@lupinum/better-convex-nuxt 1.0.0-beta.3 → 1.0.0-beta.5

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=4.5.2 <5"
   },
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.5",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/cli/convex.d.ts

@@ -1,11 +1,19 @@
 #!/usr/bin/env node
 type ConvexAuthorityKind = 'deployment-key' | 'deployment-name' | 'self-hosted';
+export interface ConvexAuthoritySnapshot {
+    digest: string;
+    development: boolean;
+    label: string;
+}
 /** Validate that the fixed file contains one, and only one, deployment selector class. */
 export declare function assertConvexAuthoritySelection(environment: Readonly<Record<string, string>>): ConvexAuthorityKind;
 /** Build a child environment whose only Convex authority comes from the fixed file. */
 export declare function buildConvexCommandEnvironment(inherited: Readonly<Record<string, string | undefined>>, authorityFile: Readonly<Record<string, string>>): Record<string, string>;
+export declare function inspectConvexAuthority(cwd?: string): Promise<ConvexAuthoritySnapshot>;
 export declare function runConvexCommand(arguments_: readonly string[], options?: {
     cwd?: string;
+    developmentOnly?: boolean;
+    expectedAuthorityDigest?: string;
     inheritedEnvironment?: NodeJS.ProcessEnv;
     input?: string;
     onStdout?: (output: string) => void;

package/dist/runtime/cli/convex.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { stat, readFile } from "node:fs/promises";
 import { resolve } from "node:path";
@@ -176,6 +177,21 @@ async function readAuthorityFile(cwd) {
     throw new Error("The Convex authority file is missing, invalid, or too large.");
   }
 }
+function snapshotAuthority(environment) {
+  const kind = assertConvexAuthoritySelection(environment);
+  const selector = TOKEN_SELECTORS.map((name) => environment[name]).find(Boolean) ?? environment.CONVEX_DEPLOYMENT ?? "self-hosted";
+  const publicSelector = selector.includes("|") ? selector.slice(0, selector.indexOf("|")) : selector;
+  const development = kind === "deployment-key" && publicSelector.startsWith("dev:") || kind === "deployment-name" && /^(?:anonymous:anonymous-|dev:|local:)/u.test(publicSelector);
+  const canonicalAuthority = Object.entries(environment).filter(([name]) => ALLOWED_CONVEX_FILE_NAMES.has(name)).sort(([left], [right]) => left.localeCompare(right));
+  return {
+    digest: createHash("sha256").update(JSON.stringify(canonicalAuthority)).digest("hex"),
+    development,
+    label: kind === "self-hosted" ? "self-hosted deployment" : publicSelector
+  };
+}
+export async function inspectConvexAuthority(cwd = process.cwd()) {
+  return snapshotAuthority(await readAuthorityFile(resolve(cwd)));
+}
 function usage() {
   return [
     "Run the pinned Convex CLI with one explicit deployment authority.",
@@ -224,6 +240,13 @@ export async function runConvexCommand(arguments_, options = {}) {
     assertFileBoundArguments(commandArguments);
     const authorityFile = await readAuthorityFile(cwd);
     const authorityKind = assertConvexAuthoritySelection(authorityFile);
+    const authority = snapshotAuthority(authorityFile);
+    if (options.developmentOnly && !authority.development) {
+      throw new Error("This command requires development, local, or anonymous authority.");
+    }
+    if (options.expectedAuthorityDigest !== void 0 && authority.digest !== options.expectedAuthorityDigest) {
+      throw new Error("The Convex authority file changed after the operation was confirmed.");
+    }
     const deploymentKey = TOKEN_SELECTORS.map((name) => authorityFile[name]).find(Boolean);
     if (command === "deploy" && authorityKind === "deployment-name") {
       throw new Error("Deploy requires a deployment-scoped key or self-hosted authority.");

package/dist/runtime/cli/init.d.ts

@@ -1,6 +1,7 @@
 export interface InitDependencies {
     confirm(message: string): Promise<boolean>;
     prompt(message: string, defaultValue: string): Promise<string>;
+    readDevelopmentAuthorityLabel(): Promise<string>;
     runConvex(args: readonly string[], input?: string): Promise<number>;
     readEnvironmentNames(): Promise<ReadonlySet<string>>;
     generateSchema(args: readonly string[]): Promise<number>;

