@byline/admin 5.0.0 → 5.1.0

package/dist/modules/auth/refresh-tokens-repository.d.ts

@@ -19,6 +19,9 @@ export interface RefreshTokenRow {
     id: string;
     admin_user_id: string;
     token_hash: string;
+    /** Null only for legacy rows, which cannot authorize native sessions. */
+    sid: string | null;
+    session_version: number;
     issued_at: Date;
     expires_at: Date;
     revoked_at: Date | null;
@@ -28,9 +31,13 @@ export interface RefreshTokenRow {
     ip: string | null;
 }
 export interface IssueRefreshTokenInput {
+    /** Omitted only by legacy fixtures/imports; never accepted for native renewal. */
+    sid?: string | null;
     id: string;
     admin_user_id: string;
     token_hash: string;
+    /** Account generation observed under the native issuance lock. */
+    session_version: number;
     expires_at: Date;
     user_agent?: string | null;
     ip?: string | null;
@@ -43,19 +50,15 @@ export interface RefreshTokensRepository {
     /** Stamp `last_used_at` for observability. */
     touch(id: string, at?: Date): Promise<void>;
     /**
-     * Atomically revoke `oldId` and set its `rotated_to_id` to `newId`.
-     * Caller is responsible for inserting the new row (via `issue`) before
-     * calling this — ordering is a contract.
+     * Revoke `oldId` and set its `rotated_to_id` to `newId`. This is not
+     * independently a compare-and-swap. Native callers must hold the account
+     * lock, reread the predecessor, and insert the successor before this write,
+     * all through the same `withSessionLock` transaction.
      */
     markRotated(oldId: string, newId: string, at?: Date): Promise<void>;
     /** Revoke a single token. Idempotent. */
     revoke(id: string, at?: Date): Promise<void>;
-    /**
-     * Walk the rotation chain starting at `startId` and revoke every token
-     * in it. Called when a rotated token is replayed — indicates the chain
-     * has been compromised and every descendant is suspect. Returns the
-     * number of rows touched.
-     */
+    /** Revoke all refresh rows sharing the start member's sid, without traversal. */
     revokeChain(startId: string, at?: Date): Promise<number>;
     /** Revoke every non-revoked token for a user. Used on password change / sign-out everywhere. */
     revokeAllForUser(adminUserId: string, at?: Date): Promise<number>;

package/dist/modules/auth/resolve-actor.d.ts

@@ -7,6 +7,7 @@
  */
 import { AdminAuth } from '@byline/auth';
 import type { AdminStore } from '../../store.js';
+import type { AdminUserRow } from '../admin-users/repository.js';
 /**
  * Build an `AdminAuth` from a user id by reading the admin-users row and
  * collecting the distinct abilities granted through every role the user
@@ -22,3 +23,5 @@ import type { AdminStore } from '../../store.js';
  * `AdminStore` bundle; adapter-agnostic.
  */
 export declare function resolveActor(store: AdminStore, adminUserId: string): Promise<AdminAuth | null>;
+/** Internal helper: reuse the account snapshot already checked by native authentication. */
+export declare function resolveActorFromUser(store: AdminStore, user: AdminUserRow | null): Promise<AdminAuth | null>;

package/dist/modules/auth/resolve-actor.js

@@ -1,13 +1,16 @@
 import { AdminAuth } from "@byline/auth";
 async function resolveActor(store, adminUserId) {
     const user = await store.adminUsers.getById(adminUserId);
+    return resolveActorFromUser(store, user);
+}
+async function resolveActorFromUser(store, user) {
     if (!user) return null;
     if (!user.is_enabled) return null;
-    const abilities = await store.adminPermissions.listAbilitiesForUser(adminUserId);
+    const abilities = await store.adminPermissions.listAbilitiesForUser(user.id);
     return new AdminAuth({
         id: user.id,
         abilities,
         isSuperAdmin: user.is_super_admin
     });
 }
-export { resolveActor };
+export { resolveActor, resolveActorFromUser };

