@lupinum/better-convex-nuxt 1.0.0-beta.4 → 1.0.0-beta.6

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=4.5.2 <5"
   },
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/cli/init.js

@@ -42,7 +42,7 @@ import schema from './schema'
 import schemaMetadata from './schemaMetadata'
 
 // This module is inside the isolated betterAuth component, not the public app API.
-export const { assertProfile, consumeOne, count, create, deleteMany, deleteOne, findMany, findOne, incrementOne, rotateSigningKey, sessionAdmission, expireWorkforceSession, listWorkforceSessions, revokeAllWorkforceSessions, revokeWorkforceSession, touchWorkforceSession, updateMany, updateOne } = defineAuthAdapterFunctions({ metadata: schemaMetadata, schema })
+export const { assertProfile, consumeOne, consumeRateLimit, count, create, deleteMany, deleteOne, findMany, findOne, incrementOne, rotateSigningKey, sessionAdmission, expireWorkforceSession, listWorkforceSessions, revokeAllWorkforceSessions, revokeWorkforceSession, touchWorkforceSession, updateMany, updateOne } = defineAuthAdapterFunctions({ metadata: schemaMetadata, schema })
 `,
   "convex/betterAuth/convex.config.ts": `import { defineComponent } from 'convex/server'
 

package/dist/runtime/convex-auth/adapter/define-functions.d.ts

@@ -6,6 +6,9 @@ export interface DefineAuthAdapterFunctionsOptions<Schema extends SchemaDefiniti
     metadata: AuthSchemaMetadata;
 }
 export declare function defineAuthAdapterFunctions<Schema extends SchemaDefinition<any, any>>({ schema, metadata, }: DefineAuthAdapterFunctionsOptions<Schema>): {
+    migrateBeta3UserGeneration: import("convex/server").RegisteredMutation<"internal", {
+        mode: "forward" | "rollback";
+    }, Promise<import("../session-generation.js").Beta3UserGenerationMigrationResult>>;
     touchWorkforceSession: import("convex/server").RegisteredMutation<"public", {
         actor: {
             userId: string;
@@ -300,6 +303,18 @@ export declare function defineAuthAdapterFunctions<Schema extends SchemaDefiniti
             field: string;
         }[];
     }, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>;
+    consumeRateLimit: import("convex/server").RegisteredMutation<"public", {
+        window: number;
+        key: string;
+        max: number;
+        retentionWindow: number;
+    }, Promise<{
+        allowed: boolean;
+        retryAfter: null;
+    } | {
+        allowed: boolean;
+        retryAfter: number;
+    }>>;
     incrementOne: import("convex/server").RegisteredMutation<"public", {
         set?: any;
         workforce?: {