package/dist/runtime/cli/init.js

@@ -3,7 +3,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { runAuthSchemaCommand } from "./auth-schema.js";
-import { runConvexCommand } from "./convex.js";
+import { inspectConvexAuthority, runConvexCommand } from "./convex.js";
 const templates = {
   "convex/auth.config.ts": `import { getConvexAuthProvider } from '@lupinum/better-convex-nuxt/better-auth/server'
 import type { AuthConfig } from 'convex/server'
@@ -42,7 +42,7 @@ import schema from './schema'
 import schemaMetadata from './schemaMetadata'
 
 // This module is inside the isolated betterAuth component, not the public app API.
-export const { assertProfile, consumeOne, count, create, deleteMany, deleteOne, findMany, findOne, incrementOne, rotateSigningKey, sessionAdmission, expireWorkforceSession, listWorkforceSessions, revokeAllWorkforceSessions, revokeWorkforceSession, touchWorkforceSession, updateMany, updateOne } = defineAuthAdapterFunctions({ metadata: schemaMetadata, schema })
+export const { assertProfile, consumeOne, consumeRateLimit, count, create, deleteMany, deleteOne, findMany, findOne, incrementOne, rotateSigningKey, sessionAdmission, expireWorkforceSession, listWorkforceSessions, revokeAllWorkforceSessions, revokeWorkforceSession, touchWorkforceSession, updateMany, updateOne } = defineAuthAdapterFunctions({ metadata: schemaMetadata, schema })
 `,
   "convex/betterAuth/convex.config.ts": `import { defineComponent } from 'convex/server'
 
@@ -88,7 +88,26 @@ async function readOptional(path) {
     throw error;
   }
 }
-function defaultDependencies() {
+function defaultDependencies(root) {
+  let authorityPromise;
+  const developmentAuthority = async () => {
+    authorityPromise ??= inspectConvexAuthority(root);
+    const authority = await authorityPromise;
+    if (!authority.development) {
+      throw new Error("better-convex init refuses production or unclassified authority");
+    }
+    return authority;
+  };
+  const runDevelopmentConvex = async (args, options = {}) => {
+    const authority = await developmentAuthority();
+    return await runConvexCommand(args, {
+      ...options,
+      cwd: root,
+      developmentOnly: true,
+      expectedAuthorityDigest: authority.digest,
+      quiet: true
+    });
+  };
   async function question(message) {
     const terminal = createInterface({ input: process.stdin, output: process.stdout });
     try {
@@ -106,11 +125,13 @@ function defaultDependencies() {
       const answer = (await question(`${message} [${defaultValue}] `)).trim();
       return answer || defaultValue;
     },
-    runConvex: async (args, input) => await runConvexCommand(args, { input, quiet: true }),
+    async readDevelopmentAuthorityLabel() {
+      return (await developmentAuthority()).label;
+    },
+    runConvex: async (args, input) => await runDevelopmentConvex(args, { input }),
     async readEnvironmentNames() {
       let output = "";
-      const status = await runConvexCommand(["env", "list", "--names-only"], {
-        quiet: true,
+      const status = await runDevelopmentConvex(["env", "list", "--names-only"], {
         onStdout: (value) => {
           output += value;
         }
@@ -218,9 +239,9 @@ export async function runInitCommand(args, overrides = {}) {
     console.log("Usage: better-convex init [--typed-client]");
     return 0;
   }
-  const defaults = defaultDependencies();
-  const dependencies = { ...defaults, ...overrides };
   const root = process.cwd();
+  const defaults = defaultDependencies(root);
+  const dependencies = { ...defaults, ...overrides };
   const schemaPath = join(root, "convex/betterAuth/schema.ts");
   const metadataPath = join(root, "convex/betterAuth/schemaMetadata.ts");
   const [schema, metadata] = await Promise.all([
@@ -256,7 +277,10 @@ export async function runInitCommand(args, overrides = {}) {
       "Generated auth schema conflicts with the reviewed plugin profile. Run better-convex auth schema and review the diff manually."
     );
   }
-  if (!await dependencies.confirm("Provision development secrets and the first signing key?")) {
+  const authorityLabel = await dependencies.readDevelopmentAuthorityLabel();
+  if (!await dependencies.confirm(
+    `Provision development secrets and the first signing key in ${authorityLabel}?`
+  )) {
     return 0;
   }
   await provisionDevelopment(dependencies);

