@h-ai/iam 1.0.0-beta.2 → 1.0.0-beta.20

package/dist/index.js

@@ -1,9 +1,9 @@
-import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-VR7JW2EW.js';
-export { AccountConfigSchema, AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, CaptchaConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginAccessConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-VR7JW2EW.js';
+import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-PDPLBMGN.js';
+export { AccountConfigSchema, AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, CaptchaConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginAccessConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-PDPLBMGN.js';
 import { cache } from '@h-ai/cache';
 import { core, err, ok } from '@h-ai/core';
 import { crypto as crypto$1 } from '@h-ai/crypto';
-import { migrateSchema, reldb, schemaColumns, BaseReldbCrudRepository, HaiReldbError } from '@h-ai/reldb';
+import { reldb, BaseReldbCrudRepository, HaiReldbError } from '@h-ai/reldb';
 import { randomUUID, createHash, randomBytes, randomInt } from 'crypto';
 import { verifySolution, pbkdf2, createChallenge } from 'altcha/lib';
 import { z } from 'zod';
@@ -654,7 +654,10 @@ async function revision() {
     return current;
   if (current.data)
     return ok(current.data);
-  const created = await cache.kv.set(revisionKey, { epoch: randomUUID(), writers: 0 }, { nx: true });
+  const created = await cache.kv.set(revisionKey, {
+    epoch: randomUUID(),
+    writers: 0
+  }, { nx: true });
   if (!created.success)
     return created;
   const loaded = await cache.kv.get(revisionKey);
@@ -665,7 +668,10 @@ async function change(delta) {
     const current = await revision();
     if (!current.success)
       return current;
-    const written = await cache.kv.compareAndSwap(revisionKey, current.data, { epoch: randomUUID(), writers: Math.max(0, current.data.writers + delta) });
+    const written = await cache.kv.compareAndSwap(revisionKey, current.data, {
+      epoch: randomUUID(),
+      writers: Math.max(0, current.data.writers + delta)
+    });
     if (!written.success)
       return written;
     if (written.data)
@@ -873,7 +879,9 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
-        iamM("iam_apikeyCreateFailed", { params: { message: result.error.message } }),
+        iamM("iam_apikeyCreateFailed", {
+          params: { message: result.error.message }
+        }),
         result.error
       );
     }
@@ -887,7 +895,10 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     return ok(result.data);
   }
   async findByKeyPrefix(prefix2, tx) {
-    const result = await this.findAll({ where: "key_prefix = ?", params: [prefix2] }, tx);
+    const result = await this.findAll({
+      where: "key_prefix = ?",
+      params: [prefix2]
+    }, tx);
     if (!result.success) {
       return this.buildQueryError(result.error);
     }
@@ -920,7 +931,10 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     return result;
   }
   async countByUserId(userId, tx) {
-    const result = await this.count({ where: "user_id = ?", params: [userId] }, tx);
+    const result = await this.count({
+      where: "user_id = ?",
+      params: [userId]
+    }, tx);
     if (!result.success) {
       return this.buildQueryError(result.error);
     }
@@ -931,7 +945,9 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
-        iamM("iam_apikeyUpdateFailed", { params: { message: result.error.message } }),
+        iamM("iam_apikeyUpdateFailed", {
+          params: { message: result.error.message }
+        }),
         result.error
       );
     }
@@ -942,7 +958,9 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
-        iamM("iam_apikeyDeleteFailed", { params: { message: result.error.message } }),
+        iamM("iam_apikeyDeleteFailed", {
+          params: { message: result.error.message }
+        }),
         result.error
       );
     }
@@ -951,7 +969,9 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
   buildQueryError(error) {
     return err(
       HaiIamError.REPOSITORY_ERROR,
-      iamM("iam_apikeyQueryFailed", { params: { message: error.message } }),
+      iamM("iam_apikeyQueryFailed", {
+        params: { message: error.message }
+      }),
       error
     );
   }
@@ -1016,7 +1036,10 @@ function buildSession(options, now, sessionTtl, accessToken, credentialVersion)
 function applySessionPatch(session, patch) {
   const nextSession = { ...session };
   if (patch.data !== void 0) {
-    nextSession.data = { ...nextSession.data, ...patch.data };
+    nextSession.data = {
+      ...nextSession.data,
+      ...patch.data
+    };
   }
   if (patch.roles !== void 0) {
     nextSession.roles = patch.roles;
@@ -1140,16 +1163,86 @@ function toUser(storedUser) {
 // src/user/iam-user-repository-user.ts
 var TABLE_NAME2 = "hai_iam_users";
 var USER_FIELDS = [
-  { fieldName: "mustChangePassword", columnName: "must_change_password", def: { type: "BOOLEAN", notNull: true, defaultValue: false }, select: true, create: true, update: false },
-  { fieldName: "accountType", columnName: "account_type", def: { type: "TEXT", notNull: true, defaultValue: "permanent" }, select: true, create: true, update: true },
-  { fieldName: "accountStatus", columnName: "account_status", def: { type: "TEXT", notNull: true, defaultValue: "active" }, select: true, create: true, update: true },
-  { fieldName: "accountExpiresAt", columnName: "account_expires_at", def: { type: "TIMESTAMP" }, select: true, create: true, update: true },
-  { fieldName: "lastLoginAt", columnName: "last_login_at", def: { type: "TIMESTAMP" }, select: true, create: false, update: false },
-  { fieldName: "credentialVersion", columnName: "credential_version", def: { type: "TEXT", notNull: true, defaultValue: "" }, select: true, create: false, update: false },
-  { fieldName: "resetVersion", columnName: "reset_version", def: { type: "TEXT", notNull: true, defaultValue: "" }, select: true, create: false, update: false },
-  { fieldName: "resetHash", columnName: "reset_hash", def: { type: "TEXT" }, select: true, create: false, update: false },
-  { fieldName: "resetExpiresAt", columnName: "reset_expires_at", def: { type: "BIGINT" }, select: true, create: false, update: false },
-  { fieldName: "resetAttempts", columnName: "reset_attempts", def: { type: "INTEGER", notNull: true, defaultValue: 0 }, select: true, create: false, update: false },
+  {
+    fieldName: "mustChangePassword",
+    columnName: "must_change_password",
+    def: { type: "BOOLEAN", notNull: true, defaultValue: false },
+    select: true,
+    create: true,
+    update: false
+  },
+  {
+    fieldName: "accountType",
+    columnName: "account_type",
+    def: { type: "TEXT", notNull: true, defaultValue: "permanent" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "accountStatus",
+    columnName: "account_status",
+    def: { type: "TEXT", notNull: true, defaultValue: "active" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "accountExpiresAt",
+    columnName: "account_expires_at",
+    def: { type: "TIMESTAMP" },
+    select: true,
+    create: true,
+    update: true
+  },
+  {
+    fieldName: "lastLoginAt",
+    columnName: "last_login_at",
+    def: { type: "TIMESTAMP" },
+    select: true,
+    create: false,
+    update: false
+  },
+  {
+    fieldName: "credentialVersion",
+    columnName: "credential_version",
+    def: { type: "TEXT", notNull: true, defaultValue: "" },
+    select: true,
+    create: false,
+    update: false
+  },
+  {
+    fieldName: "resetVersion",
+    columnName: "reset_version",
+    def: { type: "TEXT", notNull: true, defaultValue: "" },
+    select: true,
+    create: false,
+    update: false
+  },
+  {
+    fieldName: "resetHash",
+    columnName: "reset_hash",
+    def: { type: "TEXT" },
+    select: true,
+    create: false,
+    update: false
+  },
+  {
+    fieldName: "resetExpiresAt",
+    columnName: "reset_expires_at",
+    def: { type: "BIGINT" },
+    select: true,
+    create: false,
+    update: false
+  },
+  {
+    fieldName: "resetAttempts",
+    columnName: "reset_attempts",
+    def: { type: "INTEGER", notNull: true, defaultValue: 0 },
+    select: true,
+    create: false,
+    update: false
+  },
   {
     fieldName: "id",
     columnName: "id",
@@ -1324,13 +1417,22 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
     return "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)";
   }
   async recordSuccessfulLogin(userId) {
-    const result = await reldb.sql.execute(`UPDATE ${TABLE_NAME2} SET last_login_at = ? WHERE id = ?`, [reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), userId]);
+    const result = await reldb.sql.execute(`UPDATE ${TABLE_NAME2} SET last_login_at = ? WHERE id = ?`, [
+      reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(),
+      userId
+    ]);
     return result.success ? ok(void 0) : this.buildQueryError(result.error, result.error);
   }
   async suspendInactive(cutoff) {
     const result = await reldb.sql.execute(
       `UPDATE ${TABLE_NAME2} SET account_status = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL WHERE account_status = ? AND COALESCE(last_login_at, created_at) <= ?`,
-      ["dormant", crypto.randomUUID(), crypto.randomUUID(), "active", reldb.config?.type === "sqlite" ? cutoff.getTime() : cutoff]
+      [
+        "dormant",
+        crypto.randomUUID(),
+        crypto.randomUUID(),
+        "active",
+        reldb.config?.type === "sqlite" ? cutoff.getTime() : cutoff
+      ]
     );
     return result.success ? ok(result.data.changes) : this.buildQueryError(result.error, result.error);
   }
@@ -1338,7 +1440,15 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
   async setPassword(input) {
     const result = await reldb.sql.execute(
       `UPDATE ${TABLE_NAME2} SET password_hash = ?, password_updated_at = ?, credential_version = ?, reset_version = ?, must_change_password = ?, reset_hash = NULL, reset_expires_at = NULL, reset_attempts = 0 WHERE id = ? AND credential_version = ?`,
-      [input.passwordHash, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), crypto.randomUUID(), crypto.randomUUID(), reldb.config?.type === "postgresql" ? input.mustChangePassword === true : Number(input.mustChangePassword === true), input.userId, input.expectedVersion]
+      [
+        input.passwordHash,
+        reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(),
+        crypto.randomUUID(),
+        crypto.randomUUID(),
+        reldb.config?.type === "postgresql" ? input.mustChangePassword === true : Number(input.mustChangePassword === true),
+        input.userId,
+        input.expectedVersion
+      ]
     );
     return result.success ? ok(result.data.changes === 1) : this.buildQueryError(result.error, result.error);
   }
@@ -1349,7 +1459,16 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
       return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_resetTokenInvalid"));
     const result = await reldb.sql.execute(
       `UPDATE ${TABLE_NAME2} SET reset_hash = ?, reset_expires_at = ?, reset_attempts = 0, reset_version = ? WHERE id = ? AND credential_version = ? AND reset_version = ? AND account_status = ? AND ? > ${this.databaseNow()}`,
-      [input.tokenHash, expiry, crypto.randomUUID(), input.user.id, input.user.credentialVersion ?? "", input.user.resetVersion ?? "", "active", expiry]
+      [
+        input.tokenHash,
+        expiry,
+        crypto.randomUUID(),
+        input.user.id,
+        input.user.credentialVersion ?? "",
+        input.user.resetVersion ?? "",
+        "active",
+        expiry
+      ]
     );
     return result.success ? ok(result.data.changes === 1) : this.buildQueryError(result.error, result.error);
   }
@@ -1368,7 +1487,15 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
     const version = crypto.randomUUID();
     const result = await reldb.sql.execute(
       `UPDATE ${TABLE_NAME2} SET reset_attempts = reset_attempts + 1, reset_version = ? WHERE id = ? AND reset_hash = ? AND reset_version = ? AND credential_version = ? AND reset_attempts < ? AND reset_expires_at > ${this.databaseNow()} AND account_status = ?`,
-      [version, user.id, tokenHash, user.resetVersion ?? "", user.credentialVersion ?? "", maxAttempts, "active"]
+      [
+        version,
+        user.id,
+        tokenHash,
+        user.resetVersion ?? "",
+        user.credentialVersion ?? "",
+        maxAttempts,
+        "active"
+      ]
     );
     if (!result.success)
       return this.buildQueryError(result.error, result.error);
@@ -1380,7 +1507,17 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
   async commitPasswordReset(input) {
     const result = await reldb.sql.execute(
       `UPDATE ${TABLE_NAME2} SET password_hash = ?, password_updated_at = ?, credential_version = ?, reset_version = ?, must_change_password = FALSE, reset_hash = NULL, reset_expires_at = NULL, reset_attempts = 0, login_failed_count = 0, first_login_failed_at = NULL, locked_until = NULL, last_login_failed_at = NULL WHERE id = ? AND reset_hash = ? AND reset_version = ? AND credential_version = ? AND reset_expires_at > ${this.databaseNow()} AND account_status = ?`,
-      [input.passwordHash, reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(), crypto.randomUUID(), crypto.randomUUID(), input.user.id, input.tokenHash, input.user.resetVersion ?? "", input.user.credentialVersion ?? "", "active"]
+      [
+        input.passwordHash,
+        reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date(),
+        crypto.randomUUID(),
+        crypto.randomUUID(),
+        input.user.id,
+        input.tokenHash,
+        input.user.resetVersion ?? "",
+        input.user.credentialVersion ?? "",
+        "active"
+      ]
     );
     return result.success ? ok(result.data.changes === 1) : this.buildQueryError(result.error, result.error);
   }
@@ -1399,7 +1536,12 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
