
+      }
+      return ok(result.data);
+    },
+    async getAllPermissions(options) {
+      const whereClauses = [];
+      const whereParams = [];
+      if (options?.type) {
+        whereClauses.push("type = ?");
+        whereParams.push(options.type);
+      }
+      if (options?.search) {
+        whereClauses.push("(code LIKE ? OR name LIKE ?)");
+        const escaped = options.search.replace(/[%_\\]/g, "\\$&");
+        const pattern = `%${escaped}%`;
+        whereParams.push(pattern, pattern);
+      }
+      const result = await permissionRepository.findPage({
+        where: whereClauses.length > 0 ? whereClauses.join(" AND ") : void 0,
+        params: whereParams.length > 0 ? whereParams : void 0,
+        orderBy: "created_at DESC",
+        pagination: options
+      });
+      if (!result.success) {
+        return mapRepositoryError2("iam_queryPermissionListFailed", result.error.message);
+      }
+      return ok(result.data);
+    },
+    async deletePermission(permissionId, tx) {
+      const permissionResult = await permissionRepository.findById(permissionId, tx);
+      if (!permissionResult.success) {
+        return mapRepositoryError2("iam_queryPermissionFailed", permissionResult.error.message);
+      }
+      if (!permissionResult.data) {
+        return err(
+          HaiIamError.PERMISSION_NOT_FOUND,
+          iamM("iam_permissionNotExist")
+        );
+      }
+      const affectedRoleIdsResult = await rolePermissionRepository.getRoleIdsByPermissionId(permissionId);
+      const affectedRoleIds = affectedRoleIdsResult.success ? affectedRoleIdsResult.data : [];
+      const ownTx = !tx;
+      if (!tx) {
+        const txResult = await reldb.tx.begin();
+        if (!txResult.success) {
+          return mapRepositoryError2("iam_deletePermissionFailed", txResult.error.message);
+        }
+        tx = txResult.data;
+      }
+      try {
+        const cascadeResult = await rolePermissionRepository.removeByPermissionId(permissionId, tx);
+        if (!cascadeResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return cascadeResult;
+        }
+        const delResult = await permissionRepository.deleteById(permissionId, tx);
+        if (!delResult.success) {
+          if (ownTx)
+            await tx.rollback();
+          return mapRepositoryError2("iam_deletePermissionFailed", delResult.error.message);
+        }
+        if (ownTx) {
+          const commitResult = await tx.commit();
+          if (!commitResult.success) {
+            return mapRepositoryError2("iam_deletePermissionFailed", commitResult.error.message);
+          }
+        }
+      } catch (error) {
+        if (ownTx)
+          await tx.rollback();
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_deletePermissionFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+      if (ownTx) {
+        for (const roleId of affectedRoleIds) {
+          await syncSessionPermissionsForRole(roleId);
+        }
+      }
+      logger6.info("Permission deleted", { permissionId });
+      void audit.helper.crud({ action: "delete", resource: "iam_permission", resourceId: permissionId });
+      return ok(void 0);
+    },
+    async assignPermissionToRole(roleId, permissionId, tx) {
+      const [roleResult, permResult] = await Promise.all([
+        roleRepository.existsById(roleId, tx),
+        permissionRepository.findById(permissionId, tx)
+      ]);
+      if (!roleResult.success) {
+        return mapRepositoryError2("iam_queryRoleFailed", roleResult.error.message);
+      }
+      if (!roleResult.data) {
+        return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+      }
+      if (!permResult.success) {
+        return mapRepositoryError2("iam_queryPermissionFailed", permResult.error.message);
+      }
+      if (!permResult.data) {
+        return err(HaiIamError.PERMISSION_NOT_FOUND, iamM("iam_permissionNotExist"));
+      }
+      const assignResult = await rolePermissionRepository.assign(roleId, permissionId, tx);
+      if (assignResult.success) {
+        logger6.info("Permission assigned to role", { roleId, permissionId });
+        void audit.log({ action: "permission.assign", resource: "iam_role_permission", resourceId: roleId, details: { permissionId } });
+        if (!tx) {
+          await syncSessionPermissionsForRole(roleId);
+        }
+      }
+      return assignResult;
+    },
+    async removePermissionFromRole(roleId, permissionId, tx) {
+      const [roleResult, permResult] = await Promise.all([
+        roleRepository.existsById(roleId, tx),
+        permissionRepository.findById(permissionId, tx)
+      ]);
+      if (!roleResult.success) {
+        return mapRepositoryError2("iam_queryRoleFailed", roleResult.error.message);
+      }
+      if (!roleResult.data) {
+        return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
+      }
+      if (!permResult.success) {
+        return mapRepositoryError2("iam_queryPermissionFailed", permResult.error.message);
+      }
+      if (!permResult.data) {
+        return err(
+          HaiIamError.PERMISSION_NOT_FOUND,
+          iamM("iam_permissionNotExist")
+        );
+      }
+      const removeResult = await rolePermissionRepository.remove(roleId, permissionId, tx);
+      if (removeResult.success) {
+        logger6.info("Permission removed from role", { roleId, permissionId });
+        void audit.log({ action: "permission.remove", resource: "iam_role_permission", resourceId: roleId, details: { permissionId } });
+        if (!tx) {
+          await syncSessionPermissionsForRole(roleId);
+        }
+      }
+      return removeResult;
+    },
+    async getRolePermissions(roleId) {
+      return rolePermissionRepository.getPermissions(roleId);
+    },
+    async getUserRolesForMany(userIds) {
+      return userRoleRepository.getRolesForUsers(userIds);
+    },
+    async getRolePermissionsForMany(roleIds) {
+      return rolePermissionRepository.getPermissionsForRoles(roleIds);
+    }
+  };
+}
+var logger7 = core.logger.child({ module: "iam", scope: "seed" });
+var DEFAULT_ROLES = [
+  { code: "admin", name: () => iamM("iam_seedRoleAdminName"), description: () => iamM("iam_seedRoleAdminDesc"), isSystem: true },
+  { code: "user", name: () => iamM("iam_seedRoleUserName"), description: () => iamM("iam_seedRoleUserDesc"), isSystem: true },
+  { code: "guest", name: () => iamM("iam_seedRoleGuestName"), description: () => iamM("iam_seedRoleGuestDesc"), isSystem: true }
+];
+var DEFAULT_PERMISSIONS = [
+  // ─── 菜单权限 ───
+  { code: "dashboard:view", name: () => iamM("iam_seedPermDashboardView"), type: "menu", resource: "dashboard", action: "view" },
+  { code: "user:read", name: () => iamM("iam_seedPermUserRead"), type: "menu", resource: "user", action: "read" },
+  { code: "role:read", name: () => iamM("iam_seedPermRoleRead"), type: "menu", resource: "role", action: "read" },
+  { code: "permission:read", name: () => iamM("iam_seedPermPermRead"), type: "menu", resource: "permission", action: "read" },
+  { code: "system:logs", name: () => iamM("iam_seedPermSystemLogs"), type: "menu", resource: "system", action: "logs" },
+  { code: "system:settings", name: () => iamM("iam_seedPermSystemSettings"), type: "menu", resource: "system", action: "settings" },