package/dist/runtime/convex-auth/adapter/define-functions.d.ts

@@ -183,7 +183,13 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             cursor: string | null;
         };
         model: string;
-    }, Promise<import("convex/server").PaginationResult<Record<string, string | number | boolean | string[] | number[] | null>>>>;
+    }, Promise<{
+        page: Record<string, string | number | boolean | string[] | number[] | null>[];
+        isDone: boolean;
+        continueCursor: import("convex/server").Cursor;
+        splitCursor?: import("convex/server").Cursor | null;
+        pageStatus?: "SplitRecommended" | "SplitRequired" | null;
+    }>>;
     count: import("convex/server").RegisteredQuery<"public", {
         where?: {
             mode?: "sensitive" | "insensitive" | undefined;
@@ -294,6 +300,18 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             field: string;
         }[];
     }, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>;
+    consumeRateLimit: import("convex/server").RegisteredMutation<"public", {
+        window: number;
+        key: string;
+        max: number;
+        retentionWindow: number;
+    }, Promise<{
+        allowed: boolean;
+        retryAfter: null;
+    } | {
+        allowed: boolean;
+        retryAfter: number;
+    }>>;
     incrementOne: import("convex/server").RegisteredMutation<"public", {
         set?: any;
         workforce?: {

package/dist/runtime/convex-auth/adapter/define-functions.js

@@ -78,6 +78,7 @@ const readArgs = {
   offset: v.optional(v.number())
 };
 const expireSessionReference = makeFunctionReference("adapter:expireWorkforceSession");
+const pruneRateLimitsReference = makeFunctionReference("adapter:deleteMany");
 function assertRecord(value, code) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(code);
 }
@@ -222,7 +223,7 @@ export function defineAuthAdapterFunctions({
 }) {
   assertAuthSchemaMatchesMetadata(schema, metadata);
   const workforce = hasWorkforceSchema(metadata);
-  const workforcePolicy = createWorkforceAdapterPolicy(workforce);
+  const workforcePolicy = createWorkforceAdapterPolicy(workforce, metadata);
   const relationships = createAuthRelationshipEngine({
     schema,
     metadata,
@@ -272,7 +273,6 @@ export function defineAuthAdapterFunctions({
       args: { storageId: v.id("session") },
       returns: v.null(),
       handler: async (ctx, args) => {
-        requireWorkforce();
         const next = await expireWorkforceSession(ctx, args.storageId);
         if (next !== null) await ctx.scheduler.runAt(next, expireSessionReference, args);
         return null;
@@ -314,7 +314,11 @@ export function defineAuthAdapterFunctions({
         workforceConsumedChallenge: v.optional(workforceConsumedChallengeValidator)
       },
       handler: async (ctx, args) => {
-        let row = normalizeCreate(metadata, args.model, args.data);
+        let row = normalizeCreate(
+          metadata,
+          args.model,
+          await workforcePolicy.prepareCreateInput(ctx, args.model, args.data)
+        );
         await relationships.assertTargets(ctx, args.model, row);
         await assertUniqueConstraints(ctx, schema, metadata, args.model, row);
         row = await workforcePolicy.prepareCreate(
@@ -335,7 +339,7 @@ export function defineAuthAdapterFunctions({
         if (!finalRow) throw new Error("AUTH_CREATE_TRIGGER_DELETED_ROW");
         await workforcePolicy.scheduleCreatedSession(args.model, finalRow, async (expiresAt) => {
           const sessionId = ctx.db.normalizeId("session", storageId);
-          if (!sessionId) throw new Error("AUTH_WORKFORCE_SESSION_INVALID");
+          if (!sessionId) throw new Error("AUTH_SESSION_INVALID");
           await ctx.scheduler.runAt(expiresAt, expireSessionReference, { storageId: sessionId });
         });
         return toBetterAuthDocument(finalRow);
@@ -349,10 +353,20 @@ export function defineAuthAdapterFunctions({
         workforce: v.optional(workforceOperationValidator)
       },
       handler: async (ctx, args) => {
-        const rows = await findAuthRows(ctx, schema, metadata, readShape(args), 2);
+        const requested = readShape(args);
+        const rows = await findAuthRows(
+          ctx,
+          schema,
+          metadata,
+          {
+            ...requested,
+            select: workforcePolicy.prepareReadSelect(args.model, requested.select)
+          },
+          2
+        );
         const row = oneOrNull(rows, "AUTH_FIND_ONE");
         const view = await workforcePolicy.projectFind(ctx, args.model, row, args.workforce);
