Atomically replace a still-current hash, increment its version, and revoke every session.
Persist a user provisioned by the application service.
Find a user by normalized login address for authentication.
Find an enabled user by id for current-user lookup; null when absent/disabled.
Update only the authenticated account's allowed profile fields.
Narrow identity persistence boundary used by authentication/provisioning.