package/dist/modules/auth/sign-in-rate-limiter.d.ts

@@ -0,0 +1,48 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { PasswordSignInLimiter } from '@byline/auth';
+import type { RecurringTaskDefinition } from '@byline/core';
+export interface SignInRateLimitStore {
+    /** Atomically increment, saturating at limit + 1; true only for the first limit calls. */
+    consume(key: string, limit: number, expiresAt: Date): Promise<boolean>;
+    /** Remove at most 100 expired counters and return the number removed. */
+    purgeExpired(before: Date): Promise<number>;
+}
+export interface SignInRateLimitPolicy {
+    account: {
+        limit: number;
+        windowSeconds: number;
+    };
+    ip: {
+        limit: number;
+        windowSeconds: number;
+    };
+}
+export interface SignInSecurityEvent {
+    type: 'admitted' | 'denied' | 'capacity' | 'store-error' | 'cleanup-error' | 'success' | 'failure';
+    scope?: 'account' | 'ip';
+    /** Stable, pseudonymous digests for cross-network correlation. Never passwords or raw IPs. */
+    account?: string;
+    network?: string;
+}
+export interface SignInLimiterOptions {
+    onEvent?: (event: SignInSecurityEvent) => void;
+    slots?: number;
+    maxQueue?: number;
+    queueTimeoutMs?: number;
+    /** Also bounds counter creation when the provider or a denial completes very quickly. */
+    minimumSlotMs?: number;
+}
+/**
+ * Instantiate once per process. Acquire before consume and release in finally after verification.
+ * Network admission precedes account-plus-network admission. There is no account-wide lockout.
+ */
+export declare function createPasswordSignInLimiter(store: SignInRateLimitStore, secret: string | Uint8Array, policy?: SignInRateLimitPolicy, now?: () => number, options?: SignInLimiterOptions): PasswordSignInLimiter & {
+    cleanupTask: RecurringTaskDefinition;
+    dispose(): void;
+};