-        return toBetterAuthDocument(view, args.select);
+        return toBetterAuthDocument(view, requested.select);
       }
     }),
     findMany: queryGeneric({
@@ -364,14 +378,21 @@ export function defineAuthAdapterFunctions({
         paginationOpts: paginationOptsValidator
       },
       handler: async (ctx, args) => {
+        const requested = readShape(args);
         const result = await paginateAuthRows(
           ctx,
           schema,
           metadata,
-          readShape(args),
+          {
+            ...requested,
+            select: workforcePolicy.prepareReadSelect(args.model, requested.select)
+          },
           args.paginationOpts
         );
-        return args.limit === void 0 ? result : { ...result, page: result.page.slice(0, args.limit) };
+        const page = (await Promise.all(
+          result.page.map((row) => workforcePolicy.projectFind(ctx, args.model, row))
+        )).filter((row) => row !== null).map((row) => toBetterAuthDocument(row, requested.select));
+        return { ...result, page: args.limit === void 0 ? page : page.slice(0, args.limit) };
       }
     }),
     count: queryGeneric({
@@ -495,6 +516,12 @@ export function defineAuthAdapterFunctions({
         onUpdateModels: v.optional(v.array(v.string()))
       },
       handler: async (ctx, args) => {
+        const invalidated = await workforcePolicy.invalidateSessionCollection(
+          ctx,
+          args.model,
+          args.where
+        );
+        if (invalidated !== null) return invalidated;
         const rows = await workforcePolicy.expiredVerificationRows(ctx, args.model, args.where) ?? await relationships.collectOperationRows(ctx, readShape(args));
         await relationships.applyDeletion(ctx, rows, args.model, args);
         return rows.length;
@@ -521,6 +548,74 @@ export function defineAuthAdapterFunctions({
         return toBetterAuthDocument(current);
       }
     }),
+    consumeRateLimit: mutationGeneric({
+      args: {
+        key: v.string(),
+        max: v.number(),
+        retentionWindow: v.number(),
+        window: v.number()
+      },
+      returns: v.object({
+        allowed: v.boolean(),
+        retryAfter: v.union(v.number(), v.null())
+      }),
+      handler: async (ctx, args) => {
+        const windowInMs = args.window * 1e3;
+        const retentionWindowInMs = args.retentionWindow * 1e3;
+        if (args.key.length === 0 || !Number.isSafeInteger(args.max) || args.max <= 0 || !Number.isFinite(args.window) || args.window <= 0 || !Number.isFinite(args.retentionWindow) || args.retentionWindow < args.window || !Number.isFinite(windowInMs) || !Number.isFinite(retentionWindowInMs)) {
+          throw new Error("AUTH_RATE_LIMIT_RULE_INVALID");
+        }
+        const now = Date.now();
+        const current = oneOrNull(
+          await findAuthRows(
+            ctx,
+            schema,
+            metadata,
+            { model: "rateLimit", where: [{ field: "key", value: args.key }] },
+            2
+          ),
+          "AUTH_RATE_LIMIT"
+        );
+        if (!current) {
+          await ctx.db.insert(
+            "rateLimit",
+            { id: args.key, key: args.key, count: 1, lastRequest: now }
+          );
+          return { allowed: true, retryAfter: null };
+        }
+        if (typeof current.count !== "number" || !Number.isSafeInteger(current.count) || current.count < 0 || typeof current.lastRequest !== "number" || !Number.isFinite(current.lastRequest)) {
+          throw new Error("AUTH_RATE_LIMIT_ROW_INVALID");
+        }
+        if (now - current.lastRequest >= windowInMs) {
+          await ctx.db.patch(current._id, { count: 1, lastRequest: now });
+          await ctx.scheduler.runAfter(0, pruneRateLimitsReference, {
+            model: "rateLimit",
+            where: [
+              {
+                field: "lastRequest",
+                operator: "lt",
+                value: now - retentionWindowInMs
+              }
+            ]
+          });
+          return { allowed: true, retryAfter: null };
+        }
+        if (current.count >= args.max) {
+          return {
+            allowed: false,
+            retryAfter: Math.max(1, Math.ceil((current.lastRequest + windowInMs - now) / 1e3))
+          };
+        }
+        await ctx.db.patch(
+          current._id,
+          {
+            count: current.count + 1,
+            lastRequest: now
+          }
+        );
+        return { allowed: true, retryAfter: null };
+      }
+    }),
     incrementOne: mutationGeneric({
       returns: v.union(authDocumentValidator, v.null()),
       args: {

