@byline/cli 4.19.0 → 5.1.0

package/dist/templates/byline-examples/scripts/regenerate-media-operation.ts

@@ -6,14 +6,10 @@
  * storage.
  */
 
-import type { CollectionHandle } from '@byline/client'
-import {
-  getDefaultStatus,
-  getWorkflowStatuses,
-  type CollectionDefinition,
-  type IDbAdapter,
-  type StoredFileValue,
-} from '@byline/core'
+import type { StoredFileValue } from '@byline/core'
+import { getDocumentHookCommittedDetails } from '@byline/core/services'
+
+export { replaceDocumentFieldsPreservingStatus as replaceMediaVersionPreservingStatus } from '@byline/core/services'
 
 export function storedFilePaths(value: StoredFileValue): Set<string> {
   return new Set([
@@ -47,66 +43,18 @@ export function assertCompleteVariantSet(
   }
 }
 
-/**
- * Write the regenerated fields and restore the captured workflow status as
- * one transaction.
- *
- * `CollectionHandle.update()` creates a new immutable version at the
- * collection's default status. For this maintenance operation, changing that
- * newly-created row to the captured status inside the same transaction is not
- * an editorial transition: no caller can observe the intermediate draft, and
- * an archived item never passes through published. The final version row and
- * its normal `document.updated` activity entry retain the resulting status;
- * the explicit status mutation is additionally audited as a system action.
- *
- * Direct adapter commands are intentional here and should not be copied into
- * ordinary application writes. Scripts are the supported escape hatch for
- * migrations that must preserve metadata while still using the lifecycle for
- * the content update itself.
- */
-export async function replaceMediaVersionPreservingStatus(params: {
-  db: IDbAdapter
-  definition: CollectionDefinition
-  collectionId: string
-  handle: Pick<CollectionHandle, 'update'>
-  documentId: string
-  fields: Record<string, any>
-  targetStatus: string
-}): Promise<{ documentVersionId: string }> {
-  const statuses = getWorkflowStatuses(params.definition).map((status) => status.name)
-  if (!statuses.includes(params.targetStatus)) {
-    throw new Error(
-      `regenerate-media: status '${params.targetStatus}' is not declared on collection ` +
-        `'${params.definition.path}' (declared: ${statuses.join(', ')}).`
-    )
+/** Only rejected document writes may discard freshly prepared storage objects. */
+export function mediaFailureOutcome(
+  error: unknown,
+  freshPaths: ReadonlySet<string>,
+  oldPaths: ReadonlySet<string>
+):
+  | { committed: true; revision: number; cleanupPaths: Set<string> }
+  | { committed: false; cleanupPaths: Set<string> } {
+  const committed = getDocumentHookCommittedDetails(error)
+  if (committed) return { committed: true, revision: committed.revision, cleanupPaths: new Set() }
+  return {
+    committed: false,
+    cleanupPaths: new Set([...freshPaths].filter((path) => !oldPaths.has(path))),
   }
-
-  const defaultStatus = getDefaultStatus(params.definition)
-  return params.db.withTransaction(async () => {
-    const result = await params.handle.update(params.documentId, params.fields)
-    if (params.targetStatus === defaultStatus) return result
-
-    await params.db.commands.documents.setDocumentStatus({
-      document_version_id: result.documentVersionId,
-      status: params.targetStatus,
-    })
-    if (params.targetStatus === 'published') {
-      await params.db.commands.documents.archivePublishedVersions({
-        document_id: params.documentId,
-        excludeVersionId: result.documentVersionId,
-      })
-    }
-    await params.db.commands.audit.append({
-      documentId: params.documentId,
-      collectionId: params.collectionId,
-      actorId: null,
-      actorRealm: 'system',
-      action: 'document.status.changed',
-      field: 'status',
-      before: defaultStatus,
-      after: params.targetStatus,
-    })
-
-    return result
-  })
 }

package/dist/templates/byline-examples/scripts/regenerate-media.ts

@@ -61,17 +61,14 @@ import path from 'node:path'
 