       return this.buildQueryError(expired.error, expired.error);
     const result = await reldb.sql.execute(
       `UPDATE ${TABLE_NAME2} SET locked_until = CASE WHEN COALESCE(login_failed_count, 0) + 1 >= ? THEN ? ELSE locked_until END, login_failed_count = COALESCE(login_failed_count, 0) + 1, last_login_failed_at = ? WHERE id = ? AND locked_until IS NULL`,
-      [policy.maxLoginAttempts, lockedUntil, now, userId]
+      [
+        policy.maxLoginAttempts,
+        lockedUntil,
+        now,
+        userId
+      ]
     );
     if (!result.success)
       return this.buildQueryError(result.error, result.error);
@@ -1407,8 +1549,9 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
   }
   async resetLoginFailures(userId, expectedCredentialVersion, lockoutEnabled = true) {
     const params = [userId, expectedCredentialVersion, "active"];
-    if (lockoutEnabled)
+    if (lockoutEnabled) {
       params.push(reldb.config?.type === "sqlite" ? Date.now() : /* @__PURE__ */ new Date());
+    }
     const result = await reldb.sql.execute(
       `UPDATE ${TABLE_NAME2} SET login_failed_count = 0, first_login_failed_at = NULL, last_login_failed_at = NULL, locked_until = NULL WHERE id = ? AND credential_version = ? AND account_status = ? ${lockoutEnabled ? "AND (locked_until IS NULL OR locked_until <= ?)" : ""}`,
       params
@@ -1462,7 +1605,9 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
   buildQueryError(error, cause) {
     return err(
       HaiIamError.REPOSITORY_ERROR,
-      iamM("iam_queryUserFailed", { params: { message: error.message } }),
+      iamM("iam_queryUserFailed", {
+        params: { message: error.message }
+      }),
       cause
     );
   }
@@ -1511,7 +1656,11 @@ function applyApiKeyScopes(access, scopes) {
         permissions.add(permission);
     }
   }
-  return { ...access, roles: scopes.includes("*") ? access.roles : [], permissions: [...permissions] };
+  return {
+    ...access,
+    roles: scopes.includes("*") ? access.roles : [],
+    permissions: [...permissions]
+  };
 }
 function rejectMissingPasswordCredentials() {
   const padded = crypto$1.password.hash("dummy-password-to-prevent-timing-leak");
@@ -1586,7 +1735,9 @@ function createApiKeyStrategy(config) {
       if (candidate.expiresAt && /* @__PURE__ */ new Date() >= candidate.expiresAt) {
         return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
       }
-      apiKeyRepository.updateFields(candidate.id, { lastUsedAt: /* @__PURE__ */ new Date() }).catch(() => {
+      apiKeyRepository.updateFields(candidate.id, {
+        lastUsedAt: /* @__PURE__ */ new Date()
+      }).catch(() => {
         logger3.warn("Failed to update API Key lastUsedAt", { keyId: candidate.id });
       });
       return ok(toApiKey(candidate));
@@ -1597,7 +1748,12 @@ function createApiKeyStrategy(config) {
     const fingerprint = createHash("sha256").update(rawKey).digest("hex");
     const result = await readIamCache(`verified_apikey:${fingerprint}`, async () => {
       const verified = await loadRawKey(rawKey);
-      return verified.success ? ok({ ...verified.data, expiresAt: verified.data.expiresAt?.getTime() ?? null, createdAt: verified.data.createdAt.getTime(), lastUsedAt: verified.data.lastUsedAt?.getTime() ?? null }) : verified;
+      return verified.success ? ok({
+        ...verified.data,
+        expiresAt: verified.data.expiresAt?.getTime() ?? null,
+        createdAt: verified.data.createdAt.getTime(),
+        lastUsedAt: verified.data.lastUsedAt?.getTime() ?? null
+      }) : verified;
     });
     if (!result.success)
       return result;
@@ -1605,7 +1761,12 @@ function createApiKeyStrategy(config) {
       return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
     if (result.data.expiresAt !== null && result.data.expiresAt <= Date.now())
       return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
-    return ok({ ...result.data, expiresAt: result.data.expiresAt === null ? null : new Date(result.data.expiresAt), createdAt: new Date(result.data.createdAt), lastUsedAt: result.data.lastUsedAt === null ? null : new Date(result.data.lastUsedAt) });
+    return ok({
+      ...result.data,
+      expiresAt: result.data.expiresAt === null ? null : new Date(result.data.expiresAt),
+      createdAt: new Date(result.data.createdAt),
+      lastUsedAt: result.data.lastUsedAt === null ? null : new Date(result.data.lastUsedAt)
+    });
   }
   const strategy = {
     type: "apikey",
@@ -1632,7 +1793,13 @@ function createApiKeyStrategy(config) {
         return err(HaiIamError.ACCOUNT_UNAVAILABLE, iamM("iam_accountUnavailable"));
       }
       logger3.debug("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
-      return ok({ user: { ...toUser(userResult.data), credentialVersion: userResult.data.credentialVersion ?? "" }, apiKey });
+      return ok({
+        user: {
+          ...toUser(userResult.data),
+          credentialVersion: userResult.data.credentialVersion ?? ""
+        },
+        apiKey
+      });
     }
   };
   const apiKeyFunctions = {
@@ -1642,7 +1809,9 @@ function createApiKeyStrategy(config) {
         if (!countResult.success)
           return countResult;
         if (countResult.data >= apikeyConfig.maxKeysPerUser) {
-          return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_apikeyMaxKeysReached", { params: { max: apikeyConfig.maxKeysPerUser } }));
+          return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_apikeyMaxKeysReached", {
+            params: { max: apikeyConfig.maxKeysPerUser }
+          }));
         }
         const rawKey = generateRawKey(apikeyConfig.prefix);
         const hashResult = passwordOps.hash(rawKey);
@@ -1669,16 +1838,26 @@ function createApiKeyStrategy(config) {
         if (!insertResult.success)
           return insertResult;
         logger3.info("API Key created", { userId, keyId: id, name: options.name });
-        return ok({ apiKey: toApiKey(storedApiKey), rawKey });
+        return ok({
+          apiKey: toApiKey(storedApiKey),
+          rawKey
+        });
       } catch (error) {
-        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_apikeyCreateFailed", { params: { message: String(error) } }), error);
+        return err(HaiIamError.INTERNAL_ERROR, iamM("iam_apikeyCreateFailed", {
+          params: {
+            message: String(error)
+          }
+        }), error);
       }
     },
     async listApiKeys(userId, options) {
       const result = await apiKeyRepository.findPageByUserId(userId, options ?? {});
       if (!result.success)
         return result;
-      return ok({ ...result.data, items: result.data.items.map(toApiKey) });
+      return ok({
+        ...result.data,
+        items: result.data.items.map(toApiKey)
+      });
     },
     async getApiKey(keyId) {
       const result = await apiKeyRepository.findOneById(keyId);
@@ -1708,10 +1887,20 @@ function createLoginAccessCheck(policy) {
 }
 var logger4 = core.logger.child({ module: "iam", scope: "captcha" });
 var prefix = "hai:iam:captcha:";
-var operationSchema = z.enum(["login", "register", "sendOtp", "passwordReset", "renewPassword"]);
+var operationSchema = z.enum([
+  "login",
+  "register",
+  "sendOtp",
+  "passwordReset",
+  "renewPassword"
+]);
 var proofSchema = z.object({
   id: z.string().regex(/^[a-f0-9]{64}$/),
-  solution: z.object({ counter: z.number().int().min(0).max(2e3), derivedKey: z.string().regex(/^[a-f0-9]{64}$/i), time: z.number().finite().nonnegative().optional() })
+  solution: z.object({
+    counter: z.number().int().min(0).max(2e3),
+    derivedKey: z.string().regex(/^[a-f0-9]{64}$/i),
+    time: z.number().finite().nonnegative().optional()
+  })
 });
 async function createIamCaptcha(config, input) {
   if (!config.enabled)
@@ -1732,7 +1921,12 @@ async function createIamCaptcha(config, input) {
       hmacKeySignatureSecret: keySecret,
       data: { operation: operation.data }
     });
-    const record = { operation: operation.data, challenge, signatureSecret, keySecret };
+    const record = {
+      operation: operation.data,
+      challenge,
+      signatureSecret,
+      keySecret
+    };
     const saved = await cache.kv.set(`${prefix}${id}`, record, { nx: true, ex: config.ttlSeconds });
     if (!saved.success || !saved.data)
       return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
@@ -1766,7 +1960,13 @@ async function verifyIamCaptcha(config, operation, proof) {
     if (!found.data || found.data.operation !== operation)
       return err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
     const record = found.data;
-    const result = await verifySolution({ challenge: record.challenge, solution: payload.solution, deriveKey: pbkdf2.deriveKey, hmacSignatureSecret: record.signatureSecret, hmacKeySignatureSecret: record.keySecret });
+    const result = await verifySolution({
+      challenge: record.challenge,
+      solution: payload.solution,
+      deriveKey: pbkdf2.deriveKey,
+      hmacSignatureSecret: record.signatureSecret,
+      hmacKeySignatureSecret: record.keySecret
+    });
     if (!result.verified)
       return err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
     const removed = await cache.kv.del(key);
@@ -1848,7 +2048,12 @@ function createLdapStrategy(config) {
     maxLoginAttempts = 5,
     lockoutDuration = 900
   } = config;
-  const failurePolicy = { maxLoginAttempts, lockoutDuration, lockoutEnabled: config.lockoutEnabled ?? true, failureWindow: config.failureWindow ?? 86400 };
+  const failurePolicy = {
+    maxLoginAttempts,
+    lockoutDuration,
+    lockoutEnabled: config.lockoutEnabled ?? true,
+    failureWindow: config.failureWindow ?? 86400
+  };
   function getAttributeValue(entry, attr) {
     const value = entry.attributes[attr];
     if (Array.isArray(value)) {
@@ -1956,7 +2161,9 @@ function createLdapStrategy(config) {
           if (!createResult.success) {
             return err(
               HaiIamError.REPOSITORY_ERROR,
-              iamM("iam_createUserFailed", { params: { message: createResult.error.message } }),
+              iamM("iam_createUserFailed", {
+                params: { message: createResult.error.message }
+              }),
               createResult.error
             );
           }
@@ -1999,7 +2206,10 @@ function createLdapStrategy(config) {
         if (!resetResult.success)
           return resetResult;
         logger5.debug("LDAP authentication succeeded", { userId: storedUser.id });
-        return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
+        return ok({
+          ...toUser(storedUser),
+          credentialVersion: storedUser.credentialVersion ?? ""
+        });
       } finally {
         await client.unbind();
       }
@@ -2035,7 +2245,11 @@ function createCacheOtpRepository() {
       if (!current.success)
         return failure2();
       if (current.data && current.data.cooldownUntil > Date.now()) {
-        return err(HaiIamError.OTP_RESEND_TOO_FAST, iamM("iam_otpResendTooFast", { params: { seconds: Math.ceil((current.data.cooldownUntil - Date.now()) / 1e3) } }));
+        return err(HaiIamError.OTP_RESEND_TOO_FAST, iamM("iam_otpResendTooFast", {
+          params: {
+            seconds: Math.ceil((current.data.cooldownUntil - Date.now()) / 1e3)
+          }
+        }));
       }
       if (Date.now() >= state.expiresAt)
         return invalid();
@@ -2046,7 +2260,10 @@ function createCacheOtpRepository() {
         return err(HaiIamError.SECURITY_BUSY, iamM("iam_securityBusy"));
       if (Date.now() >= state.expiresAt)
         return invalid();
-      return ok({ idempotencyKey: `iam-otp:${state.version}`, expiresAt: new Date(state.expiresAt) });
+      return ok({
+        idempotencyKey: `iam-otp:${state.version}`,
+        expiresAt: new Date(state.expiresAt)
+      });
     },
     async consumeOtp(identifier, code, maxAttempts) {
       const key = keyFor(identifier);
@@ -2061,7 +2278,11 @@ function createCacheOtpRepository() {
         version = state.version;
         const correct = core.string.constantTimeEqual(state.code, code);
         const attempts = state.attempts + 1;
-        const next = { ...state, attempts, code: correct || attempts >= maxAttempts ? null : state.code };
+        const next = {
+          ...state,
+          attempts,
+          code: correct || attempts >= maxAttempts ? null : state.code
+        };
         const committed = await cache.kv.compareAndSwap(key, state, next, { keepTtl: true });
         if (!committed.success)
           return failure2();
@@ -2106,7 +2327,12 @@ function createOtpStrategy(config) {
   const otpConfig = config.otpConfig ? OtpConfigSchema.parse(config.otpConfig) : OtpConfigSchema.parse({});
   const maxLoginAttempts = config.maxLoginAttempts ?? 5;
   const lockoutDuration = config.lockoutDuration ?? 900;
-  const failurePolicy = { maxLoginAttempts, lockoutDuration, lockoutEnabled: config.lockoutEnabled ?? true, failureWindow: config.failureWindow ?? 86400 };
+  const failurePolicy = {
+    maxLoginAttempts,
+    lockoutDuration,
+    lockoutEnabled: config.lockoutEnabled ?? true,
+    failureWindow: config.failureWindow ?? 86400
+  };
   const registerConfig = config.registerConfig;
   const allowAutoRegister = registerConfig?.enabled ?? config.autoRegister ?? false;
   const defaultAccountStatus = registerConfig?.defaultAccountStatus ?? "active";
@@ -2157,7 +2383,9 @@ function createOtpStrategy(config) {
         if (!createResult.success) {
           return err(
             HaiIamError.REPOSITORY_ERROR,
-            iamM("iam_createUserFailed", { params: { message: createResult.error.message } }),
+            iamM("iam_createUserFailed", {
+              params: { message: createResult.error.message }
+            }),
             createResult.error
           );
         }
@@ -2187,7 +2415,10 @@ function createOtpStrategy(config) {
       if (!resetResult.success)
         return resetResult;