package/dist/runtime/convex-auth/adapter/generate-schema.js

@@ -1,6 +1,40 @@
 import {
   fingerprintAuthSchemaModels
 } from "./metadata.js";
+const sessionGenerationFields = {
+  session: {
+    bcnAssuranceGeneration: {
+      type: "number",
+      required: true,
+      defaultValue: 0,
+      input: false,
+      returned: false
+    }
+  },
+  user: {
+    bcnSecurityGeneration: {
+      type: "number",
+      required: true,
+      defaultValue: 0,
+      input: false,
+      returned: false
+    }
+  }
+};
+function withSessionGenerationFields(tables) {
+  return Object.fromEntries(
+    Object.entries(tables).map(([name, table]) => {
+      if (name !== "user" && name !== "session") return [name, table];
+      for (const [fieldName, expected] of Object.entries(sessionGenerationFields[name])) {
+        const configured = table.fields[fieldName];
+        if (configured && (configured.type !== expected.type || configured.required !== expected.required || configured.defaultValue !== expected.defaultValue || configured.input !== expected.input || configured.returned !== expected.returned || configured.fieldName !== void 0 || configured.references !== void 0 || configured.unique === true)) {
+          throw new Error(`AUTH_SCHEMA_SESSION_GENERATION_FIELD_RESERVED:${name}.${fieldName}`);
+        }
+      }
+      return [name, { ...table, fields: { ...table.fields, ...sessionGenerationFields[name] } }];
+    })
+  );
+}
 const explicitIndexes = {
   invitation: [
     { fields: ["email", "organizationId", "status"] },
@@ -311,7 +345,7 @@ ${fields}
   ].join("\n");
 }
 export function generateAuthSchemaArtifacts(tables) {
-  const metadata = buildMetadata(tables);
+  const metadata = buildMetadata(withSessionGenerationFields(tables));
   return {
     metadata,
     metadataCode: renderMetadata(metadata),

package/dist/runtime/convex-auth/component/_generated/component.d.ts

@@ -37,6 +37,15 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
                 value: string | number | boolean | Array<string> | Array<number> | null;
             }>;
         }, Record<string, string | number | boolean | Array<string> | Array<number> | null> | null, Name>;
+        consumeRateLimit: FunctionReference<"mutation", "internal", {
+            key: string;
+            max: number;
+            retentionWindow: number;
+            window: number;
+        }, {
+            allowed: boolean;
+            retryAfter: number | null;
+        }, Name>;
         count: FunctionReference<"query", "internal", {
             model: string;
             where?: Array<{

