Summary

• Auth boundary: ownerId required on all admin mutations (revoke/disable/enable/update/rotate/getUsage) — prevents cross-tenant access
• Server-side secret gen: create() and rotate() generate secret material inside component mutations, no longer passed from client
• Remove apiKeyEvents table: structured logging replaces event-based audit trail — eliminates unbounded table growth, O(N) scans, retention cron complexity
• Remove @convex-dev/rate-limiter: rate limiting is integrator's responsibility at their HTTP layer where they have caller context (IP, auth, plan tier)
• Remove @convex-dev/aggregate + @convex-dev/crons: unused deps removed (component deps: 4 -> 1)
• Input validation: keyPrefix/env charset, gracePeriodMs min/max bounds, metadata/scopes/tags size caps, configure() bounds
• Validate optimization: remaining decrement and lastUsedAt write decoupled into single merged patch; lastUsedAt throttled to 60s
• Pagination: list()/listByTag() use .take(100) default limit instead of unbounded .collect()
• revokeByTag: now catches rotating + disabled statuses (not just active)

Breaking Changes

Stats

• 10 files changed, 487 insertions, 412 deletions
• 82 tests passing (was 69), +14 new tests covering auth boundary, input validation, bounds
• Component deps: 4 -> 1 (shardedCounter only)
• Tables: 3 -> 2 (apiKeyEvents removed)
• Writes per validate: 4 -> 1-2

Test plan

• All 82 tests pass (pnpm test)
• Lint clean (pnpm lint)
• TypeScript clean (pnpm build)
• Cross-tenant auth boundary tested (6 mutations)
• Input validation tested (env charset, metadata size, scopes/tags limits)
• gracePeriodMs bounds tested (min 60s, max 30d)
• configure() bounds tested (negative/zero rejection)
• 7-perspective code review completed (0 BLOCKING findings remaining)
• README migration guide (follow-up — docs only)
• Run pnpm build:codegen with Convex auth to regenerate _generated/ types