 import { createSuperAdminContext } from '@byline/auth'
 import { createBylineClient } from '@byline/client'
-import {
-  type FieldUploadContext,
-  getCollectionDefinition,
-  getServerConfig,
-} from '@byline/core'
+import { type FieldUploadContext, getCollectionDefinition, getServerConfig } from '@byline/core'
 import { extractImageMeta, generateImageVariants, isBypassMimeType } from '@byline/core/image'
 import { uploadField as coreUploadField } from '@byline/core/services'
-
 import type { MediaFields } from '@byline/generated-types'
+
 import {
   assertCompleteVariantSet,
+  mediaFailureOutcome,
   replaceMediaVersionPreservingStatus,
   storedFilePaths,
 } from './regenerate-media-operation.js'
@@ -120,14 +117,15 @@ async function run(): Promise<void> {
     id: string
     path: string
     status: string
+    revision: number
     fields: MediaFields
   }[] = []
   const pageSize = 100
   for (let page = 1; ; page++) {
-    const result = await handle.find({
+    const result = await handle.findForEdit({
+      locale: 'all',
       page,
       pageSize,
-      status: 'any',
       _bypassBeforeRead: true,
     })
     for (const d of result.docs) {
@@ -135,6 +133,7 @@ async function run(): Promise<void> {
         id: d.id,
         path: d.path,
         status: d.status,
+        revision: d.revision,
         fields: d.fields,
       })
     }
@@ -228,15 +227,10 @@ async function run(): Promise<void> {
       }
 
       const nextFields = { ...doc.fields, [FIELD_NAME]: uploadResult.storedFile }
-      await replaceMediaVersionPreservingStatus({
-        db: config.db,
-        definition,
-        collectionId,
-        handle,
-        documentId: doc.id,
-        fields: nextFields,
-        targetStatus: doc.status,
-      })
+      await replaceMediaVersionPreservingStatus(
+        { ...baseUploadCtx, requestContext },
+        { documentId: doc.id, data: nextFields, expectedRevision: doc.revision }
+      )
 
       const variantSummary =
         uploadResult.storedFile.variants?.map((v) => `${v.name}:${v.format ?? '?'}`).join(', ') ??
@@ -246,11 +240,11 @@ async function run(): Promise<void> {
       )
       processed += 1
     } catch (err) {
-      // The document transaction did not commit. Remove every fresh path we
-      // know about, but never delete a path that belonged to the old value — a
-      // deterministic beforeStore hook may already have overwritten it.
-      const rollbackPaths = new Set([...freshPaths].filter((storagePath) => !oldPaths.has(storagePath)))
-      const cleanupErrors = await deletePathsBestEffort(storage, rollbackPaths)
+      // A post-commit hook failure must retain the files referenced by the saved version.
+      // Rejected writes discard only fresh paths, preserving any reused original path.
+      const outcome = mediaFailureOutcome(err, freshPaths, oldPaths)
+      if (outcome.committed) processed += 1
+      const cleanupErrors = await deletePathsBestEffort(storage, outcome.cleanupPaths)
       const failure = asDocumentError(doc.id, doc.path, err)
       failures.push(
         cleanupErrors.length === 0
@@ -260,7 +254,10 @@ async function run(): Promise<void> {
               `regenerate-media: operation and rollback cleanup failed for '${doc.path}'`
             )
       )
-      console.error(`  ! fail ${doc.id} (${doc.path}):`, err)
+      console.error(
+        `  ! ${outcome.committed ? `saved revision ${outcome.revision}; hook failed` : 'fail'} ${doc.id} (${doc.path}):`,
+        err
+      )
     }
   }
 

package/dist/templates/byline-examples/seeds/site-settings.ts

@@ -11,14 +11,17 @@ import { getSystemBylineClient } from '@byline/client/server'
 /** Seed the singleton slot once, without overwriting later editorial changes. */
 export async function seedSiteSettings(): Promise<'seeded' | 'unchanged'> {
   const settings = getSystemBylineClient().singleton('site-settings')
-  const existing = await settings.get({ status: 'any' })
-  if (existing != null) return 'unchanged'
+  const existing = await settings.getForEdit()
+  if (existing?.state !== 'empty') return 'unchanged'
 