package/dist/runtime/convex-auth/adapter/define-functions.js

@@ -12,6 +12,7 @@ import {
   normalizeSigningKeyCandidate,
   signingKeyCandidateValidator
 } from "../jwks-rotation.js";
+import { migrateBeta3UserGeneration, sessionGenerationAuthority } from "../session-generation.js";
 import { createWorkforceAdapterPolicy } from "../workforce/adapter-policy.js";
 import { readAuthSessionAdmission } from "../workforce/admission.js";
 import {
@@ -78,6 +79,7 @@ const readArgs = {
   offset: v.optional(v.number())
 };
 const expireSessionReference = makeFunctionReference("adapter:expireWorkforceSession");
+const pruneRateLimitsReference = makeFunctionReference("adapter:deleteMany");
 function assertRecord(value, code) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(code);
 }
@@ -222,6 +224,7 @@ export function defineAuthAdapterFunctions({
 }) {
   assertAuthSchemaMatchesMetadata(schema, metadata);
   const workforce = hasWorkforceSchema(metadata);
+  const generationAuthority = sessionGenerationAuthority(metadata);
   const workforcePolicy = createWorkforceAdapterPolicy(workforce, metadata);
   const relationships = createAuthRelationshipEngine({
     schema,
@@ -233,6 +236,19 @@ export function defineAuthAdapterFunctions({
     if (!workforce) throw new Error("AUTH_WORKFORCE_SCHEMA_REQUIRED");
   }
   return {
+    migrateBeta3UserGeneration: internalMutationGeneric({
+      args: {
+        mode: v.union(v.literal("forward"), v.literal("rollback"))
+      },
+      returns: v.object({
+        patched: v.number(),
+        scanned: v.number()
+      }),
+      handler: (ctx, args) => {
+        if (!generationAuthority) throw new Error("AUTH_SESSION_GENERATION_SCHEMA_INVALID");
+        return migrateBeta3UserGeneration(ctx, args.mode, generationAuthority);
+      }
+    }),
     touchWorkforceSession: mutationGeneric({
       args: { actor: workforceSessionActorValidator },
       returns: v.object({ expiresAt: v.number() }),
@@ -547,6 +563,74 @@ export function defineAuthAdapterFunctions({
         return toBetterAuthDocument(current);
       }
     }),
+    consumeRateLimit: mutationGeneric({
+      args: {
+        key: v.string(),
+        max: v.number(),
+        retentionWindow: v.number(),
+        window: v.number()
+      },
+      returns: v.object({
+        allowed: v.boolean(),
+        retryAfter: v.union(v.number(), v.null())
+      }),
+      handler: async (ctx, args) => {
+        const windowInMs = args.window * 1e3;
+        const retentionWindowInMs = args.retentionWindow * 1e3;
+        if (args.key.length === 0 || !Number.isSafeInteger(args.max) || args.max <= 0 || !Number.isFinite(args.window) || args.window <= 0 || !Number.isFinite(args.retentionWindow) || args.retentionWindow < args.window || !Number.isFinite(windowInMs) || !Number.isFinite(retentionWindowInMs)) {
+          throw new Error("AUTH_RATE_LIMIT_RULE_INVALID");
+        }
+        const now = Date.now();
+        const current = oneOrNull(
+          await findAuthRows(
+            ctx,
+            schema,
+            metadata,
+            { model: "rateLimit", where: [{ field: "key", value: args.key }] },
+            2
+          ),
+          "AUTH_RATE_LIMIT"
+        );
+        if (!current) {
+          await ctx.db.insert(
+            "rateLimit",
+            { id: args.key, key: args.key, count: 1, lastRequest: now }
+          );
+          return { allowed: true, retryAfter: null };
+        }
+        if (typeof current.count !== "number" || !Number.isSafeInteger(current.count) || current.count < 0 || typeof current.lastRequest !== "number" || !Number.isFinite(current.lastRequest)) {
+          throw new Error("AUTH_RATE_LIMIT_ROW_INVALID");
+        }
+        if (now - current.lastRequest >= windowInMs) {
+          await ctx.db.patch(current._id, { count: 1, lastRequest: now });
+          await ctx.scheduler.runAfter(0, pruneRateLimitsReference, {
+            model: "rateLimit",
+            where: [
+              {
+                field: "lastRequest",
+                operator: "lt",
+                value: now - retentionWindowInMs
+              }
+            ]
+          });
+          return { allowed: true, retryAfter: null };
+        }
+        if (current.count >= args.max) {
+          return {
+            allowed: false,
+            retryAfter: Math.max(1, Math.ceil((current.lastRequest + windowInMs - now) / 1e3))
+          };
+        }
+        await ctx.db.patch(
+          current._id,
+          {
+            count: current.count + 1,
+            lastRequest: now
+          }
+        );
+        return { allowed: true, retryAfter: null };
+      }
+    }),
     incrementOne: mutationGeneric({
       returns: v.union(authDocumentValidator, v.null()),
       args: {

package/dist/runtime/convex-auth/component/_generated/component.d.ts

@@ -37,6 +37,15 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
                 value: string | number | boolean | Array<string> | Array<number> | null;
             }>;
         }, Record<string, string | number | boolean | Array<string> | Array<number> | null> | null, Name>;
+        consumeRateLimit: FunctionReference<"mutation", "internal", {
+            key: string;
+            max: number;
+            retentionWindow: number;
+            window: number;
+        }, {
+            allowed: boolean;
+            retryAfter: number | null;
+        }, Name>;
         count: FunctionReference<"query", "internal", {
             model: string;
             where?: Array<{