+  { code: "system:modules", name: () => iamM("iam_seedPermSystemModules"), type: "menu", resource: "system", action: "modules" },
+  { code: "profile:read", name: () => iamM("iam_seedPermProfileRead"), type: "menu", resource: "profile", action: "read" },
+  // ─── API 权限 ───
+  { code: "user:list", name: () => iamM("iam_seedPermUserList"), type: "api", resource: "user", action: "list" },
+  { code: "user:api:create", name: () => iamM("iam_seedPermUserApiCreate"), type: "api", resource: "user", action: "api:create" },
+  { code: "user:api:update", name: () => iamM("iam_seedPermUserApiUpdate"), type: "api", resource: "user", action: "api:update" },
+  { code: "user:api:delete", name: () => iamM("iam_seedPermUserApiDelete"), type: "api", resource: "user", action: "api:delete" },
+  { code: "role:list", name: () => iamM("iam_seedPermRoleList"), type: "api", resource: "role", action: "list" },
+  { code: "role:api:create", name: () => iamM("iam_seedPermRoleApiCreate"), type: "api", resource: "role", action: "api:create" },
+  { code: "role:api:update", name: () => iamM("iam_seedPermRoleApiUpdate"), type: "api", resource: "role", action: "api:update" },
+  { code: "role:api:delete", name: () => iamM("iam_seedPermRoleApiDelete"), type: "api", resource: "role", action: "api:delete" },
+  { code: "permission:list", name: () => iamM("iam_seedPermPermList"), type: "api", resource: "permission", action: "list" },
+  { code: "permission:manage", name: () => iamM("iam_seedPermPermManage"), type: "api", resource: "permission", action: "manage" },
+  { code: "permission:api:create", name: () => iamM("iam_seedPermPermApiCreate"), type: "api", resource: "permission", action: "api:create" },
+  { code: "permission:api:delete", name: () => iamM("iam_seedPermPermApiDelete"), type: "api", resource: "permission", action: "api:delete" },
+  { code: "audit:read", name: () => iamM("iam_seedPermAuditRead"), type: "api", resource: "audit", action: "read" },
+  // ─── 按钮权限 ───
+  { code: "user:create", name: () => iamM("iam_seedPermUserCreate"), type: "button", resource: "user", action: "create" },
+  { code: "user:update", name: () => iamM("iam_seedPermUserUpdate"), type: "button", resource: "user", action: "update" },
+  { code: "user:delete", name: () => iamM("iam_seedPermUserDelete"), type: "button", resource: "user", action: "delete" },
+  { code: "role:create", name: () => iamM("iam_seedPermRoleCreate"), type: "button", resource: "role", action: "create" },
+  { code: "role:update", name: () => iamM("iam_seedPermRoleUpdate"), type: "button", resource: "role", action: "update" },
+  { code: "role:delete", name: () => iamM("iam_seedPermRoleDelete"), type: "button", resource: "role", action: "delete" },
+  { code: "permission:create", name: () => iamM("iam_seedPermPermCreate"), type: "button", resource: "permission", action: "create" },
+  { code: "permission:delete", name: () => iamM("iam_seedPermPermDelete"), type: "button", resource: "permission", action: "delete" }
+];
+var USER_ROLE_PERMISSIONS = ["dashboard:view", "profile:read"];
+async function seedIamData(authz) {
+  try {
+    const existingRoles = await authz.getAllRoles({ page: 1, pageSize: 1e3 });
+    const existingRoleMap = /* @__PURE__ */ new Map();
+    if (existingRoles.success) {
+      for (const role of existingRoles.data.items) {
+        existingRoleMap.set(role.code, role.id);
+      }
+    }
+    const roleMap = /* @__PURE__ */ new Map();
+    for (const role of DEFAULT_ROLES) {
+      const existingId = existingRoleMap.get(role.code);
+      if (existingId) {
+        roleMap.set(role.code, existingId);
+        continue;
+      }
+      const result = await authz.createRole({ code: role.code, name: role.name(), description: role.description(), isSystem: role.isSystem });
+      if (result.success) {
+        roleMap.set(role.code, result.data.id);
+      } else {
+        return result;
+      }
+    }
+    const existingPerms = await authz.getAllPermissions({ page: 1, pageSize: 1e3 });
+    const existingPermMap = /* @__PURE__ */ new Map();
+    if (existingPerms.success) {
+      for (const perm of existingPerms.data.items) {
+        existingPermMap.set(perm.code, perm.id);
+      }
+    }
+    const permMap = /* @__PURE__ */ new Map();
+    for (const perm of DEFAULT_PERMISSIONS) {
+      const existingId = existingPermMap.get(perm.code);
+      if (existingId) {
+        permMap.set(perm.code, existingId);
+        continue;
+      }
+      const result = await authz.createPermission({ code: perm.code, name: perm.name(), type: perm.type, resource: perm.resource, action: perm.action });
+      if (result.success) {
+        permMap.set(perm.code, result.data.id);
+      } else {
+        return result;
+      }
+    }
+    const adminRoleId = roleMap.get("admin");
+    if (adminRoleId) {
+      for (const [, permId] of permMap) {
+        await authz.assignPermissionToRole(adminRoleId, permId);
+      }
+    }
+    const userRoleId = roleMap.get("user");
+    if (userRoleId) {
+      for (const permCode of USER_ROLE_PERMISSIONS) {
+        const permId = permMap.get(permCode);
+        if (permId) {
+          await authz.assignPermissionToRole(userRoleId, permId);
+        }
+      }
+    }
+    logger7.info("IAM seed data initialized");
+    return ok(void 0);
+  } catch (error) {
+    logger7.error("Failed to seed IAM data", { error });
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      iamM("iam_initSeedDataFailed"),
+      error
+    );
+  }
+}
+
+// src/session/iam-session-utils.ts
+function generateToken() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const base64 = btoa(String.fromCharCode(...bytes));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function buildSession(options, now, sessionTtl, accessToken) {
+  return {
+    userId: options.userId,
+    username: options.username,
+    displayName: options.displayName,
+    avatarUrl: options.avatarUrl,
+    roles: options.roles ?? [],
+    permissions: options.permissions ?? [],
+    source: options.source,
+    accessToken,
+    createdAt: now,
+    lastActiveAt: now,
+    expiresAt: new Date(now.getTime() + sessionTtl * 1e3),
+    data: options.data
+  };
+}
+function getSessionTtl(session, now = Date.now()) {
+  return Math.max(0, Math.floor((session.expiresAt.getTime() - now) / 1e3));
+}
+function applySessionPatch(session, patch) {
+  const nextSession = { ...session };
+  if (patch.data !== void 0) {
+    nextSession.data = { ...nextSession.data, ...patch.data };
+  }
+  if (patch.roles !== void 0) {
+    nextSession.roles = patch.roles;
+  }
+  if (patch.permissions !== void 0) {
+    nextSession.permissions = patch.permissions;
+  }
+  if (patch.username !== void 0) {
+    nextSession.username = patch.username;
+  }
+  if (patch.displayName !== void 0) {
+    nextSession.displayName = patch.displayName;
+  }
+  if (patch.avatarUrl !== void 0) {
+    nextSession.avatarUrl = patch.avatarUrl;
+  }
+  if (patch.source !== void 0) {
+    nextSession.source = patch.source;
+  }
+  nextSession.lastActiveAt = /* @__PURE__ */ new Date();
+  return nextSession;
+}
+
+// src/session/iam-session-repository-cache.ts