-  await settings.update({
-    siteName: 'Example site',
-    siteDescription:
-      'A concise description of this site for search results and social media previews.',
-  })
+  await settings.update(
+    {
+      siteName: 'Example site',
+      siteDescription:
+        'A concise description of this site for search results and social media previews.',
+    },
+    { expectedState: 'empty' }
+  )
   console.log('Seeded site settings')
   return 'seeded'
 }

package/dist/templates/dialects/mysql/byline/server.config.ts

@@ -14,7 +14,9 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { JwtSessionProvider } from '@byline/admin/auth'
+import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { getRequestIP } from '@tanstack/react-start/server'
+import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { getAdminBylineClient } from '@byline/client/server'
 import { type BylineCore, initBylineCore } from '@byline/core'
 import { mysqlAdapter } from '@byline/db-mysql'
@@ -67,6 +69,8 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     )
   }
 
+  const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
+
   const sessionProvider = new JwtSessionProvider({
     store: adminStore,
     signingSecret,
@@ -86,6 +90,16 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
       baseUrl: '/uploads',
     }),
     sessionProvider,
+    recurringTasks: [signInLimiter.cleanupTask],
+    passwordSignIn: {
+      limiter: signInLimiter,
+      resolveClientIp: createClientIpResolver({
+        // Opt in only when the proxy overwrites this header and direct access is blocked.
+        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+        resolvePeerIp: () => getRequestIP() ??
+          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      }),
+    },
     fields: {
       richText: {
         embed: lexicalEditorEmbedServer({ getClient: getAdminBylineClient }),

package/dist/templates/dialects/mysql/byline-examples/server.config.ts

@@ -11,7 +11,9 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { JwtSessionProvider } from '@byline/admin/auth'
+import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { getRequestIP } from '@tanstack/react-start/server'
+import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { getAdminBylineClient } from '@byline/client/server'
 import { type BylineCore, initBylineCore } from '@byline/core'
 import { mysqlAdapter } from '@byline/db-mysql'
@@ -75,6 +77,8 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     )
   }
 
+  const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
+
   const sessionProvider = new JwtSessionProvider({
     store: adminStore,
     signingSecret,
@@ -94,6 +98,16 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
       baseUrl: '/uploads',
     }),
     sessionProvider,
+    recurringTasks: [signInLimiter.cleanupTask],
+    passwordSignIn: {
+      limiter: signInLimiter,
+      resolveClientIp: createClientIpResolver({
+        // Opt in only when the proxy overwrites this header and direct access is blocked.
+        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+        resolvePeerIp: () => getRequestIP() ??
+          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      }),
+    },
     fields: {
       richText: {
         embed: lexicalEditorEmbedServer({ getClient: getAdminBylineClient }),

package/dist/templates/dialects/postgres/byline/server.config.ts

@@ -18,7 +18,9 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { JwtSessionProvider } from '@byline/admin/auth'
+import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { getRequestIP } from '@tanstack/react-start/server'
+import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { type BylineCore, initBylineCore } from '@byline/core'
 import { pgAdapter } from '@byline/db-postgres'
 import { createAdminStore } from '@byline/db-postgres/admin'
@@ -82,6 +84,8 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     )
   }
 
+  const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
+
   const sessionProvider = new JwtSessionProvider({
     store: adminStore,
     signingSecret,
@@ -136,6 +140,16 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     //   cacheControl: 'public, max-age=31536000, immutable',
     // }),
     sessionProvider,
+    recurringTasks: [signInLimiter.cleanupTask],
+    passwordSignIn: {
+      limiter: signInLimiter,
+      resolveClientIp: createClientIpResolver({
+        // Opt in only when the proxy overwrites this header and direct access is blocked.
+        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+        resolvePeerIp: () => getRequestIP() ??
+          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      }),
+    },
     fields: {
       richText: {
         embed: lexicalEditorEmbedServer({ getClient: getAdminBylineClient }),

package/dist/templates/dialects/postgres/byline-examples/scripts/re-anchor.ts

@@ -16,6 +16,7 @@
  * listed — that list is the outstanding-translation backlog. Re-run as
  * translation progresses; it is idempotent (each doc is its own transaction).
  *
+ * From the application directory containing byline/:
  *   pnpm tsx byline/scripts/re-anchor.ts --to fr
  *   pnpm tsx byline/scripts/re-anchor.ts --to fr --collection pages
  *   pnpm tsx byline/scripts/re-anchor.ts --to fr --dry-run
@@ -28,7 +29,7 @@ import '../server.config.js'
 
 import { parseArgs } from 'node:util'
 