package/dist/runtime/convex-auth/component/adapter.d.ts

@@ -13,7 +13,18 @@ export declare const assertProfile: import("convex/server").RegisteredQuery<"pub
         value: string | number | boolean | string[] | number[] | null;
         field: string;
     }[];
-}, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>, count: import("convex/server").RegisteredQuery<"public", {
+}, Promise<Record<string, string | number | boolean | string[] | number[] | null> | null>>, consumeRateLimit: import("convex/server").RegisteredMutation<"public", {
+    window: number;
+    key: string;
+    max: number;
+    retentionWindow: number;
+}, Promise<{
+    allowed: boolean;
+    retryAfter: null;
+} | {
+    allowed: boolean;
+    retryAfter: number;
+}>>, count: import("convex/server").RegisteredQuery<"public", {
     where?: {
         mode?: "sensitive" | "insensitive" | undefined;
         operator?: "in" | "lt" | "lte" | "gt" | "gte" | "eq" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;

package/dist/runtime/convex-auth/component/adapter.js

@@ -4,6 +4,7 @@ import schemaMetadata from "./schemaMetadata.js";
 export const {
   assertProfile,
   consumeOne,
+  consumeRateLimit,
   count,
   create,
   deleteMany,

package/dist/runtime/convex-auth/create-better-convex-auth.js

@@ -11,6 +11,7 @@ import { createOAuthOperator } from "./oauth-operator.js";
 import { requireAuthOrigin } from "./origin.js";
 import { convexAuth } from "./plugin.js";
 import { getConvexAuthProvider } from "./provider.js";
+import { createConvexAuthRateLimitStorage } from "./rate-limit-storage.js";
 import { workforceSessionPolicy } from "./workforce/operations.js";
 import { createWorkforceSchemaPlugins } from "./workforce/profile.js";
 import { createWorkforceProviderHooks } from "./workforce/provider-hooks.js";
@@ -209,6 +210,15 @@ export function createBetterConvexAuthOwned(component, options = {}, extraPlugin
         ] : [],
         ...oauthProfile ? [createOAuthProvider(oauthProfile)] : []
       ];
+      const maximumConfiguredPluginRateLimitWindow = Math.max(
+        0,
+        ...plugins.flatMap((plugin) => plugin.rateLimit?.map((rule) => rule.window) ?? [])
+      );
+      const rateLimitStorage = createConvexAuthRateLimitStorage(
+        ctx,
+        component,
+        maximumConfiguredPluginRateLimitWindow
+      );
       const auth = betterAuth({
         appName: options.appName,
         account: {
@@ -260,7 +270,12 @@ export function createBetterConvexAuthOwned(component, options = {}, extraPlugin
         },
         emailVerification: workforce ? { ...emailVerification, autoSignInAfterVerification: false } : emailVerification,
         plugins,
-        rateLimit: { enabled: true, modelName: "rateLimit", storage: "database" },
+        rateLimit: {
+          customStorage: rateLimitStorage,
+          enabled: true,
+          modelName: "rateLimit",
+          storage: "database"
+        },
         session: {
           expiresIn: 7 * 24 * 60 * 60,
           updateAge: 24 * 60 * 60,

package/dist/runtime/convex-auth/index.d.ts

@@ -8,6 +8,7 @@ export { requireAuthOrigin } from './origin.js';
 export { requireWritableAuthCtx } from './context.js';
 export { convexAuth } from './plugin.js';
 export { getConvexAuthProvider } from './provider.js';
+export { createConvexAuthRateLimitStorage } from './rate-limit-storage.js';
 export { createBetterAuthMcpAccessVerifier, verifyOAuthBearerToken } from './oauth-resource.js';
 export { createUserProjectionTriggers } from './user-projection.js';
 export type { AuthCtx, WritableAuthCtx } from './context.js';

package/dist/runtime/convex-auth/index.js

@@ -6,5 +6,6 @@ export { requireAuthOrigin } from "./origin.js";
 export { requireWritableAuthCtx } from "./context.js";
 export { convexAuth } from "./plugin.js";
 export { getConvexAuthProvider } from "./provider.js";
+export { createConvexAuthRateLimitStorage } from "./rate-limit-storage.js";
 export { createBetterAuthMcpAccessVerifier, verifyOAuthBearerToken } from "./oauth-resource.js";
 export { createUserProjectionTriggers } from "./user-projection.js";