       logger6.debug("OTP authentication succeeded", { userId: storedUser.id });
-      return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
+      return ok({
+        ...toUser(storedUser),
+        credentialVersion: storedUser.credentialVersion ?? ""
+      });
     }
   };
   function isChannelEnabled(identifier) {
@@ -2199,7 +2430,12 @@ function createOtpStrategy(config) {
     if (!isChannelEnabled(identifier))
       return err(HaiIamError.LOGIN_DISABLED, iamM("iam_identifierTypeNotSupported"));
     const code = generateOtpCode(otpConfig.length);
-    const saved = await config.otpRepository.issueOtp({ identifier, code, expiresIn: otpConfig.expiresIn, resendInterval: otpConfig.resendInterval });
+    const saved = await config.otpRepository.issueOtp({
+      identifier,
+      code,
+      expiresIn: otpConfig.expiresIn,
+      resendInterval: otpConfig.resendInterval
+    });
     if (!saved.success)
       return saved;
     const context = saved.data;
@@ -2244,7 +2480,12 @@ function createPasswordStrategy(config) {
   const passwordConfig = config.passwordConfig ? PasswordConfigSchema.parse(config.passwordConfig) : PasswordConfigSchema.parse({});
   const maxLoginAttempts = config.maxLoginAttempts ?? 5;
   const lockoutDuration = config.lockoutDuration ?? 900;
-  const failurePolicy = { maxLoginAttempts, lockoutDuration, lockoutEnabled: config.lockoutEnabled ?? true, failureWindow: config.failureWindow ?? 86400 };
+  const failurePolicy = {
+    maxLoginAttempts,
+    lockoutDuration,
+    lockoutEnabled: config.lockoutEnabled ?? true,
+    failureWindow: config.failureWindow ?? 86400
+  };
   const passwordOps = crypto$1.password;
   function mapPasswordError(message) {
     return err(
@@ -2256,13 +2497,17 @@ function createPasswordStrategy(config) {
     if (password.length < passwordConfig.minLength) {
       return err(
         HaiIamError.PASSWORD_POLICY_VIOLATION,
-        iamM("iam_passwordMinLength", { params: { minLength: passwordConfig.minLength } })
+        iamM("iam_passwordMinLength", {
+          params: { minLength: passwordConfig.minLength }
+        })
       );
     }
     if (password.length > passwordConfig.maxLength) {
       return err(
         HaiIamError.PASSWORD_POLICY_VIOLATION,
-        iamM("iam_passwordMaxLength", { params: { maxLength: passwordConfig.maxLength } })
+        iamM("iam_passwordMaxLength", {
+          params: { maxLength: passwordConfig.maxLength }
+        })
       );
     }
     if (passwordConfig.requireUppercase && !PASSWORD_UPPERCASE_REGEX.test(password)) {
@@ -2289,9 +2534,17 @@ function createPasswordStrategy(config) {
         iamM("iam_passwordNeedSpecialChar")
       );
     }
-    const classes = [PASSWORD_UPPERCASE_REGEX, PASSWORD_LOWERCASE_REGEX, PASSWORD_DIGIT_REGEX, PASSWORD_SPECIAL_CHAR_REGEX].filter((pattern) => pattern.test(password)).length;
-    if (classes < passwordConfig.minCharacterClasses)
-      return err(HaiIamError.PASSWORD_POLICY_VIOLATION, iamM("iam_passwordCharacterClasses", { params: { count: passwordConfig.minCharacterClasses } }));
+    const classes = [
+      PASSWORD_UPPERCASE_REGEX,
+      PASSWORD_LOWERCASE_REGEX,
+      PASSWORD_DIGIT_REGEX,
+      PASSWORD_SPECIAL_CHAR_REGEX
+    ].filter((pattern) => pattern.test(password)).length;
+    if (classes < passwordConfig.minCharacterClasses) {
+      return err(HaiIamError.PASSWORD_POLICY_VIOLATION, iamM("iam_passwordCharacterClasses", {
+        params: { count: passwordConfig.minCharacterClasses }
+      }));
+    }
     return ok(void 0);
   }
   function checkAccountStatus(user) {
@@ -2347,7 +2600,10 @@ function createPasswordStrategy(config) {
       if (!resetResult.success)
         return resetResult;
       logger7.debug("Password authentication succeeded", { userId: storedUser.id });
-      return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
+      return ok({
+        ...toUser(storedUser),
+        credentialVersion: storedUser.credentialVersion ?? ""
+      });
     }
   };
   function hashPassword(password) {
@@ -2451,7 +2707,12 @@ async function createAuthnOperations(deps) {
       config
     });
     logger8.info("Authn sub-feature initialized");
-    return ok({ authn: operations.authn, loginRegisteredUser: operations.loginRegisteredUser, passwordStrategyResult: passwordResult, apiKeyFunctions });
+    return ok({
+      authn: operations.authn,
+      loginRegisteredUser: operations.loginRegisteredUser,
+      passwordStrategyResult: passwordResult,
+      apiKeyFunctions
+    });
   } catch (error) {
     logger8.error("Authn sub-feature initialization failed", { error });
     return err(
@@ -2480,7 +2741,9 @@ function buildAuthnOperations(deps) {
     if (!loginConfig[type]) {
       return err(
         HaiIamError.LOGIN_DISABLED,
-        iamM("iam_loginDisabled", { params: { type } })
+        iamM("iam_loginDisabled", {
+          params: { type }
+        })
       );
     }
     return null;
@@ -2601,7 +2864,10 @@ function buildAuthnOperations(deps) {
     const authorization = await authzFunctions.getUserAuthorization(session.data.userId);
     if (!authorization.success)
       return authorization;
-    const current = { ...session.data, ...authorization.data };
+    const current = {
+      ...session.data,
+      ...authorization.data
+    };
     return ok(current.apiKeyId ? applyApiKeyScopes(current, current.apiKeyScopes ?? []) : current);
   }
   const tickets = createTicketOperations();
@@ -2616,99 +2882,114 @@ function buildAuthnOperations(deps) {
       return configured;
     return ok(sensitive.operations.includes(operation) || configured.data.includes(operation));
   }
-  return { loginRegisteredUser: async (user, context) => {
-    const stored = await userRepository.findById(user.id);
-    if (!stored.success)
-      return stored;
-    if (!stored.data || !isUserActive(stored.data))
-      return err(HaiIamError.ACCOUNT_UNAVAILABLE, iamM("iam_accountUnavailable"));
-    return buildAuthResult({ ...user, credentialVersion: stored.data.credentialVersion ?? "" }, void 0, context);
-  }, authn: {
-    createCaptcha: (input) => createIamCaptcha(config.captcha, input),
-    async reauthenticate(accessToken, password, operation) {
-      const required = await requiresProof(operation);
-      if (!required.success)
-        return required;
-      if (!required.data)
-        return err(HaiIamError.PERMISSION_DENIED, iamM("iam_reauthenticationRequired"));
-      const current = await verifyCurrentSession(accessToken);
-      if (!current.success)
-        return current;
-      const stored = await userRepository.findById(current.data.userId);
+  return {
+    loginRegisteredUser: async (user, context) => {
+      const stored = await userRepository.findById(user.id);
       if (!stored.success)
         return stored;
-      if (!stored.data)
-        return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
-      const verified = await passwordStrategy.authenticate({ type: "password", identifier: stored.data.username, password });
-      if (!verified.success)
-        return verified;
-      if (verified.data.credentialVersion !== current.data.credentialVersion)
-        return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
-      return tickets.issue({ subjectId: current.data.userId, purpose: `iam:reauth:${operation}`, ttlMs: sensitive.ttlSeconds * 1e3, grant: { operation, sessionVersion: current.data.version, credentialVersion: current.data.credentialVersion } });
+      if (!stored.data || !isUserActive(stored.data))
+        return err(HaiIamError.ACCOUNT_UNAVAILABLE, iamM("iam_accountUnavailable"));
+      return buildAuthResult({ ...user, credentialVersion: stored.data.credentialVersion ?? "" }, void 0, context);
     },
-    async checkSensitiveOperation(accessToken, operation, ticket) {
-      const current = await verifyCurrentSession(accessToken);
-      if (!current.success)
-        return current;
-      const required = await requiresProof(operation);
-      if (!required.success)
-        return required;
-      if (!required.data)
+    authn: {
+      createCaptcha: (input) => createIamCaptcha(config.captcha, input),
+      async reauthenticate(accessToken, password, operation) {
+        const required = await requiresProof(operation);
+        if (!required.success)
+          return required;
+        if (!required.data)
+          return err(HaiIamError.PERMISSION_DENIED, iamM("iam_reauthenticationRequired"));
+        const current = await verifyCurrentSession(accessToken);
+        if (!current.success)
+          return current;
+        const stored = await userRepository.findById(current.data.userId);
+        if (!stored.success)
+          return stored;
+        if (!stored.data)
+          return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
+        const verified = await passwordStrategy.authenticate({ type: "password", identifier: stored.data.username, password });
+        if (!verified.success)
+          return verified;
+        if (verified.data.credentialVersion !== current.data.credentialVersion)
+          return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
+        return tickets.issue({
+          subjectId: current.data.userId,
+          purpose: `iam:reauth:${operation}`,
+          ttlMs: sensitive.ttlSeconds * 1e3,
+          grant: { operation, sessionVersion: current.data.version, credentialVersion: current.data.credentialVersion }
+        });
+      },
+      async checkSensitiveOperation(accessToken, operation, ticket) {
+        const current = await verifyCurrentSession(accessToken);
+        if (!current.success)
+          return current;
+        const required = await requiresProof(operation);
+        if (!required.success)
+          return required;
+        if (!required.data)
+          return ok(void 0);
+        if (!ticket)
+          return err(HaiIamError.REAUTHENTICATION_REQUIRED, iamM("iam_reauthenticationRequired"));
+        const proof = await tickets.consume(ticket, { purpose: `iam:reauth:${operation}` });
+        if (!proof.success)
+          return proof;
+        if (proof.data.subjectId !== current.data.userId || proof.data.grant.operation !== operation || proof.data.grant.sessionVersion !== current.data.version || proof.data.grant.credentialVersion !== current.data.credentialVersion)
+          return err(HaiIamError.REAUTHENTICATION_REQUIRED, iamM("iam_reauthenticationRequired"));
         return ok(void 0);
-      if (!ticket)
-        return err(HaiIamError.REAUTHENTICATION_REQUIRED, iamM("iam_reauthenticationRequired"));
-      const proof = await tickets.consume(ticket, { purpose: `iam:reauth:${operation}` });
-      if (!proof.success)
-        return proof;
-      if (proof.data.subjectId !== current.data.userId || proof.data.grant.operation !== operation || proof.data.grant.sessionVersion !== current.data.version || proof.data.grant.credentialVersion !== current.data.credentialVersion)
-        return err(HaiIamError.REAUTHENTICATION_REQUIRED, iamM("iam_reauthenticationRequired"));
-      return ok(void 0);
-    },
-    async login(credentials, context) {
-      return loginWithStrategy("password", credentials, passwordStrategy, context);
-    },
-    async loginWithOtp(credentials, context) {
-      return loginWithStrategy("otp", credentials, otpStrategy, context);
-    },
-    async loginWithLdap(credentials, context) {
-      return loginWithStrategy("ldap", credentials, ldapStrategy, context);
-    },
-    async loginWithApiKey(credentials, context) {
-      const disabled = loginDisabled("apikey");
-      if (disabled)
-        return disabled;
-      if (!apiKeyStrategy)
-        return err(HaiIamError.STRATEGY_NOT_SUPPORTED, iamM("iam_featureNotImplemented"));
-      const authenticated = await apiKeyStrategy.authenticate({ type: "apikey", ...credentials });
-      if (!authenticated.success)
-        return authenticated;
-      return buildAuthResult(authenticated.data.user, authenticated.data.apiKey, context);
-    },
-    async logout(accessToken) {
-      return sessionFunctions.delete(accessToken);
-    },
-    verifyToken: verifyCurrentSession,
-    async sendOtp(identifier, options) {
-      const captcha = await verifyIamCaptcha(config.captcha, "sendOtp", options?.captcha);
-      if (!captcha.success)
-        return captcha;
-      const disabled = loginDisabled("otp");
-      if (disabled) {
-        return disabled;
-      }
-      if (!otpChallenge) {
-        return err(
-          HaiIamError.STRATEGY_NOT_SUPPORTED,
-          iamM("iam_otpStrategyRequiredForSend")
-        );
+      },
+      async login(credentials, context) {
+        return loginWithStrategy("password", credentials, passwordStrategy, context);
+      },
+      async loginWithOtp(credentials, context) {
+        return loginWithStrategy("otp", credentials, otpStrategy, context);
+      },
+      async loginWithLdap(credentials, context) {
+        return loginWithStrategy("ldap", credentials, ldapStrategy, context);
+      },
+      async loginWithApiKey(credentials, context) {
+        const disabled = loginDisabled("apikey");
+        if (disabled)
+          return disabled;
+        if (!apiKeyStrategy)
+          return err(HaiIamError.STRATEGY_NOT_SUPPORTED, iamM("iam_featureNotImplemented"));
+        const authenticated = await apiKeyStrategy.authenticate({ type: "apikey", ...credentials });
+        if (!authenticated.success)
+          return authenticated;
+        return buildAuthResult(authenticated.data.user, authenticated.data.apiKey, context);
+      },
+      async logout(accessToken) {
+        return sessionFunctions.delete(accessToken);
+      },
+      verifyToken: verifyCurrentSession,
+      async sendOtp(identifier, options) {
+        const captcha = await verifyIamCaptcha(config.captcha, "sendOtp", options?.captcha);
+        if (!captcha.success)
+          return captcha;
+        const disabled = loginDisabled("otp");