-import { getBylineCore, getServerConfig } from '@byline/core'
+import { documentRevisionFromDatabase, getBylineCore, getServerConfig } from '@byline/core'
 import type { PgAdapter } from '@byline/db-postgres'
 
 const USAGE =
@@ -74,7 +75,19 @@ async function run() {
     `${dryRun ? '[dry-run] ' : ''}re-anchoring ${scope} → content source locale '${targetLocale}'…`
   )
 
-  const report = await db.reAnchorDocuments({ targetLocale, collectionId, dryRun })
+  // Capture each precondition before starting the batch; never refresh and retry a stale target.
+  const observed = await db.pool.query<{ document_id: string; revision: string }>(
+    `SELECT DISTINCT d.id AS document_id, d.revision
+     FROM byline_documents d JOIN byline_document_versions v ON v.document_id = d.id
+     WHERE v.is_deleted = false AND ($1::uuid IS NULL OR v.collection_id = $1::uuid)
+     ORDER BY d.id`,
+    [collectionId ?? null]
+  )
+  const targets = observed.rows.map((row) => ({
+    documentId: row.document_id,
+    expectedRevision: documentRevisionFromDatabase(row.revision),
+  }))
+  const report = await db.reAnchorDocuments({ targets, targetLocale, collectionId, dryRun })
 
   console.log(
     `${dryRun ? '[dry-run] would re-anchor' : '✓ re-anchored'} ${report.reanchored}/${report.total} document(s) → '${targetLocale}'`

package/dist/templates/dialects/postgres/byline-examples/server.config.ts

@@ -15,7 +15,9 @@
  */
 
 import { type AdminStore, registerAdminAbilities } from '@byline/admin'
-import { JwtSessionProvider } from '@byline/admin/auth'
+import { createPasswordSignInLimiter, JwtSessionProvider } from '@byline/admin/auth'
+import { getRequestIP } from '@tanstack/react-start/server'
+import { createClientIpResolver } from '@byline/host-tanstack-start/integrations/client-ip'
 import { type BylineCore, initBylineCore } from '@byline/core'
 import { pgAdapter } from '@byline/db-postgres'
 import { createAdminStore } from '@byline/db-postgres/admin'
@@ -130,6 +132,8 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     )
   }
 
+  const signInLimiter = createPasswordSignInLimiter(adminStore.signInRateLimits, signingSecret)
+
   const sessionProvider = new JwtSessionProvider({
     store: adminStore,
     signingSecret,
@@ -190,6 +194,16 @@ async function buildBylineCore(): Promise<BylineCore<AdminStore>> {
     //   cacheControl: 'public, max-age=31536000, immutable',
     // }),
     sessionProvider,
+    recurringTasks: [signInLimiter.cleanupTask],
+    passwordSignIn: {
+      limiter: signInLimiter,
+      resolveClientIp: createClientIpResolver({
+        // Opt in only when the proxy overwrites this header and direct access is blocked.
+        trustedProxyHeader: process.env.BYLINE_TRUSTED_CLIENT_IP_HEADER || undefined,
+        resolvePeerIp: () => getRequestIP() ??
+          (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null),
+      }),
+    },
     fields: {
       // Server-side richtext adapter — refreshes embedded relation
       // envelopes (link `{ title, path }`, inline-image `{ title, altText,

package/dist/templates/migrations/mysql/{0000_clean_magdalene.sql → 0000_kind_exodus.sql}