package/dist/runtime/convex-auth/plugin.js

@@ -37,6 +37,7 @@ import {
   validateOAuthProviderProfile
 } from "./oauth-security.js";
 import { normalizeAuthOrigin } from "./origin.js";
+import { isConvexAuthRateLimitStorage } from "./rate-limit-storage.js";
 import { workforceSchemaPlugin } from "./workforce/schema.js";
 import { isFullWorkforceSession } from "./workforce/session-assurance.js";
 const forbiddenCustomClaims = /* @__PURE__ */ new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub"]);
@@ -379,7 +380,7 @@ function hasSafeGlobalAuthRuntime(context) {
   const ipAddress = context.options.advanced?.ipAddress;
   const ipHeaders = ipAddress?.ipAddressHeaders;
   const trustedProxies = ipAddress?.trustedProxies;
-  return context.options.rateLimit?.enabled === true && context.options.rateLimit.storage === "database" && context.options.rateLimit.modelName === "rateLimit" && context.options.rateLimit.customStorage === void 0 && context.options.rateLimit.customRules === void 0 && Array.isArray(ipHeaders) && ipHeaders.length === 1 && ipHeaders[0]?.toLowerCase() === VERIFIED_CLIENT_IP_HEADER && (ipAddress?.disableIpTracking === void 0 || ipAddress.disableIpTracking === false) && (trustedProxies === void 0 || Array.isArray(trustedProxies) && trustedProxies.length === 0) && (ipAddress?.ipv6Subnet === void 0 || ipAddress.ipv6Subnet === 64) && (context.options.advanced?.trustedProxyHeaders === void 0 || context.options.advanced.trustedProxyHeaders === false);
+  return context.options.rateLimit?.enabled === true && context.options.rateLimit.storage === "database" && context.options.rateLimit.modelName === "rateLimit" && isConvexAuthRateLimitStorage(context.options.rateLimit.customStorage) && context.options.rateLimit.customRules === void 0 && Array.isArray(ipHeaders) && ipHeaders.length === 1 && ipHeaders[0]?.toLowerCase() === VERIFIED_CLIENT_IP_HEADER && (ipAddress?.disableIpTracking === void 0 || ipAddress.disableIpTracking === false) && (trustedProxies === void 0 || Array.isArray(trustedProxies) && trustedProxies.length === 0) && (ipAddress?.ipv6Subnet === void 0 || ipAddress.ipv6Subnet === 64) && (context.options.advanced?.trustedProxyHeaders === void 0 || context.options.advanced.trustedProxyHeaders === false);
 }
 export function convexAuth(options) {
   validateSessionJwt(options);

package/dist/runtime/convex-auth/rate-limit-storage.d.ts

@@ -0,0 +1,20 @@
+import type { BetterAuthOptions } from 'better-auth';
+import type { GenericDataModel } from 'convex/server';
+import { type AuthCtx } from './context.js';
+import type { AuthAdapterComponentApi } from './types.js';
+type BetterAuthRateLimitStorage = NonNullable<NonNullable<BetterAuthOptions['rateLimit']>['customStorage']>;
+export declare function isConvexAuthRateLimitStorage(storage: BetterAuthRateLimitStorage | undefined): boolean;
+/**
+ * Test seam for constructing a trusted in-memory storage fixture.
+ *
+ * @internal
+ */
+export declare function registerConvexAuthRateLimitStorageForTest(storage: BetterAuthRateLimitStorage): BetterAuthRateLimitStorage;
+/**
+ * Create the one atomic Better Auth rate-limit store backed by the auth component.
+ * `maximumConfiguredRateLimitWindow` must include every custom plugin rule. The
+ * constructor owns the pinned Better Auth built-in 60-second floor. A final
+ * Convex OCC error is safe to retry because that mutation did not commit.
+ */
+export declare function createConvexAuthRateLimitStorage<DataModel extends GenericDataModel>(ctx: AuthCtx<DataModel>, component: AuthAdapterComponentApi, maximumConfiguredRateLimitWindow: number): BetterAuthRateLimitStorage;
+export {};