package/dist/modules/auth/sign-in-rate-limiter.js

@@ -0,0 +1,229 @@
+import { createHmac } from "node:crypto";
+import { isIP } from "node:net";
+const DEFAULT_POLICY = {
+    account: {
+        limit: 10,
+        windowSeconds: 900
+    },
+    ip: {
+        limit: 60,
+        windowSeconds: 60
+    }
+};
+const CLEANUP_TASK_NAME = 'auth.sign-in-counters.cleanup';
+function signInNetwork(ip) {
+    const version = isIP(ip);
+    if (4 === version) return ip;
+    if (6 !== version || ip.includes('%')) throw new Error('Invalid client address');
+    const canonical = new URL(`http://[${ip}]/`).hostname.slice(1, -1);
+    const mapped = /^::ffff:([0-9a-f]+):([0-9a-f]+)$/.exec(canonical);
+    if (mapped) {
+        const high = Number.parseInt(mapped[1], 16);
+        const low = Number.parseInt(mapped[2], 16);
+        return [
+            high >>> 8,
+            255 & high,
+            low >>> 8,
+            255 & low
+        ].join('.');
+    }
+    const [left, right] = canonical.split('::');
+    const head = left ? left.split(':') : [];
+    const tail = right ? right.split(':') : [];
+    const words = void 0 === right ? head : [
+        ...head,
+        ...Array(8 - head.length - tail.length).fill('0'),
+        ...tail
+    ];
+    return `${words.slice(0, 4).join(':')}::/64`;
+}
+function createPasswordSignInLimiter(store, secret, policy = DEFAULT_POLICY, now = Date.now, options = {}) {
+    const secretBytes = 'string' == typeof secret ? new TextEncoder().encode(secret) : secret;
+    if (secretBytes.byteLength < 32) throw new Error('Sign-in HMAC secret must contain at least 32 bytes');
+    const key = createHmac('sha256', secretBytes).update('byline:password-sign-in:v1').digest();
+    const digest = (value)=>createHmac('sha256', key).update(JSON.stringify(value)).digest('hex');
+    const rules = structuredClone(policy);
+    for (const rule of Object.values(rules))if (!Number.isSafeInteger(rule.limit) || rule.limit < 1 || rule.limit > 1000000 || !Number.isSafeInteger(rule.windowSeconds) || rule.windowSeconds < 1 || rule.windowSeconds > 86400) throw new Error('Invalid password sign-in rate limit policy');
+    const slots = options.slots ?? 1;
+    const maxQueue = options.maxQueue ?? 4;
+    const queueTimeoutMs = options.queueTimeoutMs ?? 250;
+    const minimumSlotMs = options.minimumSlotMs ?? 100;
+    for (const value of [
+        slots,
+        queueTimeoutMs,
+        minimumSlotMs
+    ])if (!Number.isSafeInteger(value) || value < 1 || value > 60000) throw new Error('Invalid sign-in capacity policy');
+    if (!Number.isSafeInteger(maxQueue) || maxQueue < 0 || maxQueue > 1000) throw new Error('Invalid sign-in queue size');
+    const diagnostics = new Map();
+    const emit = (event)=>{
+        try {
+            if (options.onEvent) options.onEvent(event);
+            else if ('admitted' !== event.type && 'success' !== event.type) {
+                const entry = diagnostics.get(event.type) ?? {
+                    last: -1 / 0,
+                    count: 0
+                };
+                entry.count++;
+                if (performance.now() - entry.last >= 10000) {
+                    console.warn('[byline:password-sign-in]', {
+                        ...event,
+                        count: entry.count
+                    });
+                    entry.last = performance.now();
+                    entry.count = 0;
+                }
+                diagnostics.set(event.type, entry);
+            }
+        } catch  {}
+    };
+    const identifiers = ({ email, ip })=>({
+            account: digest([
+                'account',
+                email.trim().toLowerCase()
+            ]),
+            network: digest([
+                'network',
+                signInNetwork(ip)
+            ])
+        });
+    let active = 0;
+    let disposed = false;
+    const queue = [];
+    const lease = ()=>{
+        active++;
+        const started = performance.now();
+        let released = false;
+        return ()=>{
+            if (released) return;
+            released = true;
+            setTimeout(()=>{
+                active--;
+                queue.shift()?.grant();
+            }, Math.max(0, minimumSlotMs - (performance.now() - started))).unref();
+        };
+    };
+    const cleanupTask = {
+        name: CLEANUP_TASK_NAME,
+        intervalMs: 60000,
+        leaseMs: 60000,
+        async run (context) {
+            const cutoff = new Date(now() - 300000);
+            try {
+                for(let batch = 0; batch < 32; batch++){
+                    context.signal.throwIfAborted();
+                    await context.heartbeat();
+                    if (await store.purgeExpired(cutoff) < 100) return {
+                        workRemaining: false
+                    };
+                }
+                return {
+                    workRemaining: true
+                };
+            } catch (error) {
+                emit({
+                    type: 'cleanup-error'
+                });
+                throw error;
+            }
+        }
+    };
+    return {
+        requiredCleanupTask: CLEANUP_TASK_NAME,
+        cleanupTask,
+        dispose () {
+            disposed = true;
+            for (const waiter of queue.splice(0))waiter.cancel();
+        },
+        async acquire () {
+            if (disposed) throw new Error('Sign-in limiter disposed');
+            if (active < slots) return lease();
+            if (queue.length >= maxQueue) {
+                emit({
+                    type: 'capacity'
+                });
+                return null;
+            }
+            return new Promise((resolve)=>{
+                const waiter = {
+                    grant: ()=>{
+                        clearTimeout(timeout);
+                        resolve(lease());
+                    },
+                    cancel: ()=>{
+                        clearTimeout(timeout);
+                        emit({
+                            type: 'capacity'
+                        });
+                        resolve(null);
+                    }
+                };
+                const timeout = setTimeout(()=>{
+                    queue.splice(queue.indexOf(waiter), 1);
+                    waiter.cancel();
+                }, queueTimeoutMs);
+                queue.push(waiter);
+            });
+        },
+        recordResult (input, outcome) {
+            emit({
+                type: outcome,
+                ...identifiers(input)
+            });
+        },
+        async consume (input) {
+            const time = now();
+            const network = signInNetwork(input.ip);
+            const ids = identifiers(input);
+            try {
+                await store.purgeExpired(new Date(time - 300000));
+                for (const [scope, identity] of [
+                    [
+                        'ip',
+                        network
+                    ],
+                    [
+                        'account',
+                        [
+                            input.email.trim().toLowerCase(),
+                            network
+                        ]
+                    ]
+                ]){
+                    const rule = rules[scope];
+                    const windowMs = 1000 * rule.windowSeconds;
+                    const end = (Math.floor(time / windowMs) + 1) * windowMs;
+                    if (!await store.consume(digest([
+                        scope,
+                        identity,
+                        end
+                    ]), rule.limit, new Date(end))) {
+                        emit({
+                            type: 'denied',
+                            scope,
+                            ...ids
+                        });
+                        return {
+                            allowed: false,
+                            retryAfterSeconds: Math.max(1, Math.ceil((end - time) / 1000))
+                        };
+                    }
+                }
+                emit({
+                    type: 'admitted',
+                    ...ids
+                });
+                return {
+                    allowed: true,
+                    retryAfterSeconds: 0
+                };
+            } catch (error) {
+                emit({
+                    type: 'store-error',
+                    ...ids
+                });
+                throw error;
+            }
+        }
+    };
+}
+export { createPasswordSignInLimiter };