@@ -1,3 +1,12 @@
+CREATE TABLE `byline_admin_login_sessions` (
+	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`admin_user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`session_version` int NOT NULL,
+	`expires_at` datetime(6) NOT NULL,
+	`revoked_at` datetime(6),
+	CONSTRAINT `byline_admin_login_sessions_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
 CREATE TABLE `byline_admin_permissions` (
 	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`vid` int NOT NULL DEFAULT 1,
@@ -12,7 +21,9 @@ CREATE TABLE `byline_admin_permissions` (
 CREATE TABLE `byline_admin_refresh_tokens` (
 	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`admin_user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`sid` char(36) CHARACTER SET ascii COLLATE ascii_bin,
 	`token_hash` varchar(64) NOT NULL,
+	`session_version` int NOT NULL DEFAULT -1,
 	`issued_at` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
 	`expires_at` datetime(6) NOT NULL,
 	`revoked_at` datetime(6),
@@ -46,6 +57,13 @@ CREATE TABLE `byline_admin_roles` (
 	CONSTRAINT `byline_admin_roles_machine_name_unique` UNIQUE(`machine_name`)
 );
 --> statement-breakpoint
+CREATE TABLE `byline_admin_sign_in_rate_limits` (
+	`key` varchar(64) NOT NULL,
+	`attempts` int NOT NULL,
+	`expires_at` datetime(3) NOT NULL,
+	CONSTRAINT `byline_admin_sign_in_rate_limits_key` PRIMARY KEY(`key`)
+);
+--> statement-breakpoint
 CREATE TABLE `byline_admin_user_preferences` (
 	`user_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`scope` varchar(255) NOT NULL,
@@ -57,6 +75,7 @@ CREATE TABLE `byline_admin_user_preferences` (
 --> statement-breakpoint
 CREATE TABLE `byline_admin_users` (
 	`id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`session_version` int NOT NULL DEFAULT 0,
 	`vid` int NOT NULL DEFAULT 1,
 	`given_name` varchar(100),
 	`family_name` varchar(100),
@@ -173,6 +192,7 @@ CREATE TABLE `byline_document_publish_schedules` (
 	`document_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`collection_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`target_version_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+	`authorized_revision` bigint,
 	`publish_at` datetime(6) NOT NULL,
 	`state` varchar(32) NOT NULL DEFAULT 'armed',
 	`suspended_at` datetime(6),
@@ -189,8 +209,9 @@ CREATE TABLE `byline_document_publish_schedules` (
 	`attempt_count` int NOT NULL DEFAULT 0,
 	`last_error` text,
 	CONSTRAINT `byline_document_publish_schedules_document_id` PRIMARY KEY(`document_id`),
+	CONSTRAINT `check_publish_schedules_authorized_revision` CHECK(`byline_document_publish_schedules`.`authorized_revision` IS NULL OR `byline_document_publish_schedules`.`authorized_revision` BETWEEN 1 AND 9007199254740991),
 	CONSTRAINT `check_publish_schedules_state` CHECK(`byline_document_publish_schedules`.`state` IN ('armed', 'needs_reconfirm')),
-	CONSTRAINT `check_publish_schedules_suspended_reason` CHECK(`byline_document_publish_schedules`.`suspended_reason` IS NULL OR `byline_document_publish_schedules`.`suspended_reason` = 'content_edited')
+	CONSTRAINT `check_publish_schedules_suspended_reason` CHECK(`byline_document_publish_schedules`.`suspended_reason` IS NULL OR `byline_document_publish_schedules`.`suspended_reason` IN ('content_edited', 'document_metadata_changed', 'upgrade_invalidated'))
 );
 --> statement-breakpoint
 CREATE TABLE `byline_document_relationships` (
@@ -229,10 +250,12 @@ CREATE TABLE `byline_documents` (
 	`collection_id` char(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
 	`order_key` varchar(128) CHARACTER SET ascii COLLATE ascii_bin,
 	`source_locale` varchar(10) NOT NULL,
+	`revision` bigint NOT NULL,