package/dist/runtime/convex-auth/rate-limit-storage.js

@@ -0,0 +1,46 @@
+import { requireWritableAuthCtx } from "./context.js";
+const AUTH_RATE_LIMIT_CONTENTION_MAX_RETRIES = 5;
+const BETTER_AUTH_MAX_BUILT_IN_RATE_LIMIT_WINDOW_SECONDS = 60;
+const ownedStorages = /* @__PURE__ */ new WeakSet();
+function isFinalConvexContention(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /documents? read from or written to/iu.test(message) && /changed while this mutation was being run and on every subsequent retry/iu.test(message);
+}
+function retryDelay(attempt) {
+  const delayMs = Math.min(5 * 2 ** attempt, 80) + Math.floor(Math.random() * 7);
+  return new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+export function isConvexAuthRateLimitStorage(storage) {
+  return storage !== void 0 && ownedStorages.has(storage);
+}
+export function registerConvexAuthRateLimitStorageForTest(storage) {
+  ownedStorages.add(storage);
+  return storage;
+}
+export function createConvexAuthRateLimitStorage(ctx, component, maximumConfiguredRateLimitWindow) {
+  const storage = {
+    async consume(key, rule) {
+      requireWritableAuthCtx(ctx);
+      for (let attempt = 0; ; attempt += 1) {
+        try {
+          return await ctx.runMutation(component.adapter.consumeRateLimit, {
+            key,
+            max: rule.max,
+            retentionWindow: Math.max(
+              BETTER_AUTH_MAX_BUILT_IN_RATE_LIMIT_WINDOW_SECONDS,
+              maximumConfiguredRateLimitWindow,
+              rule.window
+            ),
+            window: rule.window
+          });
+        } catch (error) {
+          if ("db" in ctx || attempt >= AUTH_RATE_LIMIT_CONTENTION_MAX_RETRIES || !isFinalConvexContention(error)) {
+            throw error;
+          }
+          await retryDelay(attempt);
+        }
+      }
+    }
+  };
+  return registerConvexAuthRateLimitStorageForTest(storage);
+}

package/dist/runtime/convex-auth/session-generation.d.ts

@@ -4,6 +4,11 @@ import type { AuthWhere } from './adapter/query.js';
 type ReadCtx = GenericQueryCtx<GenericDataModel>;
 type WriteCtx = GenericMutationCtx<GenericDataModel>;
 type Row = Record<string, unknown>;
+export type Beta3UserGenerationMigrationMode = 'forward' | 'rollback';
+export interface Beta3UserGenerationMigrationResult {
+    patched: number;
+    scanned: number;
+}
 export interface SessionGenerationAuthority {
     assuranceGenerationField: string;
     securityGenerationField: string;
@@ -13,6 +18,11 @@ export interface SessionGenerationAuthority {
 }
 export declare const canonicalSessionGenerationAuthority: SessionGenerationAuthority;
 export declare function sessionGenerationAuthority(metadata: AuthSchemaMetadata): SessionGenerationAuthority | null;
+/**
+ * Temporary beta.3 cutover for small, pre-customer deployments.
+ * Legacy sessions must be deleted before this operator runs.
+ */
+export declare function migrateBeta3UserGeneration(ctx: WriteCtx, mode: Beta3UserGenerationMigrationMode, authority?: SessionGenerationAuthority): Promise<Beta3UserGenerationMigrationResult>;
 /** Add component-owned generation fields before strict generated-schema normalization. */
 export declare function prepareSessionGenerationCreate(ctx: ReadCtx, model: string, input: unknown, authority?: SessionGenerationAuthority): Promise<unknown>;
 /** Generic adapter updates must never mint or move session-generation authority. */

package/dist/runtime/convex-auth/session-generation.js

@@ -33,6 +33,34 @@ function generation(value) {
 async function readUser(ctx, userId, authority) {
   return await ctx.db.query(authority.userModel).withIndex("id", (query) => query.eq("id", userId)).unique();
 }
+export async function migrateBeta3UserGeneration(ctx, mode, authority = canonicalSessionGenerationAuthority) {
+  const sessions = await ctx.db.query(authority.sessionModel).take(1);
+  if (sessions.length !== 0) throw new Error("AUTH_BETA3_CUTOVER_SESSIONS_REMAIN");
+  const users = await ctx.db.query(authority.userModel).take(129);
+  if (users.length > 128) throw new Error("AUTH_BETA3_CUTOVER_USER_LIMIT");
+  let patched = 0;
+  for (const user of users) {
+    if (typeof user._id !== "string" || !user._id || typeof user.id !== "string" || !user.id) {
+      throw new Error("AUTH_BETA3_CUTOVER_USER_INVALID");
+    }
+    const current = user[authority.securityGenerationField];
+    if (current !== void 0 && (!generation(current) || current !== 0)) {
+      throw new Error("AUTH_BETA3_CUTOVER_GENERATION_INVALID");
+    }
+    if (mode === "forward" && current === void 0) {
+      await ctx.db.patch(authority.userModel, user._id, {
+        [authority.securityGenerationField]: 0
+      });
+      patched += 1;
+    } else if (mode === "rollback" && current === 0) {
+      await ctx.db.patch(authority.userModel, user._id, {
+        [authority.securityGenerationField]: void 0
+      });
+      patched += 1;
+    }
+  }
+  return { patched, scanned: users.length };
+}
 export async function prepareSessionGenerationCreate(ctx, model, input, authority = canonicalSessionGenerationAuthority) {
   if (!input || typeof input !== "object" || Array.isArray(input)) return input;
   const row = input;