package/dist/store.d.ts

@@ -8,8 +8,10 @@
 import type { AdminPermissionsRepository } from './modules/admin-permissions/repository.js';
 import type { AdminPreferencesRepository } from './modules/admin-preferences/repository.js';
 import type { AdminRolesRepository } from './modules/admin-roles/repository.js';
-import type { AdminUsersRepository } from './modules/admin-users/repository.js';
+import type { AdminUsersRepository, AdminUserWithPasswordRow } from './modules/admin-users/repository.js';
+import type { LoginSessionsRepository } from './modules/auth/login-sessions-repository.js';
 import type { RefreshTokensRepository } from './modules/auth/refresh-tokens-repository.js';
+import type { SignInRateLimitStore } from './modules/auth/sign-in-rate-limiter.js';
 /**
  * The bundle of repositories that `@byline/admin` needs from the DB
  * adapter. A DB adapter package (`@byline/db-postgres`, a future
@@ -19,11 +21,22 @@ import type { RefreshTokensRepository } from './modules/auth/refresh-tokens-repo
  * `JwtSessionProvider`, to `seedSuperAdmin`, and (later) to admin-user
  * and admin-role commands.
  *
- * Keeping the five repositories together as a single argument avoids
+ * Keeping the repositories together as a single argument avoids
  * exploding constructor signatures and makes "needs admin DB access" a
  * single, recognisable type.
  */
 export interface AdminStore {
+    /**
+     * Serialize native issuance/revocation against account mutations. Lock the
+     * account row first, then operate on refresh rows through the scoped store.
+     * The callback and all its writes commit together or roll back together.
+     * Never retain the scoped repositories beyond the callback. No automatic retries.
+     */
+    withSessionLock<T>(adminUserId: string, work: (store: AdminStore, user: AdminUserWithPasswordRow | null) => Promise<T>): Promise<T>;
+    /** Lock distinct account IDs in sorted order in one transaction for account-switch sign-in. */
+    withSessionLocks<T>(adminUserIds: string[], work: (store: AdminStore) => Promise<T>): Promise<T>;
+    loginSessions: LoginSessionsRepository;
+    signInRateLimits: SignInRateLimitStore;
     adminUsers: AdminUsersRepository;
     adminRoles: AdminRolesRepository;
     adminPermissions: AdminPermissionsRepository;

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/admin",
   "private": false,
   "license": "MPL-2.0",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -174,40 +174,40 @@
     "@codemirror/lang-sql": "^6.10.0",
     "@codemirror/lang-yaml": "^6.1.3",
     "@codemirror/language": "^6.12.4",
-    "@codemirror/state": "^6.7.1",
-    "@codemirror/view": "^6.43.9",
+    "@codemirror/state": "^6.7.4",
+    "@codemirror/view": "^6.43.11",
     "@lezer/highlight": "^1.2.3",
     "@tanstack/react-form-start": "^1.33.5",
     "clsx": "^2.1.1",
-    "jose": "^6.2.10",
+    "jose": "^6.2.12",
     "react-diff-viewer-continued": "^4.4.0",
     "uuid": "^14.0.2",
-    "zod": "^4.4.3",
-    "@byline/core": "5.0.0",
-    "@byline/analytics": "5.0.0",
-    "@byline/i18n": "5.0.0",
-    "@byline/ui": "5.0.0",
-    "@byline/auth": "5.0.0",
-    "@byline/analytics-agent": "5.0.0"
+    "zod": "^4.5.4",
+    "@byline/analytics": "5.1.0",
+    "@byline/analytics-agent": "5.1.0",
+    "@byline/core": "5.1.0",
+    "@byline/auth": "5.1.0",
+    "@byline/ui": "5.1.0",
+    "@byline/i18n": "5.1.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
+    "@biomejs/biome": "2.5.12",
     "@rsbuild/plugin-react": "^2.1.0",
-    "@rslib/core": "^0.23.2",
-    "@types/node": "^26.4.0",
+    "@rslib/core": "^1.0.0",
+    "@types/node": "^26.5.0",
     "@types/react": "19.2.18",
-    "@types/react-dom": "19.2.5",
-    "@vitejs/plugin-react": "^6.1.0",
+    "@types/react-dom": "19.2.7",
+    "@vitejs/plugin-react": "^6.1.1",
     "jsdom": "^30.0.1",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "typescript": "^7.0.2",
     "typescript-plugin-css-modules": "^5.2.0",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "publishConfig": {
     "access": "public",