+var TOKEN_KEY_PREFIX = "hai:iam:token:";
+var USER_TOKENS_KEY_PREFIX = "hai:iam:user:";
+var REFRESH_TOKEN_PREFIX = "hai:iam:refresh:";
+function buildTokenKey(token) {
+  return `${TOKEN_KEY_PREFIX}${token}`;
+}
+function buildUserTokensKey(userId) {
+  return `${USER_TOKENS_KEY_PREFIX}${userId}:tokens`;
+}
+function buildRefreshKey(refreshToken) {
+  return `${REFRESH_TOKEN_PREFIX}${refreshToken}`;
+}
+function restoreSessionDates(session) {
+  return {
+    ...session,
+    createdAt: session.createdAt instanceof Date ? session.createdAt : new Date(session.createdAt),
+    lastActiveAt: session.lastActiveAt instanceof Date ? session.lastActiveAt : new Date(session.lastActiveAt),
+    expiresAt: session.expiresAt instanceof Date ? session.expiresAt : new Date(session.expiresAt)
+  };
+}
+function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
+  const repo = {
+    async save(session, tokenPair) {
+      const accessToken = session.accessToken;
+      const userId = session.userId;
+      const ttl = getSessionTtl(session);
+      const setResult = await cache.kv.set(buildTokenKey(accessToken), session, { ex: ttl });
+      if (!setResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_saveSessionMappingCacheFailed", { params: { message: setResult.error.message } }),
+          setResult.error
+        );
+      }
+      const saddResult = await cache.set_.sadd(buildUserTokensKey(userId), accessToken);
+      if (!saddResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_saveUserSessionCacheFailed", { params: { message: saddResult.error.message } }),
+          saddResult.error
+        );
+      }
+      await cache.kv.expire(buildUserTokensKey(userId), sessionMaxAge * 2);
+      const refreshResult = await cache.kv.set(
+        buildRefreshKey(tokenPair.refreshToken),
+        { userId, accessToken },
+        { ex: refreshTokenMaxAge }
+      );
+      if (!refreshResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_saveSessionMappingCacheFailed", { params: { message: refreshResult.error.message } }),
+          refreshResult.error
+        );
+      }
+      return ok(void 0);
+    },
+    async getByAccessToken(accessToken) {
+      const result = await cache.kv.get(buildTokenKey(accessToken));
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_querySessionMappingCacheFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      if (!result.data) {
+        return ok(null);
+      }
+      return ok(restoreSessionDates(result.data));
+    },
+    async updateByAccessToken(accessToken, data) {
+      const sessionResult = await repo.getByAccessToken(accessToken);
+      if (!sessionResult.success) {
+        return sessionResult;
+      }
+      if (!sessionResult.data) {
+        return err(
+          HaiIamError.SESSION_NOT_FOUND,
+          iamM("iam_sessionNotExist")
+        );
+      }
+      const nextSession = applySessionPatch(sessionResult.data, data);
+      const ttl = getSessionTtl(nextSession);
+      const setResult = await cache.kv.set(buildTokenKey(accessToken), nextSession, { ex: ttl });
+      if (!setResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_saveSessionMappingCacheFailed", { params: { message: setResult.error.message } }),
+          setResult.error
+        );
+      }
+      return ok(void 0);
+    },
+    async removeByAccessToken(accessToken) {
+      const sessionResult = await cache.kv.get(buildTokenKey(accessToken));
+      if (sessionResult.success && sessionResult.data) {
+        const session = sessionResult.data;
+        await cache.set_.srem(buildUserTokensKey(session.userId), accessToken);
+        const tokenPair = session.data?._tokenPair;
+        if (tokenPair?.refreshToken) {
+          await cache.kv.del(buildRefreshKey(tokenPair.refreshToken));
+        }
+      }
+      await cache.kv.del(buildTokenKey(accessToken));
+      return ok(void 0);
+    },
+    async removeByUserId(userId) {
+      const tokensResult = await cache.set_.smembers(buildUserTokensKey(userId));
+      if (tokensResult.success) {
+        for (const token of tokensResult.data) {
+          await repo.removeByAccessToken(token);
+        }
+      }
+      await cache.kv.del(buildUserTokensKey(userId));
+      return ok(void 0);
+    },
+    async getByRefreshToken(refreshToken) {
+      const mappingResult = await cache.kv.get(buildRefreshKey(refreshToken));
+      if (!mappingResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_querySessionMappingCacheFailed", { params: { message: mappingResult.error.message } }),
+          mappingResult.error
+        );
+      }
+      if (!mappingResult.data) {
+        return ok(null);
+      }
+      return repo.getByAccessToken(mappingResult.data.accessToken);
+    },
+    async removeRefreshToken(refreshToken) {
+      const result = await cache.kv.del(buildRefreshKey(refreshToken));
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_deleteSessionMappingCacheFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      return ok(void 0);
+    },
+    async patchUserSessions(userId, updates) {
+      const tokensResult = await cache.set_.smembers(buildUserTokensKey(userId));
+      if (!tokensResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryUserSessionCacheFailed", { params: { message: tokensResult.error.message } }),
+          tokensResult.error
+        );
+      }
+      const staleTokens = [];
+      for (const token of tokensResult.data) {
+        const sessionKey = buildTokenKey(token);
+        const sessionResult = await cache.kv.get(sessionKey);
+        if (!sessionResult.success || !sessionResult.data) {
+          staleTokens.push(token);
+          continue;
+        }
+        const ttlResult = await cache.kv.ttl(sessionKey);
+        if (!ttlResult.success || ttlResult.data <= 0) {
+          staleTokens.push(token);
+          continue;
+        }
+        const updated = { ...sessionResult.data, ...updates };
+        const setResult = await cache.kv.set(sessionKey, updated, { ex: ttlResult.data });
+        if (!setResult.success) {
+          return err(
+            HaiIamError.REPOSITORY_ERROR,
+            iamM("iam_saveUserSessionCacheFailed", { params: { message: setResult.error.message } }),
+            setResult.error
+          );
+        }
+      }
+      if (staleTokens.length > 0) {
+        await cache.set_.srem(buildUserTokensKey(userId), ...staleTokens);
+      }
+      return ok(void 0);
+    }
+  };
+  return repo;
+}
+
+// src/session/iam-session-functions.ts
+var logger8 = core.logger.child({ module: "iam", scope: "session" });
+async function createSessionOperations(deps) {
+  try {
+    const { config } = deps;
+    const sessionConfig = SessionConfigSchema.parse(config.session ?? {});
+    const sessionRepository = createCacheSessionRepository(
+      sessionConfig.maxAge ?? 86400,
+      sessionConfig.refreshTokenMaxAge ?? 604800
+    );
+    const functions = buildSessionFunctions({
+      maxAge: sessionConfig.maxAge,
+      sliding: sessionConfig.sliding,
+      singleDevice: sessionConfig.singleDevice,
+      sessionRepository
+    });
+    logger8.info("Session sub-feature initialized");
+    return ok(functions);