package/dist/runtime/shared/release-fingerprint.js

@@ -1,4 +1,4 @@
-const packedRuntimeFingerprint = "bcn-release-v1-dd08fa363fff64276636c0d6063a23b769019aaf4f0aaa67d5aec0876d2cbb62";
+const packedRuntimeFingerprint = "bcn-release-v1-1a4ab089f02a76a2e4e1fa972a0160575dcecf5a3acc7f1958616549ddc3c81c";
 const packedRuntimeFingerprintPattern = /^bcn-release-v1-[0-9a-f]{64}$/u;
 export const PACKED_RUNTIME_FINGERPRINT_HEADER = "x-bcn-runtime-fingerprint";
 export function getPackedRuntimeFingerprint() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lupinum/better-convex-nuxt",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "description": "Full-featured Convex integration for Nuxt with SSR, real-time subscriptions, and authentication",
   "keywords": [
     "authentication",
@@ -195,7 +195,7 @@
   },
   "dependencies": {
     "@better-auth/utils": "0.4.2",
-    "@lupinum/better-convex-vue": "1.0.0-beta.4",
+    "@lupinum/better-convex-vue": "1.0.0-beta.6",
     "@nuxt/kit": "4.5.2",
     "convex-helpers": "0.1.114",
     "defu": "^6.1.5",
@@ -218,7 +218,7 @@
     "@nuxt/test-utils": "^4.0.3",
     "@types/node": "22.20.1",
     "@vitejs/plugin-vue": "^6.0.8",
-    "@vitest/browser-playwright": "^4.1.8",
+    "@vitest/browser-playwright": "^4.1.11",
     "arktype": "2.2.3",
     "better-auth": "1.7.2",
     "changelogen": "0.6.2",
@@ -236,7 +236,7 @@
     "tar": "7.5.22",
     "typescript": "~5.9.3",
     "vite": "8.1.5",
-    "vitest": "^4.1.8",
+    "vitest": "^4.1.11",
     "vitest-browser-vue": "^2.1.0",
     "vue-tsc": "^3.3.7",
     "yaml": "2.9.0",