package/dist/runtime/convex-auth/component/adapter.d.ts

@@ -13,7 +13,18 @@ export declare const assertProfile: import("convex/server").RegisteredQuery<"pub
         value: string | number | boolean | string[] | number[] | null;
         field: string;
     }[];
-}, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>, count: import("convex/server").RegisteredQuery<"public", {
+}, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>, consumeRateLimit: import("convex/server").RegisteredMutation<"public", {
+    window: number;
+    key: string;
+    max: number;
+    retentionWindow: number;
+}, Promise<{
+    allowed: boolean;
+    retryAfter: null;
+} | {
+    allowed: boolean;
+    retryAfter: number;
+}>>, count: import("convex/server").RegisteredQuery<"public", {
     where?: {
         mode?: "sensitive" | "insensitive" | undefined;
         operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
@@ -118,7 +129,13 @@ export declare const assertProfile: import("convex/server").RegisteredQuery<"pub
         cursor: string | null;
     };
     model: string;
-}, Promise<import("convex/server").PaginationResult<Record<string, string | number | boolean | string[] | number[] | null>>>>, findOne: import("convex/server").RegisteredQuery<"public", {
+}, Promise<{
+    page: Record<string, string | number | boolean | string[] | number[] | null>[];
+    isDone: boolean;
+    continueCursor: import("convex/server").Cursor;
+    splitCursor?: import("convex/server").Cursor | null;
+    pageStatus?: "SplitRecommended" | "SplitRequired" | null;
+}>>, findOne: import("convex/server").RegisteredQuery<"public", {
     join?: any;
     select?: string[] | undefined;
     workforce?: {

package/dist/runtime/convex-auth/component/adapter.js

@@ -4,6 +4,7 @@ import schemaMetadata from "./schemaMetadata.js";
 export const {
   assertProfile,
   consumeOne,
+  consumeRateLimit,
   count,
   create,
   deleteMany,

package/dist/runtime/convex-auth/component/schema.js

@@ -8,7 +8,8 @@ export const tables = {
     emailVerified: v.boolean(),
     image: v.union(v.null(), v.string()),
     createdAt: v.number(),
-    updatedAt: v.number()
+    updatedAt: v.number(),
+    bcnSecurityGeneration: v.number()
   }).index("id", ["id"]).index("name", ["name"]).index("email", ["email"]).index("createdAt", ["createdAt"]),
   session: defineTable({
     id: v.string(),
@@ -18,7 +19,8 @@ export const tables = {
     updatedAt: v.number(),
     ipAddress: v.union(v.null(), v.string()),
     userAgent: v.union(v.null(), v.string()),
-    userId: v.string()
+    userId: v.string(),
+    bcnAssuranceGeneration: v.number()
   }).index("id", ["id"]).index("expiresAt", ["expiresAt"]).index("userId_expiresAt", ["userId", "expiresAt"]).index("token", ["token"]).index("createdAt", ["createdAt"]).index("userId", ["userId"]),
   account: defineTable({
     id: v.string(),
@@ -176,6 +178,6 @@ export const tables = {
 };
 const schema = defineSchema(tables);
 Object.defineProperty(schema, "__betterConvexNuxtAuthSchemaFingerprint", {
-  value: "bcn-auth-schema-v2:e33d90ec0cf73ec1"
+  value: "bcn-auth-schema-v2:de26f24c2d072824"
 });
 export default schema;

package/dist/runtime/convex-auth/component/schemaMetadata.d.ts

@@ -1,6 +1,6 @@
 /** This file is generated by Better Convex Nuxt. Do not edit. */
 declare const schemaMetadata: {
-    readonly fingerprint: "bcn-auth-schema-v2:e33d90ec0cf73ec1";
+    readonly fingerprint: "bcn-auth-schema-v2:de26f24c2d072824";
     readonly models: {
         readonly user: {
             readonly logicalName: "user";
@@ -90,6 +90,18 @@ declare const schemaMetadata: {
                     readonly unique: false;
                     readonly updatable: true;
                 };
+                readonly bcnSecurityGeneration: {
+                    readonly logicalName: "bcnSecurityGeneration";
+                    readonly physicalName: "bcnSecurityGeneration";
+                    readonly kind: "number";
+                    readonly nullable: false;
+                    readonly required: true;
+                    readonly indexed: false;
+                    readonly selectable: true;
+                    readonly sortable: false;
+                    readonly unique: false;
+                    readonly updatable: true;
+                };
             };
             readonly indexes: readonly [{
                 readonly descriptor: "id";
@@ -212,6 +224,18 @@ declare const schemaMetadata: {
                         readonly onDelete: "cascade";
                     };
                 };
+                readonly bcnAssuranceGeneration: {
+                    readonly logicalName: "bcnAssuranceGeneration";
+                    readonly physicalName: "bcnAssuranceGeneration";
+                    readonly kind: "number";
+                    readonly nullable: false;
+                    readonly required: true;
+                    readonly indexed: false;
+                    readonly selectable: true;
+                    readonly sortable: false;
+                    readonly unique: false;
+                    readonly updatable: true;
+                };
             };
             readonly indexes: readonly [{
                 readonly descriptor: "id";