+        if (disabled) {
+          return disabled;
+        }
+        if (!otpChallenge) {
+          return err(
+            HaiIamError.STRATEGY_NOT_SUPPORTED,
+            iamM("iam_otpStrategyRequiredForSend")
+          );
+        }
+        return otpChallenge(identifier);
       }
-      return otpChallenge(identifier);
     }
-  } };
+  };
 }
 var TABLE_NAME3 = "hai_iam_permissions";
 var PERMISSION_FIELDS = [
-  { fieldName: "sensitiveOperations", columnName: "sensitive_operations", def: { type: "JSON" }, select: true, create: true, update: true },
+  {
+    fieldName: "sensitiveOperations",
+    columnName: "sensitive_operations",
+    def: { type: "JSON" },
+    select: true,
+    create: true,
+    update: true
+  },
   {
     fieldName: "id",
     columnName: "id",
@@ -2802,7 +3083,9 @@ var DbPermissionRepository = class extends BaseReldbCrudRepository {
     if (operation !== void 0 && (typeof operation !== "string" || !operation.trim() || operation.length > 128))
       return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
     const match = reldb.config?.type === "postgresql" ? "sensitive_operations::jsonb @> CAST(? AS jsonb)" : reldb.config?.type === "mysql" ? "JSON_CONTAINS(sensitive_operations, JSON_QUOTE(?))" : "EXISTS (SELECT 1 FROM json_each(sensitive_operations) WHERE type = 'text' AND value = ?)";
-    const params = operation === void 0 ? [] : [reldb.config?.type === "postgresql" ? JSON.stringify([operation]) : operation];
+    const params = operation === void 0 ? [] : [
+      reldb.config?.type === "postgresql" ? JSON.stringify([operation]) : operation
+    ];
     const result = await reldb.sql.query(`SELECT sensitive_operations FROM hai_iam_permissions WHERE sensitive_operations IS NOT NULL${operation === void 0 ? "" : ` AND ${match} LIMIT 1`}`, params);
     if (!result.success)
       return result;
@@ -2837,7 +3120,9 @@ var DbPermissionRepository = class extends BaseReldbCrudRepository {
   buildQueryError(error, cause) {
     return err(
       HaiIamError.REPOSITORY_ERROR,
-      iamM("iam_queryPermissionFailed", { params: { message: error.message } }),
+      iamM("iam_queryPermissionFailed", {
+        params: { message: error.message }
+      }),
       cause
     );
   }
@@ -2861,19 +3146,28 @@ async function createDbRolePermissionRepository() {
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
-        iamM("iam_createRolePermissionTableFailed", { params: { message: result.error.message } }),
+        iamM("iam_createRolePermissionTableFailed", {
+          params: { message: result.error.message }
+        }),
         result.error
       );
     }
     const indexResults = await Promise.all([
-      reldb.ddl.createIndex(ROLE_PERMISSION_TABLE, "idx_role_perm_role_perm", { columns: ["role_id", "permission_id"], unique: true }),
-      reldb.ddl.createIndex(ROLE_PERMISSION_TABLE, "idx_role_perm_role", { columns: ["role_id"] })
+      reldb.ddl.createIndex(ROLE_PERMISSION_TABLE, "idx_role_perm_role_perm", {
+        columns: ["role_id", "permission_id"],
+        unique: true
+      }),
+      reldb.ddl.createIndex(ROLE_PERMISSION_TABLE, "idx_role_perm_role", {
+        columns: ["role_id"]
+      })
     ]);
     for (const indexResult of indexResults) {
       if (!indexResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_createRolePermissionIndexFailed", { params: { message: indexResult.error.message } }),
+          iamM("iam_createRolePermissionIndexFailed", {
+            params: { message: indexResult.error.message }
+          }),
           indexResult.error
         );
       }
@@ -2897,7 +3191,9 @@ async function createDbRolePermissionRepository() {
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
-        iamM("iam_queryPermissionFailed", { params: { message: result.error.message } }),
+        iamM("iam_queryPermissionFailed", {
+          params: { message: result.error.message }
+        }),
         result.error
       );
     }
@@ -2913,7 +3209,9 @@ async function createDbRolePermissionRepository() {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_assignPermissionFailed", { params: { message: result.error.message } }),
+          iamM("iam_assignPermissionFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -2928,7 +3226,9 @@ async function createDbRolePermissionRepository() {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_removePermissionFailed", { params: { message: result.error.message } }),
+          iamM("iam_removePermissionFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -2949,7 +3249,9 @@ async function createDbRolePermissionRepository() {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryPermissionFailed", { params: { message: result.error.message } }),
+          iamM("iam_queryPermissionFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -2967,7 +3269,9 @@ async function createDbRolePermissionRepository() {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryPermissionFailed", { params: { message: result.error.message } }),
+          iamM("iam_queryPermissionFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -2982,7 +3286,9 @@ async function createDbRolePermissionRepository() {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_removePermissionFailed", { params: { message: result.error.message } }),
+          iamM("iam_removePermissionFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -2997,7 +3303,9 @@ async function createDbRolePermissionRepository() {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_removePermissionFailed", { params: { message: result.error.message } }),
+          iamM("iam_removePermissionFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -3011,7 +3319,9 @@ async function createDbRolePermissionRepository() {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryPermissionFailed", { params: { message: result.error.message } }),
+          iamM("iam_queryPermissionFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -3030,7 +3340,9 @@ async function createDbRolePermissionRepository() {
       if (!relationsResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryPermissionFailed", { params: { message: relationsResult.error.message } }),
+          iamM("iam_queryPermissionFailed", {
+            params: { message: relationsResult.error.message }
+          }),
           relationsResult.error
         );
       }
@@ -3040,7 +3352,9 @@ async function createDbRolePermissionRepository() {
       if (relationsResult.data.length === 0) {
         return ok(result);
       }
-      const uniquePermIds = [...new Set(relationsResult.data.map((r) => r.permission_id))];
+      const uniquePermIds = [
+        ...new Set(relationsResult.data.map((r) => r.permission_id))
+      ];
       const permPlaceholders = uniquePermIds.map(() => "?").join(", ");
       const permsResult = await reldb.sql.query(
         `SELECT * FROM ${PERMISSION_TABLE} WHERE id IN (${permPlaceholders})`,
@@ -3049,7 +3363,9 @@ async function createDbRolePermissionRepository() {
       if (!permsResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryPermissionFailed", { params: { message: permsResult.error.message } }),
+          iamM("iam_queryPermissionFailed", {
+            params: { message: permsResult.error.message }
+          }),
           permsResult.error
         );
       }
@@ -3079,19 +3395,28 @@ async function createDbUserRoleRepository(roleRepository) {
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
-        iamM("iam_createUserRoleTableFailed", { params: { message: result.error.message } }),
+        iamM("iam_createUserRoleTableFailed", {
+          params: { message: result.error.message }
+        }),
         result.error
       );
     }
     const indexResults = await Promise.all([
-      reldb.ddl.createIndex(USER_ROLE_TABLE, "idx_user_role_user_role", { columns: ["user_id", "role_id"], unique: true }),
-      reldb.ddl.createIndex(USER_ROLE_TABLE, "idx_user_role_user", { columns: ["user_id"] })
+      reldb.ddl.createIndex(USER_ROLE_TABLE, "idx_user_role_user_role", {
+        columns: ["user_id", "role_id"],
+        unique: true
+      }),
+      reldb.ddl.createIndex(USER_ROLE_TABLE, "idx_user_role_user", {
+        columns: ["user_id"]
+      })
     ]);
     for (const indexResult of indexResults) {
       if (!indexResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_createUserRoleIndexFailed", { params: { message: indexResult.error.message } }),
+          iamM("iam_createUserRoleIndexFailed", {
+            params: { message: indexResult.error.message }
+          }),
           indexResult.error
         );
       }
@@ -3115,7 +3440,9 @@ async function createDbUserRoleRepository(roleRepository) {
     if (!result.success) {
       return err(
         HaiIamError.REPOSITORY_ERROR,
-        iamM("iam_queryRoleFailed", { params: { message: result.error.message } }),
+        iamM("iam_queryRoleFailed", {
+          params: { message: result.error.message }
+        }),
         result.error
       );
     }
@@ -3131,7 +3458,9 @@ async function createDbUserRoleRepository(roleRepository) {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_assignRoleFailed", { params: { message: result.error.message } }),
+          iamM("iam_assignRoleFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -3146,7 +3475,9 @@ async function createDbUserRoleRepository(roleRepository) {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_removeRoleFailed", { params: { message: result.error.message } }),
+          iamM("iam_removeRoleFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
@@ -3176,7 +3507,9 @@ async function createDbUserRoleRepository(roleRepository) {
       if (!roleResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryRoleFailed", { params: { message: roleResult.error.message } }),
+          iamM("iam_queryRoleFailed", {
+            params: { message: roleResult.error.message }
+          }),
           roleResult.error
         );
       }
@@ -3191,7 +3524,9 @@ async function createDbUserRoleRepository(roleRepository) {
       if (!usersResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryRoleFailed", { params: { message: usersResult.error.message } }),
+          iamM("iam_queryRoleFailed", {
+            params: { message: usersResult.error.message }
+          }),
           usersResult.error
         );
       }
@@ -3202,7 +3537,9 @@ async function createDbUserRoleRepository(roleRepository) {
       if (!deleteResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_removeRoleFailed", { params: { message: deleteResult.error.message } }),
+          iamM("iam_removeRoleFailed", {
+            params: { message: deleteResult.error.message }
+          }),
           deleteResult.error
         );
       }
@@ -3216,14 +3553,18 @@ async function createDbUserRoleRepository(roleRepository) {
       if (!result.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryRoleFailed", { params: { message: result.error.message } }),
+          iamM("iam_queryRoleFailed", {
+            params: { message: result.error.message }
+          }),
           result.error
         );
       }
       return ok(result.data.map((r) => r.user_id));
     },
     async getUserCounts(roleIds) {
-      const ids = [...new Set(roleIds)];
+      const ids = [
+        ...new Set(roleIds)
+      ];
       const counts = new Map(ids.map((id) => [id, 0]));
       if (ids.length === 0)
         return ok(counts);
@@ -3231,8 +3572,11 @@ async function createDbUserRoleRepository(roleRepository) {
         `SELECT role_id, COUNT(DISTINCT user_id) AS user_count FROM ${USER_ROLE_TABLE} WHERE role_id IN (${ids.map(() => "?").join(", ")}) GROUP BY role_id`,
         ids
       );
-      if (!result.success)
-        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_queryRoleFailed", { params: { message: result.error.message } }), result.error);
+      if (!result.success) {
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_queryRoleFailed", {
+          params: { message: result.error.message }
+        }), result.error);
+      }
       for (const row of result.data)
         counts.set(row.role_id, Number(row.user_count));
       return ok(counts);
@@ -3250,7 +3594,9 @@ async function createDbUserRoleRepository(roleRepository) {
       if (!relationsResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryRoleFailed", { params: { message: relationsResult.error.message } }),
+          iamM("iam_queryRoleFailed", {
+            params: { message: relationsResult.error.message }
+          }),
           relationsResult.error
         );
       }
@@ -3260,7 +3606,9 @@ async function createDbUserRoleRepository(roleRepository) {
       if (relationsResult.data.length === 0) {
         return ok(result);
       }
-      const uniqueRoleIds = [...new Set(relationsResult.data.map((r) => r.role_id))];
+      const uniqueRoleIds = [
+        ...new Set(relationsResult.data.map((r) => r.role_id))
+      ];
       const rolePlaceholders = uniqueRoleIds.map(() => "?").join(", ");
       const rolesResult = await roleRepository.findAll({
         where: `id IN (${rolePlaceholders})`,
@@ -3269,7 +3617,9 @@ async function createDbUserRoleRepository(roleRepository) {
       if (!rolesResult.success) {
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_queryRoleFailed", { params: { message: rolesResult.error.message } }),
+          iamM("iam_queryRoleFailed", {
+            params: { message: rolesResult.error.message }
+          }),
           rolesResult.error
         );
       }
@@ -3363,7 +3713,10 @@ async function createDbRoleRepository() {
 }
 var DbRoleRepository = class extends BaseReldbCrudRepository {
   async touch(roleId, tx) {
-    return tx.execute(`UPDATE ${TABLE_NAME4} SET updated_at = ? WHERE id = ?`, [(/* @__PURE__ */ new Date()).toISOString(), roleId]);
+    return tx.execute(`UPDATE ${TABLE_NAME4} SET updated_at = ? WHERE id = ?`, [
+      (/* @__PURE__ */ new Date()).toISOString(),