package/security/upstream-convex-better-auth.json

@@ -148,9 +148,9 @@
       "targetPath": "src/runtime/convex-auth/adapter/define-functions.ts",
       "sourceCommit": "c628916b451a6b4cff0f5464f134475464b1a6da",
       "sourceSha256": "7f537e1081bc22ee50d15df7b24e73e8869aa78a17af4aca18a5b0d261b186e3",
-      "targetSha256": "6fa58f0f62762254ddc829397b171a9277e4561131b8943a878d69938be673aa",
+      "targetSha256": "cfabe28cf39cfe31075eddd06c7690728419f2e2a497fd58cd8e830ba603168b",
       "classification": "adapted",
-      "modificationSummary": "Rebuilt component functions with strict validation, indexed relationships, failure-atomic writes and triggers, single-snapshot counts, guarded consumption and increments, authenticated signing-key rotation, component-owned session-generation invalidation, and workforce profile, admission, expiry, management, credential, factor, and replay operations.",
+      "modificationSummary": "Rebuilt component functions with strict validation, indexed relationships, failure-atomic writes and triggers, single-snapshot counts, one atomic rate-limit consume operation, guarded consumption and increments, authenticated signing-key rotation, component-owned session-generation invalidation, a temporary internal beta.3 user-generation cutover operator, and workforce profile, admission, expiry, management, credential, factor, and replay operations.",
       "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
       "noticeRequired": true
     },
@@ -203,9 +203,9 @@
       "targetPath": "src/runtime/convex-auth/session-generation.ts",
       "sourceCommit": "c628916b451a6b4cff0f5464f134475464b1a6da",
       "sourceSha256": "70daca2ff67e790be91a69c92e35b9c9c373ff5b23402d796a3a50429cc002bc",
-      "targetSha256": "8fdbceb38b80030c86e6071592b23646ecd407804f38da7f9cf9ae2baff27fdc",
+      "targetSha256": "e7f27dcd27e5a47a095647b9b54cac1a8c66b233ccc0e92049fda197dd5b168e",
       "classification": "rewritten",
-      "modificationSummary": "Added component-owned user and session generations so the provider's canonical delete-all selector atomically invalidates every earlier session without an unbounded collection scan; stale sessions fail adapter reads and backend admission until scheduled physical expiry.",
+      "modificationSummary": "Added component-owned user and session generations so the provider's canonical delete-all selector atomically invalidates every earlier session without an unbounded collection scan; stale sessions fail adapter reads and backend admission until scheduled physical expiry. Added a bounded beta.3 user-generation cutover helper that requires legacy sessions to be deleted while preserving user IDs, accounts, passwords, and application references.",
       "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
       "noticeRequired": false
     },
@@ -225,9 +225,9 @@
       "targetPath": "src/runtime/convex-auth/component/_generated/component.ts",
       "sourceCommit": "c628916b451a6b4cff0f5464f134475464b1a6da",
       "sourceSha256": "e337fe2ab868c4ba560868d24bcc725a7ca7e5672505adf57df6e5b6e61dbf4e",
-      "targetSha256": "48e41743290968fd5668172ce5244d22fc146d01ea38de1d5a77e3de323c3e61",
+      "targetSha256": "4746f502864388993e5cca6c795b8fc481865dc2a348dd328a5a89f9854dd98c",
       "classification": "regenerated",
-      "modificationSummary": "Regenerated the public ComponentApi declaration including relationship-aware writes, guarded consumption and increments, signing-key lifecycle operations, schema-profile assertion, persisted-session admission, and workforce session management.",
+      "modificationSummary": "Regenerated the public ComponentApi declaration including relationship-aware writes, atomic rate-limit consumption, guarded consumption and increments, signing-key lifecycle operations, schema-profile assertion, persisted-session admission, and workforce session management.",
       "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
       "noticeRequired": false
     },
@@ -258,9 +258,9 @@
       "targetPath": "src/runtime/convex-auth/component/adapter.ts",
       "sourceCommit": "c628916b451a6b4cff0f5464f134475464b1a6da",
       "sourceSha256": "1a373c633a7090ea60d0e0942a6cb0c6cff65c842c8ca8950e1546cfa50dcbe5",
-      "targetSha256": "cc67ba07c454d6e1b2d669f94dbdabb0bbb2ae0a89f569cf1492ea250a08cc5c",
+      "targetSha256": "eebdfab80285ac45b78ce92f4d79abe67f405bf0ae5a2e190cf65f0f7febb416",
       "classification": "rewritten",
-      "modificationSummary": "Reduced the component adapter to a thin assembly of the shared adapter functions and explicit workforce schema-profile and session-management functions, including scheduled expiry and atomic signing-key rotation.",
+      "modificationSummary": "Reduced the component adapter to a thin assembly of the shared adapter functions and explicit workforce schema-profile and session-management functions, including atomic rate-limit consumption, scheduled expiry, and atomic signing-key rotation.",
       "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