+  } catch (error) {
+    logger8.error("Session sub-feature initialization failed", { error });
+    return err(
+      HaiIamError.CONFIG_ERROR,
+      iamM("iam_initComponentFailed"),
+      error
+    );
+  }
+}
+function buildSessionFunctions(config) {
+  const maxAge = config.maxAge ?? 86400;
+  const sliding = config.sliding ?? true;
+  const singleDevice = config.singleDevice ?? false;
+  const repo = config.sessionRepository;
+  return {
+    async create(options) {
+      try {
+        if (singleDevice) {
+          const clearResult = await repo.removeByUserId(options.userId);
+          if (!clearResult.success) {
+            return clearResult;
+          }
+        }
+        const accessToken = generateToken();
+        const tokenPair = {
+          accessToken,
+          refreshToken: generateToken(),
+          expiresIn: maxAge,
+          tokenType: "Bearer"
+        };
+        const now = /* @__PURE__ */ new Date();
+        const sessionTtl = options.maxAge ?? maxAge;
+        const session = buildSession(options, now, sessionTtl, accessToken);
+        session.data = { ...session.data, _tokenPair: tokenPair };
+        const saveResult = await repo.save(session, tokenPair);
+        if (!saveResult.success) {
+          return saveResult;
+        }
+        logger8.debug("Session created", { userId: options.userId });
+        return ok(session);
+      } catch (error) {
+        return err(
+          HaiIamError.SESSION_CREATE_FAILED,
+          iamM("iam_createSessionFailed"),
+          error
+        );
+      }
+    },
+    async get(accessToken) {
+      const sessionResult = await repo.getByAccessToken(accessToken);
+      if (!sessionResult.success) {
+        return sessionResult;
+      }
+      const session = sessionResult.data;
+      if (!session) {
+        return ok(null);
+      }
+      if (/* @__PURE__ */ new Date() > session.expiresAt) {
+        await repo.removeByAccessToken(accessToken);
+        return ok(null);
+      }
+      if (sliding) {
+        const now = /* @__PURE__ */ new Date();
+        await repo.updateByAccessToken(accessToken, {
+          lastActiveAt: now,
+          expiresAt: new Date(now.getTime() + maxAge * 1e3)
+        });
+      }
+      return ok(session);
+    },
+    async verifyToken(accessToken) {
+      const sessionResult = await this.get(accessToken);
+      if (!sessionResult.success) {
+        return sessionResult;
+      }
+      if (!sessionResult.data) {
+        return err(
+          HaiIamError.SESSION_INVALID,
+          iamM("iam_sessionExpired")
+        );
+      }
+      return ok(sessionResult.data);
+    },
+    async update(accessToken, data) {
+      return repo.updateByAccessToken(accessToken, data);
+    },
+    async delete(accessToken) {
+      logger8.debug("Session deleted", { accessToken });
+      return repo.removeByAccessToken(accessToken);
+    },
+    async deleteByUserId(userId) {
+      const result = await repo.removeByUserId(userId);
+      if (!result.success) {
+        return result;
+      }
+      return ok(0);
+    },
+    async refresh(refreshToken) {
+      try {
+        const oldSessionResult = await repo.getByRefreshToken(refreshToken);
+        if (!oldSessionResult.success) {
+          return oldSessionResult;
+        }
+        const oldSession = oldSessionResult.data;
+        if (!oldSession) {
+          return err(
+            HaiIamError.TOKEN_EXPIRED,
+            iamM("iam_refreshTokenExpired")
+          );
+        }
+        await repo.removeByAccessToken(oldSession.accessToken);
+        const newSessionResult = await this.create({
+          userId: oldSession.userId,
+          username: oldSession.username,
+          displayName: oldSession.displayName,
+          avatarUrl: oldSession.avatarUrl,
+          roles: oldSession.roles,
+          permissions: oldSession.permissions,
+          source: oldSession.source,
+          data: oldSession.data ? { ...oldSession.data, _tokenPair: void 0 } : void 0
+        });
+        if (!newSessionResult.success) {
+          return newSessionResult;
+        }
+        const tokenPair = newSessionResult.data.data?._tokenPair;
+        if (!tokenPair) {
+          return err(
+            HaiIamError.TOKEN_REFRESH_FAILED,
+            iamM("iam_refreshTokenFailed")
+          );
+        }
+        logger8.debug("Token refreshed", { userId: oldSession.userId });
+        return ok(tokenPair);
+      } catch (error) {
+        return err(
+          HaiIamError.TOKEN_REFRESH_FAILED,
+          iamM("iam_refreshTokenFailed"),
+          error
+        );
+      }
+    },
+    async revokeRefresh(refreshToken) {
+      return repo.removeRefreshToken(refreshToken);
+    },
+    async patchUserSessions(userId, updates) {
+      return repo.patchUserSessions(userId, { ...updates });
+    }
+  };
+}
+function hashResetToken(token) {
+  const result = crypto$1.hash.hash(token);
+  if (!result.success) {
+    return err(
+      HaiIamError.REPOSITORY_ERROR,
+      iamM("iam_hashResetTokenFailed", { params: { message: result.error.message } }),
+      result.error
+    );
+  }
+  return ok(result.data);
+}
+var RESET_TOKEN_KEY_PREFIX = "hai:iam:reset:";
+var RESET_ATTEMPTS_KEY_PREFIX = "hai:iam:reset:attempts:";
+function buildResetTokenKey(hashedToken) {
+  return `${RESET_TOKEN_KEY_PREFIX}${hashedToken}`;
+}
+function buildAttemptsKey(userId) {
+  return `${RESET_ATTEMPTS_KEY_PREFIX}${userId}`;
+}
+var resetTokenRepoInstance = null;
+function resetResetTokenRepoSingleton() {
+  resetTokenRepoInstance = null;
+}
+function createCacheResetTokenRepository() {
+  if (resetTokenRepoInstance)
+    return resetTokenRepoInstance;
+  const repo = {
+    async saveToken(token, userId, expiresAt) {
+      const hashResult = hashResetToken(token);
+      if (!hashResult.success) {
+        return hashResult;
+      }
+      const hashedToken = hashResult.data;
+      const ttlSeconds = Math.max(1, Math.ceil((expiresAt.getTime() - Date.now()) / 1e3));
+      const setResult = await cache.kv.set(buildResetTokenKey(hashedToken), userId, { ex: ttlSeconds });
+      if (!setResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_saveResetTokenFailed", { params: { message: setResult.error.message } }),
+          setResult.error
+        );
+      }
+      const attemptsResult = await cache.kv.set(buildAttemptsKey(userId), 0, { ex: ttlSeconds });
+      if (!attemptsResult.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_saveResetTokenFailed", { params: { message: attemptsResult.error.message } }),
+          attemptsResult.error
+        );
+      }
+      return ok(void 0);
+    },
+    async tryGetUserByToken(token, maxAttempts) {
+      const hashResult = hashResetToken(token);
+      if (!hashResult.success) {
+        return hashResult;
+      }
+      const hashedToken = hashResult.data;
+      const tokenKey = buildResetTokenKey(hashedToken);
+      const result = await cache.kv.get(tokenKey);
+      if (!result.success) {
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_queryResetTokenFailed", { params: { message: result.error.message } }),
+          result.error
+        );
+      }
+      if (!result.data) {