package/dist/runtime/convex-auth/component/schemaMetadata.js

@@ -1,5 +1,5 @@
 const schemaMetadata = {
-  fingerprint: "bcn-auth-schema-v2:e33d90ec0cf73ec1",
+  fingerprint: "bcn-auth-schema-v2:de26f24c2d072824",
   models: {
     user: {
       logicalName: "user",
@@ -88,6 +88,18 @@ const schemaMetadata = {
           sortable: false,
           unique: false,
           updatable: true
+        },
+        bcnSecurityGeneration: {
+          logicalName: "bcnSecurityGeneration",
+          physicalName: "bcnSecurityGeneration",
+          kind: "number",
+          nullable: false,
+          required: true,
+          indexed: false,
+          selectable: true,
+          sortable: false,
+          unique: false,
+          updatable: true
         }
       },
       indexes: [
@@ -215,6 +227,18 @@ const schemaMetadata = {
             field: "id",
             onDelete: "cascade"
           }
+        },
+        bcnAssuranceGeneration: {
+          logicalName: "bcnAssuranceGeneration",
+          physicalName: "bcnAssuranceGeneration",
+          kind: "number",
+          nullable: false,
+          required: true,
+          indexed: false,
+          selectable: true,
+          sortable: false,
+          unique: false,
+          updatable: true
         }
       },
       indexes: [

package/dist/runtime/convex-auth/create-better-convex-auth.js

@@ -11,6 +11,7 @@ import { createOAuthOperator } from "./oauth-operator.js";
 import { requireAuthOrigin } from "./origin.js";
 import { convexAuth } from "./plugin.js";
 import { getConvexAuthProvider } from "./provider.js";
+import { createConvexAuthRateLimitStorage } from "./rate-limit-storage.js";
 import { workforceSessionPolicy } from "./workforce/operations.js";
 import { createWorkforceSchemaPlugins } from "./workforce/profile.js";
 import { createWorkforceProviderHooks } from "./workforce/provider-hooks.js";
@@ -209,6 +210,15 @@ export function createBetterConvexAuthOwned(component, options = {}, extraPlugin
         ] : [],
         ...oauthProfile ? [createOAuthProvider(oauthProfile)] : []
       ];
+      const maximumConfiguredPluginRateLimitWindow = Math.max(
+        0,
+        ...plugins.flatMap((plugin) => plugin.rateLimit?.map((rule) => rule.window) ?? [])
+      );
+      const rateLimitStorage = createConvexAuthRateLimitStorage(
+        ctx,
+        component,
+        maximumConfiguredPluginRateLimitWindow
+      );
       const auth = betterAuth({
         appName: options.appName,
         account: {
@@ -260,7 +270,12 @@ export function createBetterConvexAuthOwned(component, options = {}, extraPlugin
         },
         emailVerification: workforce ? { ...emailVerification, autoSignInAfterVerification: false } : emailVerification,
         plugins,
-        rateLimit: { enabled: true, modelName: "rateLimit", storage: "database" },
+        rateLimit: {
+          customStorage: rateLimitStorage,
+          enabled: true,
+          modelName: "rateLimit",
+          storage: "database"
+        },
         session: {
           expiresIn: 7 * 24 * 60 * 60,
           updateAge: 24 * 60 * 60,

package/dist/runtime/convex-auth/index.d.ts

@@ -8,6 +8,7 @@ export { requireAuthOrigin } from './origin.js';
 export { requireWritableAuthCtx } from './context.js';
 export { convexAuth } from './plugin.js';
 export { getConvexAuthProvider } from './provider.js';
+export { createConvexAuthRateLimitStorage } from './rate-limit-storage.js';
 export { createBetterAuthMcpAccessVerifier, verifyOAuthBearerToken } from './oauth-resource.js';
 export { createUserProjectionTriggers } from './user-projection.js';
 export type { AuthCtx, WritableAuthCtx } from './context.js';