+      roleId
+    ]);
   }
   constructor() {
     super(reldb, {
@@ -3378,7 +3731,9 @@ var DbRoleRepository = class extends BaseReldbCrudRepository {
   buildQueryError(error, cause) {
     return err(
       HaiIamError.REPOSITORY_ERROR,
-      iamM("iam_queryRoleFailed", { params: { message: error.message } }),
+      iamM("iam_queryRoleFailed", {
+        params: { message: error.message }
+      }),
       cause
     );
   }
@@ -3450,7 +3805,9 @@ function createRbacManager(config) {
   function mapRepositoryError2(messageKey, message) {
     return err(
       HaiIamError.REPOSITORY_ERROR,
-      iamM(messageKey, { params: { message } })
+      iamM(messageKey, {
+        params: { message }
+      })
     );
   }
   function matchesPermission(permission, code) {
@@ -3545,7 +3902,9 @@ function createRbacManager(config) {
     }
   }
   async function replaceRolePermissions(roleId, permissionIds, tx) {
-    const uniqueIds = [...new Set(permissionIds)];
+    const uniqueIds = [
+      ...new Set(permissionIds)
+    ];
     for (const id of uniqueIds) {
       const permission = await permissionRepository.findById(id, tx);
       if (!permission.success)
@@ -3566,7 +3925,14 @@ function createRbacManager(config) {
   async function getUserAuthorization(userId) {
     return readIamCache(`authorization:${userId}`, async () => {
       const rows = await reldb.sql.query("SELECT r.code AS role_code, p.code AS permission_code FROM hai_iam_user_roles ur JOIN hai_iam_roles r ON r.id = ur.role_id LEFT JOIN hai_iam_role_permissions rp ON rp.role_id = r.id LEFT JOIN hai_iam_permissions p ON p.id = rp.permission_id WHERE ur.user_id = ?", [userId]);
-      return rows.success ? ok({ roles: [...new Set(rows.data.map((row) => row.role_code))], permissions: [...new Set(rows.data.flatMap((row) => row.permission_code ? [row.permission_code] : []))] }) : rows;
+      return rows.success ? ok({
+        roles: [
+          ...new Set(rows.data.map((row) => row.role_code))
+        ],
+        permissions: [
+          ...new Set(rows.data.flatMap((row) => row.permission_code ? [row.permission_code] : []))
+        ]
+      }) : rows;
     });
   }
   return {
@@ -3574,7 +3940,11 @@ function createRbacManager(config) {
     async setPermissionSensitiveOperations(permissionId, operations) {
       if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
         return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
-      const updated = await permissionRepository.updateById(permissionId, { sensitiveOperations: [...new Set(operations.map((value) => value.trim()))] });
+      const updated = await permissionRepository.updateById(permissionId, {
+        sensitiveOperations: [
+          ...new Set(operations.map((value) => value.trim()))
+        ]
+      });
       if (!updated.success)
         return updated;
       if (updated.data.changes === 0) {
@@ -3686,7 +4056,11 @@ function createRbacManager(config) {
           await tx.rollback();
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_syncRolesFailed", { params: { message: String(error) } }),
+          iamM("iam_syncRolesFailed", {
+            params: {
+              message: String(error)
+            }
+          }),
           error
         );
       }
@@ -3749,7 +4123,11 @@ function createRbacManager(config) {
           await tx.rollback();
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_createRoleFailed", { params: { message: String(error) } }),
+          iamM("iam_createRoleFailed", {
+            params: {
+              message: String(error)
+            }
+          }),
           error
         );
       }
@@ -3844,7 +4222,11 @@ function createRbacManager(config) {
           await tx.rollback();
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_updateRoleFailed", { params: { message: String(error) } }),
+          iamM("iam_updateRoleFailed", {
+            params: {
+              message: String(error)
+            }
+          }),
           error
         );
       }
@@ -3900,7 +4282,11 @@ function createRbacManager(config) {
           await tx.rollback();
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_deleteRoleFailed", { params: { message: String(error) } }),
+          iamM("iam_deleteRoleFailed", {
+            params: {
+              message: String(error)
+            }
+          }),
           error
         );
       }
@@ -3917,7 +4303,12 @@ function createRbacManager(config) {
       const operations = permission.sensitiveOperations ?? [];
       if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
         return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
-      permission = { ...permission, sensitiveOperations: [...new Set(operations.map((value) => value.trim()))] };
+      permission = {
+        ...permission,
+        sensitiveOperations: [
+          ...new Set(operations.map((value) => value.trim()))
+        ]
+      };
       const ownTx = !tx;
       if (!tx) {
         const txResult = await reldb.tx.begin();
@@ -3960,7 +4351,11 @@ function createRbacManager(config) {
           await tx.rollback();
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_createPermissionFailed", { params: { message: String(error) } }),
+          iamM("iam_createPermissionFailed", {
+            params: {
+              message: String(error)
+            }
+          }),
           error
         );
       }
@@ -4048,7 +4443,11 @@ function createRbacManager(config) {
           await tx.rollback();
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_deletePermissionFailed", { params: { message: String(error) } }),
+          iamM("iam_deletePermissionFailed", {
+            params: {
+              message: String(error)
+            }
+          }),
           error
         );
       }
@@ -4142,7 +4541,10 @@ async function observe(operation, event, tx) {
     ...fields,
     category: "system",
     outcome: result.success ? "success" : [401, 403, 409, 423, 429].includes(result.error.httpStatus ?? 500) ? "denied" : "failure",
-    details: { ...fields.details, ...!result.success ? { reasonCode: result.error.code } : {} }
+    details: {
+      ...fields.details,
+      ...!result.success ? { reasonCode: result.error.code } : {}
+    }
   }, { tx });
   if (!recorded.success) {
     logger10.error("IAM event audit failed", { action: fields.action, resource: fields.resource, error: recorded.error });
@@ -4158,7 +4560,12 @@ function loginEvent(method, result, context) {
     details: { method },
     // 登录结果本身已完成鉴别，不把客户端提交的标识声明当成已验证主体。
     userId: result.success ? result.data.user.id : null,
-    actorSnapshot: result.success ? { id: result.data.user.id, username: result.data.user.username, displayName: result.data.user.displayName, roles: result.data.roles } : null,
+    actorSnapshot: result.success ? {
+      id: result.data.user.id,
+      username: result.data.user.username,
+      displayName: result.data.user.displayName,
+      roles: result.data.roles
+    } : null,
     ipAddress: context?.ip,
     userAgent: context?.userAgent?.slice(0, 4096),
     requestId: context?.requestId
@@ -4174,18 +4581,54 @@ function observeAuth(operations) {
     registerAndLogin: (options, context) => observe(() => operations.registerAndLogin(options, context), (result) => loginEvent("registration", result, context)),
     logout: (token) => observe(() => operations.logout(token), { action: "auth.logout", resource: "iam.auth" }),
     sendOtp: (identifier, options) => observe(() => operations.sendOtp(identifier, options), { action: "otp.send", resource: "iam.auth" }),
-    reauthenticate: (token, password, operation) => observe(() => operations.reauthenticate(token, password, operation), { action: "auth.reauthenticate", resource: "iam.auth", details: { operation } }),
-    checkSensitiveOperation: (token, operation, ticket) => observe(() => operations.checkSensitiveOperation(token, operation, ticket), (result) => !result.success ? { action: "auth.sensitive-denied", resource: "iam.auth", details: { operation } } : void 0)
+    reauthenticate: (token, password, operation) => observe(() => operations.reauthenticate(token, password, operation), {
+      action: "auth.reauthenticate",
+      resource: "iam.auth",
+      details: { operation }
+    }),
+    checkSensitiveOperation: (token, operation, ticket) => observe(() => operations.checkSensitiveOperation(token, operation, ticket), (result) => !result.success ? {
+      action: "auth.sensitive-denied",
+      resource: "iam.auth",
+      details: { operation }
+    } : void 0)
   };
 }
 function observeUsers(operations) {
   return {
     ...operations,
-    register: (options) => observe(() => operations.register(options), (result) => ({ action: "user.register", resource: "iam.users", resourceId: result.success ? result.data.user.id : void 0 })),
-    createUser: (options) => observe(() => operations.createUser(options), (result) => ({ action: "user.create", resource: "iam.users", resourceId: result.success ? result.data.user.id : void 0 })),
-    inviteUser: (options) => observe(() => operations.inviteUser(options), (result) => ({ action: "user.invite", resource: "iam.users", resourceId: result.success ? result.data.user.id : void 0 })),
-    updateUser: (id, data) => observe(() => operations.updateUser(id, data), { action: "user.update", resource: "iam.users", resourceId: id, details: { fields: Object.keys(data), ...data.accountStatus ? { accountStatus: data.accountStatus } : {}, ...data.accountType ? { accountType: data.accountType } : {} } }),
-    updateCurrentUser: (token, data) => observe(() => operations.updateCurrentUser(token, data), (result) => ({ action: "user.profile", resource: "iam.users", resourceId: result.success ? result.data.id : void 0, details: { fields: Object.keys(data) } })),
+    register: (options) => observe(() => operations.register(options), (result) => ({
+      action: "user.register",
+      resource: "iam.users",
+      resourceId: result.success ? result.data.user.id : void 0
+    })),
+    createUser: (options) => observe(() => operations.createUser(options), (result) => ({
+      action: "user.create",
+      resource: "iam.users",
+      resourceId: result.success ? result.data.user.id : void 0
+    })),
+    inviteUser: (options) => observe(() => operations.inviteUser(options), (result) => ({
+      action: "user.invite",
+      resource: "iam.users",
+      resourceId: result.success ? result.data.user.id : void 0
+    })),
+    updateUser: (id, data) => observe(() => operations.updateUser(id, data), {
+      action: "user.update",
+      resource: "iam.users",
+      resourceId: id,
+      details: {
+        fields: Object.keys(data),
+        ...data.accountStatus ? { accountStatus: data.accountStatus } : {},
+        ...data.accountType ? { accountType: data.accountType } : {}
+      }
+    }),
+    updateCurrentUser: (token, data) => observe(() => operations.updateCurrentUser(token, data), (result) => ({
+      action: "user.profile",
+      resource: "iam.users",
+      resourceId: result.success ? result.data.id : void 0,
+      details: {
+        fields: Object.keys(data)
+      }
+    })),
     deleteUser: (id) => observe(() => operations.deleteUser(id), { action: "user.delete", resource: "iam.users", resourceId: id }),
     adminResetPassword: (id, password) => observe(() => operations.adminResetPassword(id, password), { action: "password.admin-reset", resource: "iam.users", resourceId: id }),
     changePassword: (id, previous, next) => observe(() => operations.changePassword(id, previous, next), { action: "password.change", resource: "iam.users", resourceId: id }),
@@ -4193,31 +4636,92 @@ function observeUsers(operations) {
     renewPassword: (input) => observe(() => operations.renewPassword(input), { action: "password.renew", resource: "iam.users" }),
     requestPasswordReset: (identifier, options) => observe(() => operations.requestPasswordReset(identifier, options), { action: "password.reset-request", resource: "iam.users" }),
     confirmPasswordReset: (token, password) => observe(() => operations.confirmPasswordReset(token, password), { action: "password.reset-complete", resource: "iam.users" }),
-    scanInactiveAccounts: () => observe(() => operations.scanInactiveAccounts(), (result) => result.success && result.data === 0 ? void 0 : { action: "account.inactivity-scan", resource: "iam.users", details: result.success ? { count: result.data } : {} })
+    scanInactiveAccounts: () => observe(() => operations.scanInactiveAccounts(), (result) => result.success && result.data === 0 ? void 0 : {
+      action: "account.inactivity-scan",
+      resource: "iam.users",
+      details: result.success ? { count: result.data } : {}
+    })
   };
 }
 function observeAuthorization(operations) {
   return {
     ...operations,
-    assignRole: (id, roleId, tx) => observe(() => operations.assignRole(id, roleId, tx), { action: "role.assign", resource: "iam.user-roles", resourceId: id, details: { roleId } }, tx),
-    removeRole: (id, roleId, tx) => observe(() => operations.removeRole(id, roleId, tx), { action: "role.remove", resource: "iam.user-roles", resourceId: id, details: { roleId } }, tx),
-    syncRoles: (id, roleIds, tx) => observe(() => operations.syncRoles(id, roleIds, tx), { action: "role.sync", resource: "iam.user-roles", resourceId: id, details: { roleIds } }, tx),
-    createRole: (input, tx) => observe(() => operations.createRole(input, tx), (result) => ({ action: "role.create", resource: "iam.roles", resourceId: result.success ? result.data.id : void 0, details: { code: input.code } }), tx),
-    updateRole: (id, data, tx) => observe(() => operations.updateRole(id, data, tx), { action: "role.update", resource: "iam.roles", resourceId: id, details: { fields: Object.keys(data), permissionIds: data.permissionIds } }, tx),
+    assignRole: (id, roleId, tx) => observe(() => operations.assignRole(id, roleId, tx), {