       "noticeRequired": false
     },
@@ -335,9 +335,9 @@
       "targetPath": "src/runtime/convex-auth/create-better-convex-auth.ts",
       "sourceCommit": "c628916b451a6b4cff0f5464f134475464b1a6da",
       "sourceSha256": "610a4d7edfbb0fd3ab412d61e8103b9e416edaaf8e2719189c9cff345597150d",
-      "targetSha256": "0ecea97ae78a7dc70136f8973c57895bf6099e3781ee1802a0d0dfb2a5cf7e34",
+      "targetSha256": "aa9e991096e808fc15a806da6604a47d2b9fb055051459490e0b7308aa7184ad",
       "classification": "rewritten",
-      "modificationSummary": "Introduced one reviewed factory that owns adapter wiring, JWT and plugin ordering, route registration, keys, secrets, projections, and OAuth operations; admits fail-closed request-scoped email and user-creation policy, supports one fixed workforce password-and-TOTP profile, keeps arbitrary plugins limited to the internal loopback-only test constructor, and lets that constructor revalidate its boundary for every auth instance.",
+      "modificationSummary": "Introduced one reviewed factory that owns adapter wiring, JWT and plugin ordering, route registration, keys, secrets, projections, OAuth operations, and atomic database rate-limit storage; admits fail-closed request-scoped email and user-creation policy, supports one fixed workforce password-and-TOTP profile, keeps arbitrary plugins limited to the internal loopback-only test constructor, and lets that constructor revalidate its boundary for every auth instance.",
       "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
       "noticeRequired": false
     },
@@ -346,9 +346,9 @@
       "targetPath": "src/runtime/convex-auth/index.ts",
       "sourceCommit": "c628916b451a6b4cff0f5464f134475464b1a6da",
       "sourceSha256": "300f9ebf00a0f236954653984709abfb70e93f1b1b9a37fabba4ee44661d2cf5",
-      "targetSha256": "f78023311543387ddd6e0a6c3f42054060d67f0104bfbdae58f3974362b9bb7f",
+      "targetSha256": "eb1124a91e1f672ec5e9305ff6fed383d7302cd498c3d1b369fd7325414aa805",
       "classification": "rewritten",
-      "modificationSummary": "Replaced the compatibility barrel with the fixed narrow Better Convex Nuxt API, including the reviewed auth factory, maintained component, provider, OAuth resource verifier and operator, workforce schema-options helper, and rebuildable user projection.",
+      "modificationSummary": "Replaced the compatibility barrel with the fixed narrow Better Convex Nuxt API, including the reviewed auth factory, maintained component, atomic rate-limit storage constructor, provider, OAuth resource verifier and operator, workforce schema-options helper, and rebuildable user projection.",
       "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
       "noticeRequired": false
     },
@@ -363,14 +363,25 @@
       "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
       "noticeRequired": false
     },
+    {
+      "sourcePath": "src/auth-options.ts",
+      "targetPath": "src/runtime/convex-auth/rate-limit-storage.ts",
+      "sourceCommit": "c628916b451a6b4cff0f5464f134475464b1a6da",
+      "sourceSha256": "36b0218291f4b1ab577d2161a277e95fd62ce7e55e32e6f4d43ae41e001e7478",
+      "targetSha256": "36b67e5c5a4870a001fa98e3be72dc29e6a4d43c96f9dffa2ba629c15679f36e",
+      "classification": "rewritten",
+      "modificationSummary": "Added one package-owned Better Auth custom storage boundary that delegates the complete rate-limit decision and counter update to one atomic component mutation and retries only exact final uncommitted Convex contention from an action context with a fixed bound.",
+      "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
+      "noticeRequired": false
+    },
     {
       "sourcePath": "src/plugins/convex/index.ts",
       "targetPath": "src/runtime/convex-auth/plugin.ts",
       "sourceCommit": "c628916b451a6b4cff0f5464f134475464b1a6da",
       "sourceSha256": "48ab81541ecb0e5545bd74fb78ca426c0d695bbb156e03e6a402063255ef428a",
-      "targetSha256": "59f55ce50a43e094f90c1e9af4aa53a84f9082bcaf1e7f0f819bd0b02169bcb7",
+      "targetSha256": "a7852a3af404fb6d4b214646be6d49635b6044798a1e0d3d0f947a5f02ff3e0a",
       "classification": "rewritten",
-      "modificationSummary": "Rewrote the Convex plugin as the composition, request-guard, and session-issuance owner; exact OAuth Provider compatibility and operator calls live behind fail-closed guards, while the fixed workforce profile adds provider request hooks and requires current full TOTP assurance before session-token issuance.",
+      "modificationSummary": "Rewrote the Convex plugin as the composition, request-guard, and session-issuance owner; exact OAuth Provider compatibility, package-owned atomic rate-limit storage, and operator calls live behind fail-closed guards, while the fixed workforce profile adds provider request hooks and requires current full TOTP assurance before session-token issuance.",
       "latestReviewedUpstreamPatch": "https://github.com/get-convex/better-auth/commit/c628916b451a6b4cff0f5464f134475464b1a6da",
       "noticeRequired": false
     },