 	`created_at` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
 	`updated_at` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
 	CONSTRAINT `byline_documents_id` PRIMARY KEY(`id`),
-	CONSTRAINT `uq_documents_collection_id_id` UNIQUE(`collection_id`,`id`)
+	CONSTRAINT `uq_documents_collection_id_id` UNIQUE(`collection_id`,`id`),
+	CONSTRAINT `check_documents_revision` CHECK(`byline_documents`.`revision` BETWEEN 1 AND 9007199254740991)
 );
 --> statement-breakpoint
 CREATE TABLE `byline_store_file` (
@@ -373,7 +396,9 @@ CREATE TABLE `byline_store_text` (
 	CONSTRAINT `unique_text_field` UNIQUE(`document_version_id`,`field_path`,`locale`)
 );
 --> statement-breakpoint
+ALTER TABLE `byline_admin_login_sessions` ADD CONSTRAINT `fk_admin_login_sessions_user` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_permissions` ADD CONSTRAINT `fk_admin_permissions_admin_role_id` FOREIGN KEY (`admin_role_id`) REFERENCES `byline_admin_roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `byline_admin_refresh_tokens` ADD CONSTRAINT `fk_admin_refresh_tokens_sid` FOREIGN KEY (`sid`) REFERENCES `byline_admin_login_sessions`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_refresh_tokens` ADD CONSTRAINT `fk_admin_refresh_tokens_admin_user_id` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_role_admin_user` ADD CONSTRAINT `fk_admin_role_admin_user_admin_role_id` FOREIGN KEY (`admin_role_id`) REFERENCES `byline_admin_roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_admin_role_admin_user` ADD CONSTRAINT `fk_admin_role_admin_user_admin_user_id` FOREIGN KEY (`admin_user_id`) REFERENCES `byline_admin_users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
@@ -410,11 +435,14 @@ ALTER TABLE `byline_store_relation` ADD CONSTRAINT `fk_store_relation_target_col
 ALTER TABLE `byline_singleton_documents` ADD CONSTRAINT `fk_singleton_documents_document` FOREIGN KEY (`collection_id`,`document_id`) REFERENCES `byline_documents`(`collection_id`,`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_store_text` ADD CONSTRAINT `fk_store_text_document_version_id` FOREIGN KEY (`document_version_id`) REFERENCES `byline_document_versions`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE `byline_store_text` ADD CONSTRAINT `fk_store_text_collection_id` FOREIGN KEY (`collection_id`) REFERENCES `byline_collections`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_admin_login_sessions_user` ON `byline_admin_login_sessions` (`admin_user_id`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_permissions_role` ON `byline_admin_permissions` (`admin_role_id`);--> statement-breakpoint
+CREATE INDEX `idx_admin_refresh_tokens_sid` ON `byline_admin_refresh_tokens` (`sid`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_refresh_tokens_user` ON `byline_admin_refresh_tokens` (`admin_user_id`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_refresh_tokens_token_hash` ON `byline_admin_refresh_tokens` (`token_hash`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_role_admin_user_user` ON `byline_admin_role_admin_user` (`admin_user_id`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_roles_machine_name` ON `byline_admin_roles` (`machine_name`);--> statement-breakpoint
+CREATE INDEX `idx_admin_sign_in_rate_limits_expiry` ON `byline_admin_sign_in_rate_limits` (`expires_at`);--> statement-breakpoint
 CREATE INDEX `idx_byline_admin_users_email` ON `byline_admin_users` (`email`);--> statement-breakpoint
 CREATE INDEX `idx_audit_log_document_id` ON `byline_audit_log` (`document_id`,`id`);--> statement-breakpoint
 CREATE INDEX `idx_audit_log_actor_id` ON `byline_audit_log` (`actor_id`,`id`);--> statement-breakpoint