+      action: "role.assign",
+      resource: "iam.user-roles",
+      resourceId: id,
+      details: { roleId }
+    }, tx),
+    removeRole: (id, roleId, tx) => observe(() => operations.removeRole(id, roleId, tx), {
+      action: "role.remove",
+      resource: "iam.user-roles",
+      resourceId: id,
+      details: { roleId }
+    }, tx),
+    syncRoles: (id, roleIds, tx) => observe(() => operations.syncRoles(id, roleIds, tx), {
+      action: "role.sync",
+      resource: "iam.user-roles",
+      resourceId: id,
+      details: { roleIds }
+    }, tx),
+    createRole: (input, tx) => observe(() => operations.createRole(input, tx), (result) => ({
+      action: "role.create",
+      resource: "iam.roles",
+      resourceId: result.success ? result.data.id : void 0,
+      details: { code: input.code }
+    }), tx),
+    updateRole: (id, data, tx) => observe(() => operations.updateRole(id, data, tx), {
+      action: "role.update",
+      resource: "iam.roles",
+      resourceId: id,
+      details: {
+        fields: Object.keys(data),
+        permissionIds: data.permissionIds
+      }
+    }, tx),
     deleteRole: (id, tx) => observe(() => operations.deleteRole(id, tx), { action: "role.delete", resource: "iam.roles", resourceId: id }, tx),
-    createPermission: (input, tx) => observe(() => operations.createPermission(input, tx), (result) => ({ action: "permission.create", resource: "iam.permissions", resourceId: result.success ? result.data.id : void 0, details: { code: input.code } }), tx),
-    setPermissionSensitiveOperations: (id, operationIds) => observe(() => operations.setPermissionSensitiveOperations(id, operationIds), { action: "permission.sensitive-operations", resource: "iam.permissions", resourceId: id, details: { operations: operationIds } }),
+    createPermission: (input, tx) => observe(() => operations.createPermission(input, tx), (result) => ({
+      action: "permission.create",
+      resource: "iam.permissions",
+      resourceId: result.success ? result.data.id : void 0,
+      details: { code: input.code }
+    }), tx),
+    setPermissionSensitiveOperations: (id, operationIds) => observe(() => operations.setPermissionSensitiveOperations(id, operationIds), {
+      action: "permission.sensitive-operations",
+      resource: "iam.permissions",
+      resourceId: id,
+      details: { operations: operationIds }
+    }),
     deletePermission: (id, tx) => observe(() => operations.deletePermission(id, tx), { action: "permission.delete", resource: "iam.permissions", resourceId: id }, tx),
-    assignPermissionToRole: (id, permissionId, tx) => observe(() => operations.assignPermissionToRole(id, permissionId, tx), { action: "permission.assign", resource: "iam.role-permissions", resourceId: id, details: { permissionId } }, tx),
-    removePermissionFromRole: (id, permissionId, tx) => observe(() => operations.removePermissionFromRole(id, permissionId, tx), { action: "permission.remove", resource: "iam.role-permissions", resourceId: id, details: { permissionId } }, tx)
+    assignPermissionToRole: (id, permissionId, tx) => observe(() => operations.assignPermissionToRole(id, permissionId, tx), {
+      action: "permission.assign",
+      resource: "iam.role-permissions",
+      resourceId: id,
+      details: { permissionId }
+    }, tx),
+    removePermissionFromRole: (id, permissionId, tx) => observe(() => operations.removePermissionFromRole(id, permissionId, tx), {
+      action: "permission.remove",
+      resource: "iam.role-permissions",
+      resourceId: id,
+      details: { permissionId }
+    }, tx)
   };
 }
 function observeSessions(operations) {
   return {
     ...operations,
-    create: (options) => observe(() => operations.create(options), (result) => ({ action: "session.create", resource: "iam.sessions", resourceId: result.success ? result.data.version : options.userId })),
+    create: (options) => observe(() => operations.create(options), (result) => ({
+      action: "session.create",
+      resource: "iam.sessions",
+      resourceId: result.success ? result.data.version : options.userId
+    })),
     delete: (token) => observe(() => operations.delete(token), { action: "session.delete", resource: "iam.sessions" }),
-    deleteByUserId: (id) => observe(() => operations.deleteByUserId(id), (result) => ({ action: "session.revoke-user", resource: "iam.sessions", resourceId: id, details: result.success ? { count: result.data } : {} })),
+    deleteByUserId: (id) => observe(() => operations.deleteByUserId(id), (result) => ({
+      action: "session.revoke-user",
+      resource: "iam.sessions",
+      resourceId: id,
+      details: result.success ? { count: result.data } : {}
+    })),
     refresh: (token) => observe(() => operations.refresh(token), { action: "session.refresh", resource: "iam.sessions" }),
     revokeRefresh: (token) => observe(() => operations.revokeRefresh(token), { action: "session.revoke-refresh", resource: "iam.sessions" })
   };
@@ -4225,102 +4729,131 @@ function observeSessions(operations) {
 function observeApiKeys(operations) {
   return {
     ...operations,
-    createApiKey: (userId, options) => observe(() => operations.createApiKey(userId, options), (result) => ({ action: "apikey.create", resource: "iam.apikeys", resourceId: result.success ? result.data.apiKey.id : void 0, details: { subjectId: userId, scopes: options.scopes } })),
+    createApiKey: (userId, options) => observe(() => operations.createApiKey(userId, options), (result) => ({
+      action: "apikey.create",
+      resource: "iam.apikeys",
+      resourceId: result.success ? result.data.apiKey.id : void 0,
+      details: { subjectId: userId, scopes: options.scopes }
+    })),
     revokeApiKey: (id) => observe(() => operations.revokeApiKey(id), { action: "apikey.revoke", resource: "iam.apikeys", resourceId: id })
   };
 }
-var columns = { credential_version: "VARCHAR(255) NOT NULL DEFAULT ''", reset_version: "VARCHAR(255) NOT NULL DEFAULT ''", reset_hash: "TEXT", reset_expires_at: "BIGINT", reset_attempts: "INTEGER NOT NULL DEFAULT 0" };
-var accountColumns = { account_type: "VARCHAR(16) NOT NULL DEFAULT 'permanent'", account_status: "VARCHAR(16) NOT NULL DEFAULT 'active'", account_expires_at: "TIMESTAMP", last_login_at: "TIMESTAMP" };
-var steps = [{
-  version: 1,
-  name: "credential-and-reset-versions",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_iam_users", sql);
-    return found.success ? ok(found.data.length > 0 && Object.keys(columns).some((name) => !found.data.includes(name))) : found;
-  },
-  async apply(sql) {
-    const found = await schemaColumns(reldb, "hai_iam_users", sql);
-    if (!found.success)
-      return found;
-    for (const [name, definition] of Object.entries(columns)) {
-      if (found.data.includes(name))
-        continue;
-      const added = await sql.execute(`ALTER TABLE hai_iam_users ADD COLUMN ${name} ${definition}`);
-      if (!added.success)
-        return added;
+var columns = {
+  credential_version: "VARCHAR(255) NOT NULL DEFAULT ''",
+  reset_version: "VARCHAR(255) NOT NULL DEFAULT ''",
+  reset_hash: "TEXT",
+  reset_expires_at: "BIGINT",
+  reset_attempts: "INTEGER NOT NULL DEFAULT 0"
+};
+var accountColumns = {
+  account_type: "VARCHAR(16) NOT NULL DEFAULT 'permanent'",
+  account_status: "VARCHAR(16) NOT NULL DEFAULT 'active'",
+  account_expires_at: "TIMESTAMP",
+  last_login_at: "TIMESTAMP"
+};
+var steps = [
+  {
+    version: 1,
+    name: "credential-and-reset-versions",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_iam_users", sql);
+      return found.success ? ok(found.data.length > 0 && Object.keys(columns).some((name) => !found.data.includes(name))) : found;
+    },
+    async apply(sql) {
+      const found = await reldb.schemaColumns("hai_iam_users", sql);
+      if (!found.success)
+        return found;
+      for (const [name, definition] of Object.entries(columns)) {
+        if (found.data.includes(name))
+          continue;
+        const added = await sql.execute(`ALTER TABLE hai_iam_users ADD COLUMN ${name} ${definition}`);
+        if (!added.success)
+          return added;
+      }
+      return ok(void 0);
     }
-    return ok(void 0);
-  }
-}, {
-  version: 2,
-  name: "account-lifecycle",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_iam_users", sql);
-    return found.success ? ok(found.data.length > 0 && Object.keys(accountColumns).some((name) => !found.data.includes(name))) : found;
   },
-  async apply(sql) {
-    const found = await schemaColumns(reldb, "hai_iam_users", sql);
-    if (!found.success)
-      return found;
-    for (const [name, definition] of Object.entries(accountColumns)) {
-      if (found.data.includes(name))
-        continue;
-      const added = await sql.execute(`ALTER TABLE hai_iam_users ADD COLUMN ${name} ${definition}`);
-      if (!added.success)
-        return added;
+  {
+    version: 2,
+    name: "account-lifecycle",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_iam_users", sql);
+      return found.success ? ok(found.data.length > 0 && Object.keys(accountColumns).some((name) => !found.data.includes(name))) : found;
+    },
+    async apply(sql) {
+      const found = await reldb.schemaColumns("hai_iam_users", sql);
+      if (!found.success)
+        return found;
+      for (const [name, definition] of Object.entries(accountColumns)) {
+        if (found.data.includes(name))
+          continue;
+        const added = await sql.execute(`ALTER TABLE hai_iam_users ADD COLUMN ${name} ${definition}`);
+        if (!added.success)
+          return added;
+      }
+      return ok(void 0);
     }
-    return ok(void 0);
-  }
-}, {
-  version: 3,
-  name: "initial-password-state",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_iam_users", sql);
-    return found.success ? ok(found.data.length > 0 && !found.data.includes("must_change_password")) : found;
   },
-  async apply(sql) {
-    const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN must_change_password BOOLEAN NOT NULL DEFAULT FALSE");
-    return added.success ? ok(void 0) : added;
-  }
-}, {
-  version: 4,
-  name: "login-failure-window",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_iam_users", sql);
-    return found.success ? ok(found.data.length > 0 && !found.data.includes("first_login_failed_at")) : found;
+  {
+    version: 3,
+    name: "initial-password-state",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_iam_users", sql);
+      return found.success ? ok(found.data.length > 0 && !found.data.includes("must_change_password")) : found;
+    },
+    async apply(sql) {
+      const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN must_change_password BOOLEAN NOT NULL DEFAULT FALSE");
+      return added.success ? ok(void 0) : added;
+    }
   },
-  async apply(sql) {
-    const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN first_login_failed_at TIMESTAMP");
-    return added.success ? ok(void 0) : added;
-  }
-}, {
-  version: 5,
-  name: "permission-sensitive-operations",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_iam_permissions", sql);
-    return found.success ? ok(found.data.length > 0 && !found.data.includes("sensitive_operations")) : found;
+  {
+    version: 4,
+    name: "login-failure-window",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_iam_users", sql);
+      return found.success ? ok(found.data.length > 0 && !found.data.includes("first_login_failed_at")) : found;
+    },
+    async apply(sql) {
+      const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN first_login_failed_at TIMESTAMP");
+      return added.success ? ok(void 0) : added;
+    }
   },
-  async apply(sql) {
-    const added = await sql.execute("ALTER TABLE hai_iam_permissions ADD COLUMN sensitive_operations JSON");
-    return added.success ? ok(void 0) : added;
-  }
-}, {
-  version: 6,
-  name: "account-lifecycle-only",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_iam_users", sql);
-    return found.success ? ok(found.data.includes("enabled")) : found;
+  {
+    version: 5,
+    name: "permission-sensitive-operations",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_iam_permissions", sql);
+      return found.success ? ok(found.data.length > 0 && !found.data.includes("sensitive_operations")) : found;
+    },
+    async apply(sql) {
+      const added = await sql.execute("ALTER TABLE hai_iam_permissions ADD COLUMN sensitive_operations JSON");
+      return added.success ? ok(void 0) : added;
+    }
   },
-  async apply(sql) {
-    const converted = await sql.execute("UPDATE hai_iam_users SET account_status = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL WHERE (enabled = ? OR enabled IS NULL) AND account_status = ?", ["dormant", globalThis.crypto.randomUUID(), globalThis.crypto.randomUUID(), reldb.config?.type === "postgresql" ? false : 0, "active"]);
-    if (!converted.success)
-      return converted;
-    const removed = await sql.execute("ALTER TABLE hai_iam_users DROP COLUMN enabled");
-    return removed.success ? ok(void 0) : removed;
+  {
+    version: 6,
+    name: "account-lifecycle-only",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_iam_users", sql);
+      return found.success ? ok(found.data.includes("enabled")) : found;
+    },
+    async apply(sql) {
+      const converted = await sql.execute("UPDATE hai_iam_users SET account_status = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL WHERE (enabled = ? OR enabled IS NULL) AND account_status = ?", [
+        "dormant",
+        globalThis.crypto.randomUUID(),
+        globalThis.crypto.randomUUID(),
+        reldb.config?.type === "postgresql" ? false : 0,
+        "active"
+      ]);
+      if (!converted.success)
+        return converted;
+      const removed = await sql.execute("ALTER TABLE hai_iam_users DROP COLUMN enabled");
+      return removed.success ? ok(void 0) : removed;
+    }
   }
-}];
+];
 function migrateIam(options = {}) {