package/src/modules/admin-account/components/change-password.test.tsx

@@ -0,0 +1,72 @@
+import { act } from 'react'
+
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  change: vi.fn(),
+  submit: null as
+    | null
+    | ((args: {
+        value: { currentPassword: string; newPassword: string; confirm: string }
+      }) => Promise<void>),
+}))
+vi.mock('@tanstack/react-form-start', () => ({
+  revalidateLogic: () => ({}),
+  useForm: (options: { onSubmit: typeof mocks.submit }) => {
+    mocks.submit = options.onSubmit
+    return { reset: vi.fn(), Field: () => null, Subscribe: () => null }
+  },
+}))
+vi.mock('../../../services/admin-services-context.js', () => ({
+  useBylineAdminServices: () => ({ changeAccountPassword: mocks.change }),
+}))
+vi.mock('@byline/i18n/react', () => ({
+  useTranslation: () => ({
+    t: (key: string) =>
+      ({
+        'account.changePassword.feedback.updated': 'Password updated.',
+        'auth.signIn.title': 'Sign in',
+      })[key] ?? key,
+  }),
+}))
+vi.mock('@byline/ui/react', () => ({
+  Alert: ({ children, role }: { children: React.ReactNode; role?: string }) => (
+    <div role={role}>{children}</div>
+  ),
+  Button: ({ children, onClick }: { children: React.ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  InputPassword: () => null,
+  LoaderEllipsis: () => null,
+}))
+
+import { ChangeAccountPassword } from './change-password.js'
+import type { AccountResponse } from '../index.js'
+
+let root: Root
+let container: HTMLDivElement
+beforeEach(() => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+  vi.clearAllMocks()
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+afterEach(async () => {
+  await act(async () => root.unmount())
+  container.remove()
+})
+it('keeps success confirmation and a sign-in action visible after completion', async () => {
+  const account = { id: 'account', vid: 1 } as AccountResponse
+  mocks.change.mockResolvedValue({ ...account, vid: 2 })
+  await act(async () => root.render(<ChangeAccountPassword account={account} />))
+  await act(async () => {
+    await mocks.submit?.({ value: { currentPassword: 'old', newPassword: 'new', confirm: 'new' } })
+  })
+  expect(container.querySelector('[role="status"]')?.textContent).toBe('Password updated.')
+  expect(container.querySelector('button')?.textContent).toBe('Sign in')
+  expect(container.querySelector('form')).toBeNull()
+})

package/src/modules/admin-account/components/change-password.tsx

@@ -19,10 +19,8 @@
  *     password surfaces as `admin.account.invalidCurrentPassword`.
  *   - Confirmation field catches typos before round-trip.
  *
- * Caveat: changing the password here does not revoke other active
- * sessions today. Existing access tokens stay valid until expiry
- * (~15 min); a "sign out everywhere on password change" follow-up
- * will close that gap.
+ * Successful password changes end native sessions. Confirmation remains visible
+ * until the user reloads the protected account page to reach sign-in.
  */
 
 import { useMemo, useState } from 'react'
@@ -127,6 +125,19 @@ export function ChangeAccountPassword({ account, onClose, onSuccess }: ChangePas
     },
   })
 
+  if (successMessage) {
+    return (
+      <div className={cx('byline-account-change-password-wrap', styles.wrap)}>
+        <div role="status">
+          <Alert intent="success">{successMessage}</Alert>
+        </div>
+        <Button type="button" intent="primary" onClick={() => window.location.reload()}>
+          {t('auth.signIn.title')}
+        </Button>
+      </div>
+    )
+  }
+
   return (
     <div className={cx('byline-account-change-password-wrap', styles.wrap)}>
       <form