package/dist/templates/migrations/mysql/meta/_journal.json

@@ -5,8 +5,8 @@
     {
       "idx": 0,
       "version": "5",
-      "when": 1787797706202,
-      "tag": "0000_clean_magdalene",
+      "when": 1788879988783,
+      "tag": "0000_kind_exodus",
       "breakpoints": true
     }
   ]

package/dist/templates/migrations/postgres/{0000_quiet_johnny_blaze.sql → 0000_lively_talisman.sql}

@@ -1,3 +1,11 @@
+CREATE TABLE "byline_admin_login_sessions" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"admin_user_id" uuid NOT NULL,
+	"session_version" integer NOT NULL,
+	"expires_at" timestamp (6) with time zone NOT NULL,
+	"revoked_at" timestamp (6) with time zone
+);
+--> statement-breakpoint
 CREATE TABLE "byline_admin_permissions" (
 	"id" uuid PRIMARY KEY NOT NULL,
 	"vid" integer DEFAULT 1 NOT NULL,
@@ -11,7 +19,9 @@ CREATE TABLE "byline_admin_permissions" (
 CREATE TABLE "byline_admin_refresh_tokens" (
 	"id" uuid PRIMARY KEY NOT NULL,
 	"admin_user_id" uuid NOT NULL,
+	"sid" uuid,
 	"token_hash" varchar(64) NOT NULL,
+	"session_version" integer DEFAULT -1 NOT NULL,
 	"issued_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
 	"expires_at" timestamp (6) with time zone NOT NULL,
 	"revoked_at" timestamp (6) with time zone,
@@ -43,6 +53,12 @@ CREATE TABLE "byline_admin_roles" (
 	CONSTRAINT "byline_admin_roles_machine_name_unique" UNIQUE("machine_name")
 );
 --> statement-breakpoint
+CREATE TABLE "byline_admin_sign_in_rate_limits" (
+	"key" varchar(64) PRIMARY KEY NOT NULL,
+	"attempts" integer NOT NULL,
+	"expires_at" timestamp (3) with time zone NOT NULL
+);
+--> statement-breakpoint
 CREATE TABLE "byline_admin_user_preferences" (
 	"user_id" uuid NOT NULL,
 	"scope" varchar(255) NOT NULL,
@@ -54,6 +70,7 @@ CREATE TABLE "byline_admin_user_preferences" (
 --> statement-breakpoint
 CREATE TABLE "byline_admin_users" (
 	"id" uuid PRIMARY KEY NOT NULL,
+	"session_version" integer DEFAULT 0 NOT NULL,
 	"vid" integer DEFAULT 1 NOT NULL,
 	"given_name" varchar(100),
 	"family_name" varchar(100),
@@ -163,6 +180,7 @@ CREATE TABLE "byline_document_publish_schedules" (
 	"document_id" uuid PRIMARY KEY NOT NULL,
 	"collection_id" uuid NOT NULL,
 	"target_version_id" uuid NOT NULL,
+	"authorized_revision" bigint,
 	"publish_at" timestamp (6) with time zone NOT NULL,
 	"state" varchar(32) DEFAULT 'armed' NOT NULL,
 	"suspended_at" timestamp (6) with time zone,
@@ -178,8 +196,9 @@ CREATE TABLE "byline_document_publish_schedules" (
 	"next_attempt_at" timestamp (6) with time zone NOT NULL,
 	"attempt_count" integer DEFAULT 0 NOT NULL,
 	"last_error" text,
+	CONSTRAINT "check_publish_schedules_authorized_revision" CHECK ("byline_document_publish_schedules"."authorized_revision" IS NULL OR "byline_document_publish_schedules"."authorized_revision" BETWEEN 1 AND 9007199254740991),
 	CONSTRAINT "check_document_publish_schedules_state" CHECK ("byline_document_publish_schedules"."state" IN ('armed', 'needs_reconfirm')),
-	CONSTRAINT "check_document_publish_schedules_suspended_reason" CHECK ("byline_document_publish_schedules"."suspended_reason" IS NULL OR "byline_document_publish_schedules"."suspended_reason" = 'content_edited')
+	CONSTRAINT "check_document_publish_schedules_suspended_reason" CHECK ("byline_document_publish_schedules"."suspended_reason" IS NULL OR "byline_document_publish_schedules"."suspended_reason" IN ('content_edited', 'document_metadata_changed', 'upgrade_invalidated'))
 );
 --> statement-breakpoint
 CREATE TABLE "byline_document_relationships" (
@@ -217,9 +236,11 @@ CREATE TABLE "byline_documents" (
 	"collection_id" uuid NOT NULL,
 	"order_key" varchar(128) COLLATE "C",
 	"source_locale" varchar(10) NOT NULL,
+	"revision" bigint NOT NULL,
 	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
 	"updated_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
-	CONSTRAINT "uq_documents_collection_id_id" UNIQUE("collection_id","id")
+	CONSTRAINT "uq_documents_collection_id_id" UNIQUE("collection_id","id"),
+	CONSTRAINT "check_documents_revision" CHECK ("byline_documents"."revision" BETWEEN 1 AND 9007199254740991)