-  return migrateSchema(reldb, "iam", steps, options);
+  return reldb.migrateSchema("iam", steps, options);
 }
 
 // src/iam-notifications.ts
@@ -4342,7 +4875,15 @@ async function resolveIamNotifications(input) {
     const provider = configured.get(template);
     if (!reach?.isInitialized || !provider || !to)
       throw new Error(iamM("iam_passwordResetDeliveryFailed"));
-    const result = await reach.send({ provider, to, template, vars, idempotencyKey: context.idempotencyKey, sensitive: true, expiresAt: context.expiresAt.getTime() });
+    const result = await reach.send({
+      provider,
+      to,
+      template,
+      vars,
+      idempotencyKey: context.idempotencyKey,
+      sensitive: true,
+      expiresAt: context.expiresAt.getTime()
+    });
     if (!result.success || !result.data.success)
       throw new Error(iamM("iam_passwordResetDeliveryFailed"));
   }
@@ -4355,7 +4896,11 @@ async function resolveIamNotifications(input) {
     callbacks.onPasswordResetRequest = (user, token, context) => {
       const url = input.passwordReset?.resetUrl ? new URL(input.passwordReset.resetUrl) : null;
       url?.searchParams.set("token", token);
-      const vars = { token, expiresAt: context.expiresAt.toISOString(), resetUrl: url?.toString() ?? token };
+      const vars = {
+        token,
+        expiresAt: context.expiresAt.toISOString(),
+        resetUrl: url?.toString() ?? token
+      };
       return send(resetTemplate, input.passwordReset?.mode === "phone" ? user.phone ?? "" : user.email ?? "", vars, context);
     };
   }
@@ -4372,14 +4917,27 @@ function buildIamPublicConfig(config, runtime) {
     captcha: { enabled: config.captcha.enabled },
     password: PasswordConfigSchema.parse(config.password ?? {}),
     register: { enabled: config.register.enabled },
-    login: { password: config.login.password, otp: email || sms, ldap: config.login.ldap && !!config.ldap, email, sms },
+    login: {
+      password: config.login.password,
+      otp: email || sms,
+      ldap: config.login.ldap && !!config.ldap,
+      email,
+      sms
+    },
     passwordReset: { enabled: config.passwordReset?.enabled !== false && !!runtime.onPasswordResetRequest, mode: config.passwordReset?.mode ?? "email" },
     otp: { length: otp.length, resendInterval: otp.resendInterval },
     agreements: { ...config.agreements },
     ui: AuthUiConfigSchema.parse(config.ui ?? {}),
     session: { maxAge: session.maxAge, endOnPageHide: session.endOnPageHide },
-    reauthentication: { enabled: config.reauthentication?.enabled ?? false, operations: [...config.reauthentication?.operations ?? []] },
-    initialCredentials: { enabled: Boolean(config.initialCredentials?.enabled && config.passwordReset?.enabled !== false && runtime.onPasswordResetRequest) }
+    reauthentication: {
+      enabled: config.reauthentication?.enabled ?? false,
+      operations: [
+        ...config.reauthentication?.operations ?? []
+      ]
+    },
+    initialCredentials: {
+      enabled: Boolean(config.initialCredentials?.enabled && config.passwordReset?.enabled !== false && runtime.onPasswordResetRequest)
+    }
   };
 }
 async function readIamUserSecurity(repository, userId) {
@@ -4401,47 +4959,241 @@ async function readIamUserSecurity(repository, userId) {
       passwordUpdatedAt: user.passwordUpdatedAt?.getTime() ?? null
     } : null);
   });
-  return found.success ? ok(found.data ? { ...found.data, accountExpiresAt: found.data.accountExpiresAt === null ? null : new Date(found.data.accountExpiresAt), passwordUpdatedAt: found.data.passwordUpdatedAt === null ? void 0 : new Date(found.data.passwordUpdatedAt), passwordHash: found.data.hasPassword ? "present" : void 0 } : null) : found;
+  return found.success ? ok(found.data ? {
+    ...found.data,
+    accountExpiresAt: found.data.accountExpiresAt === null ? null : new Date(found.data.accountExpiresAt),
+    passwordUpdatedAt: found.data.passwordUpdatedAt === null ? void 0 : new Date(found.data.passwordUpdatedAt),
+    passwordHash: found.data.hasPassword ? "present" : void 0
+  } : null) : found;
 }
 var logger11 = core.logger.child({ module: "iam", scope: "seed" });
 var DEFAULT_ROLES = [
-  { code: "admin", name: () => iamM("iam_seedRoleAdminName"), description: () => iamM("iam_seedRoleAdminDesc"), isSystem: true },
-  { code: "user", name: () => iamM("iam_seedRoleUserName"), description: () => iamM("iam_seedRoleUserDesc"), isSystem: true },
-  { code: "guest", name: () => iamM("iam_seedRoleGuestName"), description: () => iamM("iam_seedRoleGuestDesc"), isSystem: true }
+  {
+    code: "admin",
+    name: () => iamM("iam_seedRoleAdminName"),
+    description: () => iamM("iam_seedRoleAdminDesc"),
+    isSystem: true
+  },
+  {
+    code: "user",
+    name: () => iamM("iam_seedRoleUserName"),
+    description: () => iamM("iam_seedRoleUserDesc"),
+    isSystem: true
+  },
+  {
+    code: "guest",
+    name: () => iamM("iam_seedRoleGuestName"),
+    description: () => iamM("iam_seedRoleGuestDesc"),
+    isSystem: true
+  }
 ];
 var DEFAULT_PERMISSIONS = [
   // ─── 菜单权限 ───
-  { code: "dashboard:view", name: () => iamM("iam_seedPermDashboardView"), type: "menu", resource: "dashboard", action: "view" },
-  { code: "user:read", name: () => iamM("iam_seedPermUserRead"), type: "menu", resource: "user", action: "read" },
-  { code: "role:read", name: () => iamM("iam_seedPermRoleRead"), type: "menu", resource: "role", action: "read" },
-  { code: "permission:read", name: () => iamM("iam_seedPermPermRead"), type: "menu", resource: "permission", action: "read" },
-  { code: "system:logs", name: () => iamM("iam_seedPermSystemLogs"), type: "menu", resource: "system", action: "logs" },
-  { code: "system:settings", name: () => iamM("iam_seedPermSystemSettings"), type: "menu", resource: "system", action: "settings" },
-  { code: "system:modules", name: () => iamM("iam_seedPermSystemModules"), type: "menu", resource: "system", action: "modules" },
-  { code: "profile:read", name: () => iamM("iam_seedPermProfileRead"), type: "menu", resource: "profile", action: "read" },
+  {
+    code: "dashboard:view",
+    name: () => iamM("iam_seedPermDashboardView"),
+    type: "menu",
+    resource: "dashboard",
+    action: "view"
+  },
+  {
+    code: "user:read",
+    name: () => iamM("iam_seedPermUserRead"),
+    type: "menu",
+    resource: "user",
+    action: "read"
+  },
+  {
+    code: "role:read",
+    name: () => iamM("iam_seedPermRoleRead"),
+    type: "menu",
+    resource: "role",
+    action: "read"
+  },
+  {
+    code: "permission:read",
+    name: () => iamM("iam_seedPermPermRead"),
+    type: "menu",
+    resource: "permission",
+    action: "read"
+  },
+  {
+    code: "system:logs",
+    name: () => iamM("iam_seedPermSystemLogs"),
+    type: "menu",
+    resource: "system",
+    action: "logs"
+  },
+  {
+    code: "system:settings",
+    name: () => iamM("iam_seedPermSystemSettings"),
+    type: "menu",
+    resource: "system",
+    action: "settings"
+  },
+  {
+    code: "system:modules",
+    name: () => iamM("iam_seedPermSystemModules"),
+    type: "menu",
+    resource: "system",
+    action: "modules"
+  },
+  {
+    code: "profile:read",
+    name: () => iamM("iam_seedPermProfileRead"),
+    type: "menu",
+    resource: "profile",
+    action: "read"
+  },
   // ─── API 权限 ───
-  { code: "user:list", name: () => iamM("iam_seedPermUserList"), type: "api", resource: "user", action: "list" },
-  { code: "user:api:create", name: () => iamM("iam_seedPermUserApiCreate"), type: "api", resource: "user", action: "api:create" },
-  { code: "user:api:update", name: () => iamM("iam_seedPermUserApiUpdate"), type: "api", resource: "user", action: "api:update" },
-  { code: "user:api:delete", name: () => iamM("iam_seedPermUserApiDelete"), type: "api", resource: "user", action: "api:delete" },
-  { code: "role:list", name: () => iamM("iam_seedPermRoleList"), type: "api", resource: "role", action: "list" },
-  { code: "role:api:create", name: () => iamM("iam_seedPermRoleApiCreate"), type: "api", resource: "role", action: "api:create" },
-  { code: "role:api:update", name: () => iamM("iam_seedPermRoleApiUpdate"), type: "api", resource: "role", action: "api:update" },
-  { code: "role:api:delete", name: () => iamM("iam_seedPermRoleApiDelete"), type: "api", resource: "role", action: "api:delete" },
-  { code: "permission:list", name: () => iamM("iam_seedPermPermList"), type: "api", resource: "permission", action: "list" },
-  { code: "permission:manage", name: () => iamM("iam_seedPermPermManage"), type: "api", resource: "permission", action: "manage" },
-  { code: "permission:api:create", name: () => iamM("iam_seedPermPermApiCreate"), type: "api", resource: "permission", action: "api:create" },
-  { code: "permission:api:delete", name: () => iamM("iam_seedPermPermApiDelete"), type: "api", resource: "permission", action: "api:delete" },
-  { code: "audit:read", name: () => iamM("iam_seedPermAuditRead"), type: "api", resource: "audit", action: "read" },
+  {
+    code: "user:list",
+    name: () => iamM("iam_seedPermUserList"),
+    type: "api",
+    resource: "user",
+    action: "list"
+  },
+  {
+    code: "user:api:create",
+    name: () => iamM("iam_seedPermUserApiCreate"),
+    type: "api",
+    resource: "user",
+    action: "api:create"
+  },
+  {
+    code: "user:api:update",
+    name: () => iamM("iam_seedPermUserApiUpdate"),
+    type: "api",
+    resource: "user",
+    action: "api:update"
+  },
+  {
+    code: "user:api:delete",
+    name: () => iamM("iam_seedPermUserApiDelete"),
+    type: "api",
+    resource: "user",
+    action: "api:delete"
+  },
+  {
+    code: "role:list",
+    name: () => iamM("iam_seedPermRoleList"),
+    type: "api",
+    resource: "role",
+    action: "list"
+  },
+  {
+    code: "role:api:create",
+    name: () => iamM("iam_seedPermRoleApiCreate"),
+    type: "api",
+    resource: "role",
+    action: "api:create"
+  },
+  {
+    code: "role:api:update",
+    name: () => iamM("iam_seedPermRoleApiUpdate"),
+    type: "api",
+    resource: "role",
+    action: "api:update"
+  },
+  {
+    code: "role:api:delete",
+    name: () => iamM("iam_seedPermRoleApiDelete"),
+    type: "api",
+    resource: "role",
+    action: "api:delete"
+  },
+  {
+    code: "permission:list",
+    name: () => iamM("iam_seedPermPermList"),
+    type: "api",
+    resource: "permission",
+    action: "list"
+  },
+  {
+    code: "permission:manage",
+    name: () => iamM("iam_seedPermPermManage"),
+    type: "api",
+    resource: "permission",
+    action: "manage"
+  },
+  {
+    code: "permission:api:create",
+    name: () => iamM("iam_seedPermPermApiCreate"),
+    type: "api",
+    resource: "permission",
+    action: "api:create"
+  },
+  {
+    code: "permission:api:delete",
+    name: () => iamM("iam_seedPermPermApiDelete"),
+    type: "api",
+    resource: "permission",
+    action: "api:delete"
+  },
+  {
+    code: "audit:read",
+    name: () => iamM("iam_seedPermAuditRead"),
+    type: "api",
+    resource: "audit",
+    action: "read"
+  },
   // ─── 按钮权限 ───
-  { code: "user:create", name: () => iamM("iam_seedPermUserCreate"), type: "button", resource: "user", action: "create" },
-  { code: "user:update", name: () => iamM("iam_seedPermUserUpdate"), type: "button", resource: "user", action: "update" },
-  { code: "user:delete", name: () => iamM("iam_seedPermUserDelete"), type: "button", resource: "user", action: "delete" },
-  { code: "role:create", name: () => iamM("iam_seedPermRoleCreate"), type: "button", resource: "role", action: "create" },
-  { code: "role:update", name: () => iamM("iam_seedPermRoleUpdate"), type: "button", resource: "role", action: "update" },
-  { code: "role:delete", name: () => iamM("iam_seedPermRoleDelete"), type: "button", resource: "role", action: "delete" },
-  { code: "permission:create", name: () => iamM("iam_seedPermPermCreate"), type: "button", resource: "permission", action: "create" },
-  { code: "permission:delete", name: () => iamM("iam_seedPermPermDelete"), type: "button", resource: "permission", action: "delete" }
+  {
+    code: "user:create",
+    name: () => iamM("iam_seedPermUserCreate"),
+    type: "button",
+    resource: "user",
+    action: "create"
+  },
+  {
+    code: "user:update",
+    name: () => iamM("iam_seedPermUserUpdate"),
+    type: "button",
+    resource: "user",
+    action: "update"
+  },
+  {
+    code: "user:delete",
+    name: () => iamM("iam_seedPermUserDelete"),
+    type: "button",
+    resource: "user",
+    action: "delete"
+  },
+  {
+    code: "role:create",
+    name: () => iamM("iam_seedPermRoleCreate"),
+    type: "button",
+    resource: "role",
+    action: "create"
+  },
+  {
+    code: "role:update",
+    name: () => iamM("iam_seedPermRoleUpdate"),
+    type: "button",
+    resource: "role",
+    action: "update"
+  },
+  {
+    code: "role:delete",
+    name: () => iamM("iam_seedPermRoleDelete"),
+    type: "button",
+    resource: "role",
+    action: "delete"
+  },
+  {
+    code: "permission:create",
+    name: () => iamM("iam_seedPermPermCreate"),
+    type: "button",
+    resource: "permission",
+    action: "create"
+  },
+  {
+    code: "permission:delete",
+    name: () => iamM("iam_seedPermPermDelete"),
+    type: "button",
+    resource: "permission",
+    action: "delete"
+  }
 ];
 var USER_ROLE_PERMISSIONS = ["dashboard:view", "profile:read"];
 async function seedIamData(authz) {
@@ -4459,7 +5211,12 @@ async function seedIamData(authz) {
         roleMap.set(role.code, existingId);
         continue;
       }
-      const result = await authz.createRole({ code: role.code, name: role.name(), description: role.description(), isSystem: role.isSystem });
+      const result = await authz.createRole({
+        code: role.code,
+        name: role.name(),
+        description: role.description(),
+        isSystem: role.isSystem
+      });
       if (result.success) {
         roleMap.set(role.code, result.data.id);