package/src/modules/admin-account/service.ts

@@ -7,7 +7,10 @@
  */
 
 import { toAdminUser } from '../admin-users/dto.js'
-import { ERR_ADMIN_USER_EMAIL_IN_USE } from '../admin-users/errors.js'
+import {
+  ERR_ADMIN_USER_EMAIL_IN_USE,
+  ERR_ADMIN_USER_VERSION_CONFLICT,
+} from '../admin-users/errors.js'
 import { hashPassword, verifyPassword } from '../auth/password.js'
 import {
   ERR_ADMIN_ACCOUNT_INVALID_CURRENT_PASSWORD,
@@ -38,12 +41,8 @@ import type {
  *     in the new hash. A hijacked session cannot use this flow to lock
  *     out the legitimate owner.
  *
- * Note on session revocation: changing a password here does **not**
- * currently revoke other refresh tokens — existing access tokens stay
- * valid until their 15-minute expiry, and other refresh tokens remain
- * useable. A "sign out everywhere on password change" follow-up should
- * call `RefreshTokensRepository.revokeAllExcept(adminUserId, currentJti)`
- * once that lands.
+ * Native adapter password writes atomically advance the session generation and
+ * revoke every refresh session. External providers own their own revocation.
  */
 export class AdminAccountService {
   readonly #repo: AdminUsersRepository
@@ -97,6 +96,8 @@ export class AdminAccountService {
     const ok = await verifyPassword(request.currentPassword, withHash.password_hash)
     if (!ok) throw ERR_ADMIN_ACCOUNT_INVALID_CURRENT_PASSWORD()
 
+    if (withHash.vid !== request.vid) throw ERR_ADMIN_USER_VERSION_CONFLICT()
+
     const newHash = await hashPassword(request.newPassword)
     const row = await this.#repo.setPasswordHash(actorId, request.vid, newHash)
     return toAdminUser(row)

package/src/modules/admin-users/repository.ts

@@ -68,6 +68,8 @@ export interface AdminUserRow {
  */
 export interface AdminUserWithPasswordRow extends AdminUserRow {
   password_hash: string
+  /** Native session generation, independent of edit revisions. */
+  session_version: number
 }
 
 export interface CreateAdminUserInput {
@@ -158,16 +160,23 @@ export interface AdminUsersRepository {
    * Content update with optimistic concurrency. Throws
    * `AdminUsersError(VERSION_CONFLICT)` if the stored `vid` differs from
    * `expectedVid`. Bumps `vid` on success and returns the fresh row.
+   * A false `is_enabled` patch must atomically advance the native session
+   * generation and revoke refresh sessions, under the account row lock.
    */
   update(id: string, expectedVid: number, patch: UpdateAdminUserInput): Promise<AdminUserRow>
   /**
    * Replace the stored password hash with optimistic concurrency.
    * Version-gated on `expectedVid`. Caller supplies a pre-hashed PHC string.
+   * Atomically advance the native session generation and revoke every refresh
+   * session in the same transaction. Lock the account before refresh rows.
    * Returns the updated row so callers holding the edit form can refresh
    * their cached `vid` without a second round-trip.
    */
   setPasswordHash(id: string, expectedVid: number, passwordHash: string): Promise<AdminUserRow>
-  /** Toggle enabled state. Vid-less — admin intent is independent of other edits. */
+  /**
+   * Toggle enabled state. Disable must atomically advance the native session
+   * generation and revoke refresh sessions. Enable never resets the generation.
+   */
   setEnabled(id: string, enabled: boolean): Promise<void>
   /**
    * Set the admin interface locale preference. Vid-less — user preference

package/src/modules/auth/index.ts

@@ -21,9 +21,21 @@
  * against `@byline/auth` rather than added here.
  */
 
-export { JwtSessionProvider, type JwtSessionProviderConfig } from './jwt-session-provider.js'
+export {
+  JwtSessionProvider,
+  type JwtSessionProviderConfig,
+  type NativeSessionEvent,
+} from './jwt-session-provider.js'
 export { hashPassword, verifyPassword } from './password.js'
 export { resolveActor } from './resolve-actor.js'
+export {
+  createPasswordSignInLimiter,
+  type SignInLimiterOptions,
+  type SignInRateLimitPolicy,
+  type SignInRateLimitStore,
+  type SignInSecurityEvent,
+} from './sign-in-rate-limiter.js'
+export type { LoginSessionRow, LoginSessionsRepository } from './login-sessions-repository.js'
 export type {
   IssueRefreshTokenInput,
   RefreshTokenRow,