+        return err(
+          HaiIamError.RESET_TOKEN_INVALID,
+          iamM("iam_resetTokenInvalid")
+        );
+      }
+      const userId = result.data;
+      const attemptsKey = buildAttemptsKey(userId);
+      const incrResult = await cache.kv.incr(attemptsKey);
+      const nextAttempts = incrResult.success ? incrResult.data : 1;
+      if (nextAttempts > maxAttempts) {
+        await cache.kv.del(tokenKey);
+        await cache.kv.del(attemptsKey);
+        return err(
+          HaiIamError.RESET_TOKEN_MAX_ATTEMPTS,
+          iamM("iam_resetTokenMaxAttempts")
+        );
+      }
+      return ok(userId);
+    },
+    async removeToken(token) {
+      const hashResult = hashResetToken(token);
+      if (!hashResult.success) {
+        return hashResult;
+      }
+      const hashedToken = hashResult.data;
+      const tokenKey = buildResetTokenKey(hashedToken);
+      const result = await cache.kv.get(tokenKey);
+      if (result.success && result.data) {
+        await cache.kv.del(buildAttemptsKey(result.data));
+      }
+      await cache.kv.del(tokenKey);
+      return ok(void 0);
+    }
+  };
+  resetTokenRepoInstance = repo;
+  return repo;
+}
+
+// src/user/iam-user-functions.ts
+var logger9 = core.logger.child({ module: "iam", scope: "user" });
+async function createUserOperations(deps) {
+  try {
+    const { config, passwordStrategyResult, sessionFunctions, authzFunctions, onPasswordResetRequest } = deps;
+    const userRepository = await createDbUserRepository();
+    const resetTokenRepository = createCacheResetTokenRepository();
+    const functions = buildUserFunctions({
+      userRepository,
+      resetTokenRepository,
+      passwordStrategyResult,
+      sessionFunctions,
+      authzFunctions,
+      config,
+      onPasswordResetRequest
+    });
+    logger9.info("User sub-feature initialized");
+    return ok(functions);
+  } catch (error) {
+    logger9.error("User sub-feature initialization failed", { error });
+    return err(
+      HaiIamError.CONFIG_ERROR,
+      iamM("iam_initComponentFailed"),
+      error
+    );
+  }
+}
+function hasUpdateFields(data) {
+  return Object.values(data).some((value) => value !== void 0);
+}
+function mapRepositoryError(messageKey, message) {
+  return err(
+    HaiIamError.REPOSITORY_ERROR,
+    iamM(messageKey, { params: { message } })
+  );
+}
+function mapUpdateErrorAsDomainError(message) {
+  const loweredMessage = message.toLowerCase();
+  if (loweredMessage.includes("unique") || loweredMessage.includes("duplicate")) {
+    return err(
+      HaiIamError.USER_ALREADY_EXISTS,
+      iamM("iam_userAlreadyExist")
+    );
+  }
+  return mapRepositoryError("iam_updateUserFailed", message);
+}
+async function validateUniqueFieldsForUpdate(userRepository, userId, data) {
+  const currentResult = await userRepository.findById(userId);
+  if (!currentResult.success) {
+    return mapRepositoryError("iam_queryUserFailed", currentResult.error.message);
+  }
+  if (!currentResult.data) {
+    return err(
+      HaiIamError.USER_NOT_FOUND,
+      iamM("iam_userNotExist")
+    );
+  }
+  if (data.username && data.username !== currentResult.data.username) {
+    const usernameExistsResult = await userRepository.existsByUsername(data.username);
+    if (!usernameExistsResult.success) {
+      return mapRepositoryError("iam_queryUserFailed", usernameExistsResult.error.message);
+    }
+    if (usernameExistsResult.data) {
+      return err(
+        HaiIamError.USER_ALREADY_EXISTS,
+        iamM("iam_usernameAlreadyExist")
+      );
+    }
+  }
+  if (data.email && data.email !== currentResult.data.email) {
+    const emailExistsResult = await userRepository.existsByEmail(data.email);
+    if (!emailExistsResult.success) {
+      return mapRepositoryError("iam_queryUserFailed", emailExistsResult.error.message);
+    }
+    if (emailExistsResult.data) {
+      return err(
+        HaiIamError.USER_ALREADY_EXISTS,
+        iamM("iam_emailAlreadyUsed")
+      );
+    }
+  }
+  return ok(void 0);
+}
+function buildRegistrationOps(ctx) {
+  const { userRepository, authzFunctions, config, registerConfig, agreementConfig } = ctx;
+  const { validatePassword, hashPassword } = ctx;
+  async function validateRegisterPreconditions(options) {
+    if (!registerConfig.enabled) {
+      return err(
+        HaiIamError.REGISTER_DISABLED,
+        iamM("iam_registerDisabled")
+      );
+    }
+    const validateResult = validatePassword(options.password);
+    if (!validateResult.success)
+      return validateResult;
+    const existsResult = await userRepository.existsByUsername(options.username);
+    if (existsResult.success && existsResult.data) {
+      return err(
+        HaiIamError.USER_ALREADY_EXISTS,
+        iamM("iam_usernameAlreadyExist")
+      );
+    }
+    if (options.email) {
+      const emailExistsResult = await userRepository.existsByEmail(options.email);
+      if (emailExistsResult.success && emailExistsResult.data) {
+        return err(
+          HaiIamError.USER_ALREADY_EXISTS,
+          iamM("iam_emailAlreadyUsed")
+        );
+      }
+    }
+    return ok(void 0);
+  }
+  function buildAgreementDisplay() {
+    if (!agreementConfig.showOnRegister)
+      return void 0;
+    if (!agreementConfig.userAgreementUrl && !agreementConfig.privacyPolicyUrl)
+      return void 0;
+    return {
+      userAgreementUrl: agreementConfig.userAgreementUrl,
+      privacyPolicyUrl: agreementConfig.privacyPolicyUrl,
+      showOnRegister: agreementConfig.showOnRegister,
+      showOnLogin: agreementConfig.showOnLogin
+    };
+  }
+  async function assignDefaultRole(userId) {
+    if (!config.rbac?.defaultRole)
+      return;
+    const roleResult = await authzFunctions.getRoleByCode(config.rbac.defaultRole);
+    if (roleResult.success && roleResult.data) {
+      await authzFunctions.assignRole(userId, roleResult.data.id);
+    }
+  }
+  return {
+    async register(options) {
+      const preResult = await validateRegisterPreconditions(options);
+      if (!preResult.success)
+        return preResult;
+      const hashResult = hashPassword(options.password);
+      if (!hashResult.success)
+        return hashResult;
+      const txResult = await reldb.tx.begin();
+      if (!txResult.success) {
+        return mapRepositoryError("iam_createUserFailed", txResult.error.message);
+      }
+      const tx = txResult.data;
+      const createResult = await userRepository.create({
+        username: options.username,
+        email: options.email,
+        phone: options.phone,
+        displayName: options.displayName,
+        enabled: registerConfig.defaultEnabled,
+        emailVerified: false,
+        phoneVerified: false,
+        passwordHash: hashResult.data,
+        passwordUpdatedAt: /* @__PURE__ */ new Date(),
+        metadata: options.metadata
+      }, tx);
+      if (!createResult.success) {
+        await tx.rollback();
+        return mapUpdateErrorAsDomainError(createResult.error.message);
+      }
+      const createdUserResult = await userRepository.findByUsername(options.username, tx);
+      if (!createdUserResult.success || !createdUserResult.data) {
+        await tx.rollback();