       } else if (result.error.code === HaiIamError.ROLE_ALREADY_EXISTS.code) {
@@ -4486,7 +5243,13 @@ async function seedIamData(authz) {
         permMap.set(perm.code, existingId);
         continue;
       }
-      const result = await authz.createPermission({ code: perm.code, name: perm.name(), type: perm.type, resource: perm.resource, action: perm.action });
+      const result = await authz.createPermission({
+        code: perm.code,
+        name: perm.name(),
+        type: perm.type,
+        resource: perm.resource,
+        action: perm.action
+      });
       if (result.success) {
         permMap.set(perm.code, result.data.id);
       } else if (result.error.code === HaiIamError.PERMISSION_ALREADY_EXISTS.code) {
@@ -4534,8 +5297,19 @@ function retainedUntil(entry) {
   return Math.max(new Date(entry.session.expiresAt).getTime(), entry.refreshToken ? entry.refreshExpiresAt : 0);
 }
 function restoreSession(session) {
-  const result = { ...session, createdAt: new Date(session.createdAt), startedAt: new Date(session.startedAt ?? session.createdAt), lastActiveAt: new Date(session.lastActiveAt), expiresAt: new Date(session.expiresAt) };
-  if (result.terminalType !== void 0 && !["web", "app", "desktop", "api"].includes(result.terminalType) || typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![result.createdAt, result.startedAt, result.lastActiveAt, result.expiresAt].every((date) => Number.isFinite(date.getTime()))) {
+  const result = {
+    ...session,
+    createdAt: new Date(session.createdAt),
+    startedAt: new Date(session.startedAt ?? session.createdAt),
+    lastActiveAt: new Date(session.lastActiveAt),
+    expiresAt: new Date(session.expiresAt)
+  };
+  if (result.terminalType !== void 0 && !["web", "app", "desktop", "api"].includes(result.terminalType) || typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![
+    result.createdAt,
+    result.startedAt,
+    result.lastActiveAt,
+    result.expiresAt
+  ].every((date) => Number.isFinite(date.getTime()))) {
     throw new TypeError("Invalid session state");
   }
   return result;
@@ -4692,7 +5466,10 @@ function createCacheSessionRepository(refreshTokenMaxAge, policy = {}) {
         const updated = applySessionPatch(restoreSession(entry.session), patch);
         if (![updated.expiresAt, updated.lastActiveAt].every((date) => Number.isFinite(date.getTime())))
           return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sessionMaxAgeInvalid"));
-        entry.session = { ...updated, version: crypto.randomUUID() };
+        entry.session = {
+          ...updated,
+          version: crypto.randomUUID()
+        };
         return ok(void 0);
       });
     },
@@ -4752,7 +5529,10 @@ function createCacheSessionRepository(refreshTokenMaxAge, policy = {}) {
             continue;
           if (entry.session.version !== version)
             return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
-          entry.session = { ...applySessionPatch(restoreSession(entry.session), patch), version: crypto.randomUUID() };
+          entry.session = {
+            ...applySessionPatch(restoreSession(entry.session), patch),
+            version: crypto.randomUUID()
+          };
         }
         return ok(void 0);
       });
@@ -4766,7 +5546,10 @@ function stripInternalSessionFields(session) {
     return session;
   const { _tokenPair, ...rest } = session.data;
   const hasExtraKeys = Object.keys(rest).length > 0;
-  return { ...session, data: hasExtraKeys ? rest : void 0 };
+  return {
+    ...session,
+    data: hasExtraKeys ? rest : void 0
+  };
 }
 var logger12 = core.logger.child({ module: "iam", scope: "session" });
 async function createSessionOperations(deps) {
@@ -4810,7 +5593,12 @@ function buildSessionFunctions(config) {
     if (!Number.isSafeInteger(ttl) || ttl <= 0 || !Number.isFinite(new Date(now.getTime() + ttl * 1e3).getTime()))
       return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sessionMaxAgeInvalid"));
     const accessToken = generateSessionToken(options.userId);
-    const tokens = { accessToken, refreshToken: generateSessionToken(options.userId), expiresIn: ttl, tokenType: "Bearer" };
+    const tokens = {
+      accessToken,
+      refreshToken: generateSessionToken(options.userId),
+      expiresIn: ttl,
+      tokenType: "Bearer"
+    };
     const session = buildSession(options, now, ttl, accessToken, credentialVersion);
     session.data = { ...session.data, _tokenPair: tokens };
     return ok({ session, tokens });
@@ -4836,7 +5624,12 @@ function buildSessionFunctions(config) {
       return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
     const found = await readIamCache(`apikey:${session.apiKeyId}`, async () => {
       const row = await config.apiKeyRepository.findOneById(session.apiKeyId);
-      return row.success ? ok(row.data ? { userId: row.data.userId, enabled: row.data.enabled, expiresAt: row.data.expiresAt?.getTime() ?? null, scopes: row.data.scopes } : null) : row;
+      return row.success ? ok(row.data ? {
+        userId: row.data.userId,
+        enabled: row.data.enabled,
+        expiresAt: row.data.expiresAt?.getTime() ?? null,
+        scopes: row.data.scopes
+      } : null) : row;
     });
     if (!found.success)
       return found;
@@ -4894,7 +5687,10 @@ function buildSessionFunctions(config) {
       const bound = await credential(session.userId, session.credentialVersion);
       if (!bound.success)
         return bound;
-      const validated = await validateApiKey({ ...session, ...bound.data.profile });
+      const validated = await validateApiKey({
+        ...session,
+        ...bound.data.profile
+      });
       if (!validated.success)
         return validated;
       let output = validated.data;
@@ -5038,7 +5834,9 @@ function hasUpdateFields(data) {
 function mapRepositoryError(messageKey, message) {
   return err(
     HaiIamError.REPOSITORY_ERROR,
-    iamM(messageKey, { params: { message } })
+    iamM(messageKey, {
+      params: { message }
+    })
   );
 }
 function mapUpdateErrorAsDomainError(error) {
@@ -5219,7 +6017,9 @@ function buildUserQueryOps(ctx) {
     async getUsers(userIds, options) {
       if (userIds.length > 1e3 || userIds.some((id) => typeof id !== "string" || !id.trim()))
         return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_batchUserIdsInvalid"));
-      const ids = [...new Set(userIds)];
+      const ids = [
+        ...new Set(userIds)
+      ];
       const found = /* @__PURE__ */ new Map();
       for (let offset = 0; offset < ids.length; offset += 500) {
         const batch = ids.slice(offset, offset + 500);
@@ -5229,7 +6029,9 @@ function buildUserQueryOps(ctx) {
         for (const user of users.data)
           found.set(user.id, toUser(user));
       }
-      const items = ids.flatMap((id) => found.has(id) ? [found.get(id)] : []);
+      const items = ids.flatMap((id) => found.has(id) ? [
+        found.get(id)
+      ] : []);
       if (options?.include?.includes("roles") && items.length) {
         const roles = await authzFunctions.getUserRolesForMany(items.map((user) => user.id));
         if (!roles.success)
@@ -5426,9 +6228,15 @@ function buildUserMutationOps(ctx) {
         if (updateResult.data.changes === 0)
           return err(HaiIamError.USER_NOT_FOUND, iamM("iam_userNotExist"));
         if (tx) {
-          const advanced = await tx.execute("UPDATE hai_iam_users SET credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL WHERE id = ? AND credential_version = ?", [globalThis.crypto.randomUUID(), globalThis.crypto.randomUUID(), userId, currentAccount.data.credentialVersion ?? ""]);
-          if (!advanced.success || advanced.data.changes !== 1)
+          const advanced = await tx.execute("UPDATE hai_iam_users SET credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL WHERE id = ? AND credential_version = ?", [
+            globalThis.crypto.randomUUID(),
+            globalThis.crypto.randomUUID(),
+            userId,
+            currentAccount.data.credentialVersion ?? ""
+          ]);
+          if (!advanced.success || advanced.data.changes !== 1) {
             return advanced.success ? err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict")) : advanced;
+          }
           const committed = await tx.commit();
           if (!committed.success)
             return committed;
@@ -5493,7 +6301,11 @@ function buildUserMutationOps(ctx) {
         await tx.rollback();
         return err(
           HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_deleteUserFailed", { params: { message: String(error) } }),
+          iamM("iam_deleteUserFailed", {
+            params: {
+              message: String(error)
+            }
+          }),
           error
         );
       }
@@ -5525,7 +6337,12 @@ function buildPasswordChangeOps(ctx) {
       const hashResult = hashPassword(newPassword);
       if (!hashResult.success)
         return hashResult;
-      const updateResult = await userRepository.setPassword({ userId, expectedVersion: userResult.data.credentialVersion ?? "", passwordHash: hashResult.data, mustChangePassword: ctx.config.password?.requireInitialChange === true });
+      const updateResult = await userRepository.setPassword({
+        userId,
+        expectedVersion: userResult.data.credentialVersion ?? "",
+        passwordHash: hashResult.data,
+        mustChangePassword: ctx.config.password?.requireInitialChange === true
+      });
       if (!updateResult.success)
         return updateResult;
       if (!updateResult.data)
@@ -5710,7 +6527,9 @@ function buildUserFunctions(deps) {
         return err(HaiIamError.INVITATION_DISABLED, iamM("iam_invitationDisabled"));
       const policy = deps.passwordStrategyResult.passwordConfig;
       const length = Math.min(policy.maxLength, Math.max(32, policy.minLength));
-      const password = `Aa1!${Array.from({ length: Math.ceil(length / 32) }, () => generateToken()).join("")}`.slice(0, length);
+      const password = `Aa1!${Array.from({
+        length: Math.ceil(length / 32)
+      }, () => generateToken()).join("")}`.slice(0, length);
       const created = await registration.createUser({ ...options, password });
       if (!created.success)
         return created;
@@ -5798,13 +6617,17 @@ var iam = {
       if (!reldb.isInitialized) {
         return err(
           HaiIamError.CONFIG_ERROR,
-          iamM("iam_depsNotInitialized", { params: { dep: "reldb" } })
+          iamM("iam_depsNotInitialized", {
+            params: { dep: "reldb" }
+          })
         );
       }
       if (!cache.isInitialized) {
         return err(
           HaiIamError.CONFIG_ERROR,
-          iamM("iam_depsNotInitialized", { params: { dep: "cache" } })
+          iamM("iam_depsNotInitialized", {
+            params: { dep: "cache" }
+          })
         );
       }
       if (!crypto$1.isInitialized) {
@@ -5822,13 +6645,19 @@ var iam = {
         logger14.error("IAM config validation failed", { error: parseResult.error.message });
         return err(
           HaiIamError.CONFIG_ERROR,
-          iamM("iam_configError", { params: { error: parseResult.error.message } }),
+          iamM("iam_configError", {
+            params: { error: parseResult.error.message }
+          }),
           parseResult.error
         );
       }
       const parsed = parseResult.data;
       const { onPasswordResetRequest, onOtpSendEmail, onOtpSendSms } = await resolveIamNotifications(config);
-      logger14.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
+      logger14.info("IAM notification channels resolved", {
+        email: Boolean(onOtpSendEmail),
+        sms: Boolean(onOtpSendSms),
+        passwordReset: Boolean(onPasswordResetRequest)
+      });
       const migration = await migrateIam();
       if (!migration.success)
         return migration;
@@ -5844,7 +6673,11 @@ var iam = {
             if (!passwordState.success)
               return passwordState;
           }
-          return ok(found.data ? { version: found.data.credentialVersion ?? "", available: isUserActive(found.data), profile: { username: found.data.username, displayName: found.data.displayName, avatarUrl: found.data.avatarUrl } } : null);
+          return ok(found.data ? {
+            version: found.data.credentialVersion ?? "",
+            available: isUserActive(found.data),
+            profile: { username: found.data.username, displayName: found.data.displayName, avatarUrl: found.data.avatarUrl }
+          } : null);
         }
       });
       if (!sessionResult.success) {
@@ -5889,7 +6722,12 @@ var iam = {
       currentAuthz = authorization;
       currentUser = users;
       currentConfig = parsed;
-      currentPublicConfig = buildIamPublicConfig(parsed, { ...config, onPasswordResetRequest, onOtpSendEmail, onOtpSendSms });
+      currentPublicConfig = buildIamPublicConfig(parsed, {
+        ...config,
+        onPasswordResetRequest,
+        onOtpSendEmail,
+        onOtpSendSms
+      });
       currentApiKey = authnResult.data.apiKeyFunctions ? observeApiKeys(authnResult.data.apiKeyFunctions) : null;
       currentTicket = createTicketOperations();
       const authn = authnResult.data.authn;
@@ -5944,7 +6782,18 @@ var iam = {
     const configured = await authz.getSensitiveOperations();
     if (!configured.success)
       return configured;
-    return ok({ ...snapshot, reauthentication: { ...snapshot.reauthentication, operations: [.../* @__PURE__ */ new Set([...snapshot.reauthentication.operations, ...configured.data])].sort() } });
+    return ok({
+      ...snapshot,
+      reauthentication: {
+        ...snapshot.reauthentication,
+        operations: [
+          .../* @__PURE__ */ new Set([
+            ...snapshot.reauthentication.operations,
+            ...configured.data
+          ])
+        ].sort()
+      }
+    });
   },
   get user() {
     return currentUser ?? notInitializedUser;