 );
 --> statement-breakpoint
 CREATE TABLE "byline_store_file" (
@@ -352,8 +373,10 @@ CREATE TABLE "byline_store_text" (
 	CONSTRAINT "unique_text_field" UNIQUE("document_version_id","field_path","locale")
 );
 --> statement-breakpoint
+ALTER TABLE "byline_admin_login_sessions" ADD CONSTRAINT "byline_admin_login_sessions_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_permissions" ADD CONSTRAINT "byline_admin_permissions_admin_role_id_byline_admin_roles_id_fk" FOREIGN KEY ("admin_role_id") REFERENCES "public"."byline_admin_roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_refresh_tokens" ADD CONSTRAINT "byline_admin_refresh_tokens_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "byline_admin_refresh_tokens" ADD CONSTRAINT "byline_admin_refresh_tokens_sid_byline_admin_login_sessions_id_fk" FOREIGN KEY ("sid") REFERENCES "public"."byline_admin_login_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_role_admin_user" ADD CONSTRAINT "byline_admin_role_admin_user_admin_role_id_byline_admin_roles_id_fk" FOREIGN KEY ("admin_role_id") REFERENCES "public"."byline_admin_roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_role_admin_user" ADD CONSTRAINT "byline_admin_role_admin_user_admin_user_id_byline_admin_users_id_fk" FOREIGN KEY ("admin_user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_admin_user_preferences" ADD CONSTRAINT "byline_admin_user_preferences_user_id_byline_admin_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."byline_admin_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
@@ -389,11 +412,14 @@ ALTER TABLE "byline_store_relation" ADD CONSTRAINT "byline_store_relation_target
 ALTER TABLE "byline_singleton_documents" ADD CONSTRAINT "fk_singleton_documents_document" FOREIGN KEY ("collection_id","document_id") REFERENCES "public"."byline_documents"("collection_id","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_store_text" ADD CONSTRAINT "byline_store_text_document_version_id_byline_document_versions_id_fk" FOREIGN KEY ("document_version_id") REFERENCES "public"."byline_document_versions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "byline_store_text" ADD CONSTRAINT "byline_store_text_collection_id_byline_collections_id_fk" FOREIGN KEY ("collection_id") REFERENCES "public"."byline_collections"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_admin_login_sessions_user" ON "byline_admin_login_sessions" USING btree ("admin_user_id");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_permissions_role" ON "byline_admin_permissions" USING btree ("admin_role_id");--> statement-breakpoint
+CREATE INDEX "idx_admin_refresh_tokens_sid" ON "byline_admin_refresh_tokens" USING btree ("sid");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_refresh_tokens_user" ON "byline_admin_refresh_tokens" USING btree ("admin_user_id");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_refresh_tokens_token_hash" ON "byline_admin_refresh_tokens" USING btree ("token_hash");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_role_admin_user_user" ON "byline_admin_role_admin_user" USING btree ("admin_user_id");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_roles_machine_name" ON "byline_admin_roles" USING btree ("machine_name");--> statement-breakpoint
+CREATE INDEX "idx_admin_sign_in_rate_limits_expiry" ON "byline_admin_sign_in_rate_limits" USING btree ("expires_at");--> statement-breakpoint
 CREATE INDEX "idx_byline_admin_users_email" ON "byline_admin_users" USING btree ("email");--> statement-breakpoint
 CREATE INDEX "idx_audit_log_document_id" ON "byline_audit_log" USING btree ("document_id","id");--> statement-breakpoint
 CREATE INDEX "idx_audit_log_actor_id" ON "byline_audit_log" USING btree ("actor_id","id");--> statement-breakpoint

package/dist/templates/migrations/postgres/meta/_journal.json

@@ -5,8 +5,8 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1787797717481,
-      "tag": "0000_quiet_johnny_blaze",
+      "when": 1788880329240,
+      "tag": "0000_lively_talisman",
       "breakpoints": true
     }
   ]