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      const commitResult = await tx.commit();
+      if (!commitResult.success) {
+        return mapRepositoryError("iam_createUserFailed", commitResult.error.message);
+      }
+      const createdUser = createdUserResult.data;
+      await assignDefaultRole(createdUser.id);
+      logger9.info("User registered", { userId: createdUser.id, username: options.username });
+      return ok({
+        user: toUser(createdUser),
+        agreements: buildAgreementDisplay()
+      });
+    },
+    validatePassword(password) {
+      return validatePassword(password);
+    }
+  };
+}
+function buildUserQueryOps(ctx) {
+  const { userRepository, sessionFunctions, authzFunctions } = ctx;
+  return {
+    async getCurrentUser(accessToken) {
+      const verifyResult = await sessionFunctions.verifyToken(accessToken);
+      if (!verifyResult.success) {
+        return verifyResult;
+      }
+      const userResult = await userRepository.findById(verifyResult.data.userId);
+      if (!userResult.success) {
+        return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
+      }
+      if (!userResult.data) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      return ok(toUser(userResult.data));
+    },
+    async getUser(userId, options) {
+      const userResult = await userRepository.findById(userId);
+      if (!userResult.success) {
+        return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
+      }
+      if (!userResult.data) {
+        return ok(null);
+      }
+      const user = toUser(userResult.data);
+      if (options?.include?.includes("roles")) {
+        const rolesResult = await authzFunctions.getUserRoles(userId);
+        if (rolesResult.success) {
+          user.roles = rolesResult.data;
+        }
+      }
+      return ok(user);
+    },
+    async listUsers(options) {
+      const conditions = [];
+      const params = [];
+      if (options?.search) {
+        const escaped = options.search.replace(/[%_\\]/g, "\\$&");
+        const keyword = `%${escaped}%`;
+        conditions.push("(username LIKE ? OR email LIKE ? OR phone LIKE ? OR display_name LIKE ?)");
+        params.push(keyword, keyword, keyword, keyword);
+      }
+      if (options?.enabled !== void 0) {
+        conditions.push("enabled = ?");
+        params.push(options.enabled ? 1 : 0);
+      }
+      const where = conditions.length > 0 ? conditions.join(" AND ") : void 0;
+      const usersResult = await userRepository.findPage({
+        where,
+        params: params.length > 0 ? params : void 0,
+        orderBy: "created_at DESC",
+        pagination: options ? { page: options.page, pageSize: options.pageSize } : void 0
+      });
+      if (!usersResult.success) {
+        return mapRepositoryError("iam_queryUserListFailed", usersResult.error.message);
+      }
+      const items = usersResult.data.items.map(toUser);
+      if (options?.include?.includes("roles") && items.length > 0) {
+        const userIds = items.map((u) => u.id);
+        const rolesMapResult = await authzFunctions.getUserRolesForMany(userIds);
+        if (rolesMapResult.success) {
+          for (const user of items) {
+            user.roles = rolesMapResult.data.get(user.id) ?? [];
+          }
+        }
+      }
+      return ok({
+        items,
+        total: usersResult.data.total,
+        page: usersResult.data.page,
+        pageSize: usersResult.data.pageSize
+      });
+    }
+  };
+}
+function buildUserMutationOps(ctx) {
+  const { userRepository, sessionFunctions, authzFunctions } = ctx;
+  return {
+    async updateCurrentUser(accessToken, data) {
+      const verifyResult = await sessionFunctions.verifyToken(accessToken);
+      if (!verifyResult.success) {
+        return verifyResult;
+      }
+      const userId = verifyResult.data.userId;
+      const safeData = {};
+      if (data.username !== void 0)
+        safeData.username = data.username;
+      if (data.email !== void 0)
+        safeData.email = data.email;
+      if (data.displayName !== void 0)
+        safeData.displayName = data.displayName;
+      if (data.avatarUrl !== void 0)
+        safeData.avatarUrl = data.avatarUrl;
+      if (data.phone !== void 0)
+        safeData.phone = data.phone;
+      if (data.metadata !== void 0)
+        safeData.metadata = data.metadata;
+      if (!hasUpdateFields(safeData)) {
+        const currentResult = await userRepository.findById(userId);
+        if (!currentResult.success) {
+          return mapRepositoryError("iam_queryUserFailed", currentResult.error.message);
+        }
+        if (!currentResult.data) {
+          return err(
+            HaiIamError.USER_NOT_FOUND,
+            iamM("iam_userNotExist")
+          );
+        }
+        return ok(toUser(currentResult.data));
+      }
+      const uniqueResult = await validateUniqueFieldsForUpdate(userRepository, userId, safeData);
+      if (!uniqueResult.success) {
+        return uniqueResult;
+      }
+      const updateResult = await userRepository.updateById(userId, safeData);
+      if (!updateResult.success) {
+        return mapUpdateErrorAsDomainError(updateResult.error.message);
+      }
+      if (updateResult.data.changes === 0) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      const updatedResult = await userRepository.findById(userId);
+      if (!updatedResult.success) {
+        return mapRepositoryError("iam_queryUserFailed", updatedResult.error.message);
+      }
+      if (!updatedResult.data) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      return ok(toUser(updatedResult.data));
+    },
+    async updateUser(userId, data) {
+      if (!hasUpdateFields(data)) {
+        const currentResult = await userRepository.findById(userId);
+        if (!currentResult.success) {
+          return mapRepositoryError("iam_queryUserFailed", currentResult.error.message);
+        }
+        if (!currentResult.data) {
+          return err(
+            HaiIamError.USER_NOT_FOUND,
+            iamM("iam_userNotExist")
+          );
+        }
+        return ok(toUser(currentResult.data));
+      }
+      const uniqueResult = await validateUniqueFieldsForUpdate(userRepository, userId, data);
+      if (!uniqueResult.success) {
+        return uniqueResult;
+      }
+      const updateResult = await userRepository.updateById(userId, data);
+      if (!updateResult.success) {
+        return mapUpdateErrorAsDomainError(updateResult.error.message);
+      }
+      if (updateResult.data.changes === 0) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      if (data.enabled === false) {
+        await sessionFunctions.deleteByUserId(userId);
+      }
+      const updatedResult = await userRepository.findById(userId);
+      if (!updatedResult.success) {
+        return mapRepositoryError("iam_queryUserFailed", updatedResult.error.message);
+      }
+      if (!updatedResult.data) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      return ok(toUser(updatedResult.data));
+    },
+    async deleteUser(userId) {
+      logger9.debug("Deleting user", { userId });
+      const userResult = await userRepository.findById(userId);
+      if (!userResult.success) {
+        return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
+      }
+      if (!userResult.data) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      const txResult = await reldb.tx.begin();
+      if (!txResult.success) {
+        return mapRepositoryError("iam_deleteUserFailed", txResult.error.message);
+      }
+      const tx = txResult.data;
+      try {
+        const syncResult = await authzFunctions.syncRoles(userId, [], tx);
+        if (!syncResult.success) {
+          await tx.rollback();
+          return mapRepositoryError("iam_deleteUserFailed", syncResult.error.message);
+        }
+        const deleteResult = await userRepository.deleteById(userId, tx);
+        if (!deleteResult.success) {
+          await tx.rollback();
+          return mapRepositoryError("iam_deleteUserFailed", deleteResult.error.message);
+        }
+        const commitResult = await tx.commit();
+        if (!commitResult.success) {
+          return mapRepositoryError("iam_deleteUserFailed", commitResult.error.message);
+        }
+      } catch (error) {
+        await tx.rollback();
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_deleteUserFailed", { params: { message: String(error) } }),
+          error
+        );
+      }
+      await sessionFunctions.deleteByUserId(userId);
+      logger9.info("User deleted", { userId });
+      return ok(void 0);
+    }
+  };
+}
+function buildPasswordChangeOps(ctx) {
+  const { userRepository, sessionFunctions } = ctx;
+  const { validatePassword, hashPassword } = ctx;
+  return {
+    async adminResetPassword(userId, newPassword) {
+      logger9.debug("Admin resetting user password", { userId });
+      const userResult = await userRepository.findById(userId);
+      if (!userResult.success) {
+        return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
+      }
+      if (!userResult.data) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      const validateResult = validatePassword(newPassword);
+      if (!validateResult.success)
+        return validateResult;
+      const hashResult = hashPassword(newPassword);
+      if (!hashResult.success)
+        return hashResult;
+      const updateResult = await userRepository.updateById(userId, {
+        passwordHash: hashResult.data,
+        passwordUpdatedAt: /* @__PURE__ */ new Date()
+      });
+      if (!updateResult.success) {
+        return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
+      }
+      await sessionFunctions.deleteByUserId(userId);
+      logger9.info("Admin reset password", { userId });
+      return ok(void 0);
+    },
+    async changePassword(userId, oldPassword, newPassword) {
+      const userResult = await userRepository.findById(userId);
+      if (!userResult.success) {
+        return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
+      }
+      if (!userResult.data) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      const user = userResult.data;
+      if (!user.passwordHash) {
+        return err(
+          HaiIamError.INVALID_CREDENTIALS,
+          iamM("iam_accountNoPassword")
+        );
+      }
+      const verifyResult = crypto$1.password.verify(oldPassword, user.passwordHash);
+      if (!verifyResult.success || !verifyResult.data) {
+        return err(
+          HaiIamError.INVALID_CREDENTIALS,
+          iamM("iam_originalPasswordWrong")
+        );
+      }
+      const validateResult = validatePassword(newPassword);
+      if (!validateResult.success)
+        return validateResult;
+      const hashResult = hashPassword(newPassword);
+      if (!hashResult.success)
+        return hashResult;
+      const updateResult = await userRepository.updateById(userId, {
+        passwordHash: hashResult.data,
+        passwordUpdatedAt: /* @__PURE__ */ new Date()
+      });
+      if (!updateResult.success) {
+        return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
+      }
+      await sessionFunctions.deleteByUserId(userId);
+      logger9.info("Password changed", { userId });
+      return ok(void 0);
+    },
+    /**
+     * 通过访问令牌定位当前用户并执行改密。
+     *
+     * @param accessToken 访问令牌
+     * @param oldPassword 原密码
+     * @param newPassword 新密码
+     * @returns 改密执行结果
+     */
+    async changeCurrentUserPassword(accessToken, oldPassword, newPassword) {
+      const verifyResult = await sessionFunctions.verifyToken(accessToken);
+      if (!verifyResult.success) {
+        return verifyResult;
+      }
+      return this.changePassword(verifyResult.data.userId, oldPassword, newPassword);
+    }
+  };
+}
+function buildPasswordResetOps(ctx) {
+  const { userRepository, resetTokenRepository, sessionFunctions, config, onPasswordResetRequest } = ctx;
+  const { validatePassword, hashPassword } = ctx;
+  return {
+    async requestPasswordReset(identifier) {
+      logger9.debug("Password reset requested", { identifier });
+      const resetConfig = PasswordResetConfigSchema.parse(config.passwordReset ?? {});
+      const userResult = await userRepository.findByIdentifier(identifier);
+      if (!userResult.success) {
+        logger9.warn("Failed to look up user for password reset", { identifier });
+        return ok(void 0);
+      }
+      if (!userResult.data) {
+        logger9.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
+        return ok(void 0);
+      }
+      const user = toUser(userResult.data);
+      const token = globalThis.crypto.randomUUID();
+      const expiresAt = new Date(Date.now() + resetConfig.tokenExpiresIn * 1e3);
+      const saveResult = await resetTokenRepository.saveToken(token, user.id, expiresAt);
+      if (!saveResult.success) {
+        return saveResult;
+      }
+      if (onPasswordResetRequest) {
+        try {
+          await onPasswordResetRequest(user, token, expiresAt);
+        } catch (callbackError) {
+          logger9.error("Password reset callback failed", { userId: user.id, error: callbackError });
+        }
+      } else {
+        logger9.warn("No password reset callback configured, token will not be delivered to user", { userId: user.id });
+      }
+      logger9.info("Password reset token generated", { userId: user.id });
+      return ok(void 0);
+    },
+    async confirmPasswordReset(token, newPassword) {
+      logger9.debug("Confirming password reset");
+      const resetConfig = PasswordResetConfigSchema.parse(config.passwordReset ?? {});
+      const validateResult = validatePassword(newPassword);
+      if (!validateResult.success)
+        return validateResult;
+      const tokenResult = await resetTokenRepository.tryGetUserByToken(token, resetConfig.maxAttempts);
+      if (!tokenResult.success) {
+        return tokenResult;
+      }
+      const userId = tokenResult.data;
+      const userResult = await userRepository.findById(userId);
+      if (!userResult.success) {
+        return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
+      }
+      if (!userResult.data) {
+        return err(
+          HaiIamError.USER_NOT_FOUND,
+          iamM("iam_userNotExist")
+        );
+      }
+      const hashResult = hashPassword(newPassword);
+      if (!hashResult.success)
+        return hashResult;
+      const updateResult = await userRepository.updateById(userId, {
+        passwordHash: hashResult.data,
+        passwordUpdatedAt: /* @__PURE__ */ new Date()
+      });
+      if (!updateResult.success) {
+        return mapRepositoryError("iam_updateUserFailed", updateResult.error.message);
+      }
+      await resetTokenRepository.removeToken(token);
+      await sessionFunctions.deleteByUserId(userId);
+      logger9.info("Password reset confirmed", { userId });
+      return ok(void 0);
+    }
+  };
+}
+function buildUserFunctions(deps) {
+  const { validatePassword, hashPassword } = deps.passwordStrategyResult;
+  const ctx = {
+    ...deps,
+    validatePassword,
+    hashPassword,
+    registerConfig: RegisterConfigSchema.parse(deps.config.register ?? {}),
+    agreementConfig: AgreementConfigSchema.parse(deps.config.agreements ?? {})
+  };
+  return {
+    ...buildRegistrationOps(ctx),
+    ...buildUserQueryOps(ctx),
+    ...buildUserMutationOps(ctx),
+    ...buildPasswordChangeOps(ctx),
+    ...buildPasswordResetOps(ctx)
+  };
+}
+
+// src/iam-main.ts
+var logger10 = core.logger.child({ module: "iam", scope: "main" });
+var initInProgress = false;
+var currentConfig = null;
+var currentAuth = null;
+var currentUser = null;
+var currentAuthz = null;
+var currentSession = null;
+var currentApiKey = null;
+var notInitialized = core.module.createNotInitializedKit(
+  HaiIamError.NOT_INITIALIZED,
+  () => iamM("iam_notInitialized")
+);
+var notInitializedAuth = notInitialized.proxy();
+var notInitializedAuthz = notInitialized.proxy();
+var notInitializedSession = notInitialized.proxy();
+var notInitializedApiKey = notInitialized.proxy();
+var syncUserProxy = notInitialized.proxy("sync");
+var asyncUserProxy = notInitialized.proxy();
+var notInitializedUser = new Proxy({}, {
+  get(_, prop, receiver) {
+    return prop === "validatePassword" ? Reflect.get(syncUserProxy, prop, receiver) : Reflect.get(asyncUserProxy, prop, receiver);
+  }
+});
+var iam = {
+  async init(config) {
+    if (initInProgress) {
+      logger10.warn("IAM init already in progress, skipping concurrent call");
+      return err(
+        HaiIamError.CONFIG_ERROR,
+        iamM("iam_initInProgress")
+      );
+    }
+    initInProgress = true;
+    try {
+      if (currentConfig !== null) {
+        logger10.warn("IAM module is already initialized, reinitializing");
+        await iam.close();
+      }
+      const { ldapClientFactory, ldapSyncUser, onPasswordResetRequest, onOtpSendEmail, onOtpSendSms, ...settingsInput } = config;
+      logger10.info("Initializing IAM module");
+      if (!reldb.isInitialized) {
+        return err(
+          HaiIamError.CONFIG_ERROR,
+          iamM("iam_depsNotInitialized", { params: { dep: "reldb" } })
+        );
+      }
+      if (!cache.isInitialized) {
+        return err(
+          HaiIamError.CONFIG_ERROR,
+          iamM("iam_depsNotInitialized", { params: { dep: "cache" } })
+        );
+      }
+      if (!crypto$1.isInitialized) {
+        const cryptoResult = await crypto$1.init();
+        if (!cryptoResult.success) {
+          return err(
+            HaiIamError.CONFIG_ERROR,
+            iamM("iam_initFailed"),
+            cryptoResult.error
+          );
+        }
+      }
+      const parseResult = IamConfigSchema.safeParse(settingsInput);
+      if (!parseResult.success) {
+        logger10.error("IAM config validation failed", { error: parseResult.error.message });
+        return err(
+          HaiIamError.CONFIG_ERROR,
+          iamM("iam_configError", { params: { error: parseResult.error.message } }),
+          parseResult.error
+        );
+      }
+      const parsed = parseResult.data;
+      const sessionResult = await createSessionOperations({ config: parsed });
+      if (!sessionResult.success) {
+        return sessionResult;
+      }
+      const authzResult = await createAuthzOperations({ config: parsed, session: sessionResult.data });
+      if (!authzResult.success) {
+        return authzResult;
+      }
+      const authnResult = await createAuthnOperations({
+        config: parsed,
+        sessionFunctions: sessionResult.data,
+        authzFunctions: authzResult.data,
+        ldapClientFactory,
+        ldapSyncUser,
+        onOtpSendEmail,
+        onOtpSendSms
+      });
+      if (!authnResult.success) {
+        return authnResult;
+      }
+      const userResult = await createUserOperations({
+        config: parsed,
+        passwordStrategyResult: authnResult.data.passwordStrategyResult,
+        sessionFunctions: sessionResult.data,
+        authzFunctions: authzResult.data,
+        onPasswordResetRequest
+      });
+      if (!userResult.success) {
+        return userResult;
+      }
+      if (parsed.seedDefaultData) {
+        const seedResult = await seedIamData(authzResult.data);
+        if (!seedResult.success) {
+          return seedResult;
+        }
+      }
+      currentSession = sessionResult.data;
+      currentAuthz = authzResult.data;
+      currentUser = userResult.data;
+      currentConfig = parsed;
+      currentApiKey = authnResult.data.apiKeyFunctions;
+      const authn = authnResult.data.authn;
+      currentAuth = {
+        ...authn,
+        async registerAndLogin(options) {
+          const regResult = await currentUser.register(options);
+          if (!regResult.success) {
+            return regResult;
+          }
+          return authn.login({ identifier: options.username, password: options.password });
+        }
+      };
+      logger10.info("IAM module initialized");
+      return ok(void 0);
+    } catch (error) {
+      logger10.error("IAM module initialization failed", { error });
+      return err(
+        HaiIamError.CONFIG_ERROR,
+        iamM("iam_initFailed"),
+        error
+      );
+    } finally {
+      initInProgress = false;
+    }
+  },
+  get auth() {
+    return currentAuth ?? notInitializedAuth;
+  },
+  get user() {
+    return currentUser ?? notInitializedUser;
+  },
+  get authz() {
+    return currentAuthz ?? notInitializedAuthz;
+  },
+  get session() {
+    return currentSession ?? notInitializedSession;
+  },
+  get apiKey() {
+    return currentApiKey ?? notInitializedApiKey;
+  },
+  get config() {
+    return currentConfig;
+  },
+  get isInitialized() {
+    return currentConfig !== null;
+  },
+  get isRegisterEnabled() {
+    return currentConfig?.register?.enabled !== false;
+  },
+  async close() {
+    if (currentConfig === null && currentAuth === null && currentUser === null && currentAuthz === null && currentSession === null) {
+      logger10.info("IAM module already closed, skipping");
+      return;
+    }
+    logger10.info("Closing IAM module");
+    currentAuth = null;
+    currentUser = null;
+    currentAuthz = null;
+    currentSession = null;
+    currentApiKey = null;
+    currentConfig = null;
+    resetApiKeyRepoSingleton();
+    resetOtpRepoSingleton();
+    resetUserRepoSingleton();
+    resetResetTokenRepoSingleton();
+    resetRoleRepoSingleton();
+    resetPermissionRepoSingleton();
+    logger10.info("IAM module closed");
+  }
+};
+
+export { AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema, iam };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map