@ayepi/rate 0.2.0 → 0.3.0

package/README.md

@@ -49,6 +49,9 @@ retryAfter }`); on exceeded requests the chain short-circuits with the 429.
 - `rateLimit.server(def, opts)` (`@ayepi/rate/server`) — binds the policy. These options
   move here: `key, limit, window, algorithm?, store?, prefix?, countRejected?, status?,
   message?, headers?, alwaysHeaders?, skip?`. Bind it with `implement(api).middleware(...)`.
+  The rule fields — `limit`, `window`, `algorithm`, `countRejected` — each accept a fixed
+  value **or** a per-request `(io) => value`, so limits can differ by caller (e.g.
+  `limit: (io) => io.ctx.user.plan === 'pro' ? 1000 : 100`).
 
 ## Standalone (without middleware)
 

package/ayepi-rate.md

@@ -115,7 +115,8 @@ Everything below is exported. `@internal` symbols are intentionally omitted.
 | Export | Kind | Purpose |
 | --- | --- | --- |
 | `rateLimit` | function | Same name, **augmented with `.server(def, opts)`** to bind the policy. |
-| `RateLimitServerOptions` | interface | The policy options for `.server` (extends `LimiterOptions`). |
+| `RateLimitServerOptions` | interface | The policy options for `.server` (rule fields accept a static value or a per-request `(io) => T`). |
+| `RateKeyFn` / `Dynamic` | type | Helpers: `RateKeyFn<M, T> = (io) => T`; `Dynamic<M, T> = T \| RateKeyFn<M, T>` — the shape of every per-request option. |
 
 ### Redis subpath `@ayepi/rate/redis`
 
@@ -158,10 +159,10 @@ it in another middleware's `requires` (see `ayepi-core-middleware.md`).
 ### The impl (`@ayepi/rate/server`)
 
 ```ts
-rateLimit.server: <const R extends readonly AnyMiddleware[]>(
-  def: RateLimitDef<{ ratelimit: RateLimitInfo }, R>,
-  opts: RateLimitServerOptions<StackCtx<R>, R>,
-) => BoundMiddleware  // pass to implement(api).middleware(...)
+rateLimit.server: <M extends AnyMiddleware>(
+  def: M,                              // a RateLimitDef — its `requires` types `io.ctx`
+  opts: RateLimitServerOptions<M>,
+) => BoundMiddleware<M>  // pass to implement(api).middleware(...)
 ```
 
 `.server` binds the policy and returns the bound pair. It composes with the chainable
@@ -170,20 +171,35 @@ rateLimit.server: <const R extends readonly AnyMiddleware[]>(
 ### `RateLimitServerOptions`
 
 ```ts
-interface RateLimitServerOptions<Ctx extends object, R extends readonly AnyMiddleware[]>
-  extends LimiterOptions {
+// A rule field is either a fixed value or resolved per request from the key `io`.
+type RateKeyFn<M, T> = (io: RateKeyIO<StackCtx<ReqOf<M>>>) => T;
+type Dynamic<M, T>   = T | RateKeyFn<M, T>;
+
+interface RateLimitServerOptions<M extends AnyMiddleware> {
   /** Derive the rate-limit key from the request context (e.g. `io.ctx.user.id`). */
-  readonly key: (io: RateKeyIO<Ctx>) => string;
+  readonly key: RateKeyFn<M, string>;
+  /** Max requests (or token-bucket capacity) per window — fixed, or per request. */
+  readonly limit: Dynamic<M, number>;
+  /** Window length in ms (also the token refill period) — fixed, or per request. */
+  readonly window: Dynamic<M, number>;
+  /** Algorithm (default `'fixed-window'`) — fixed, or per request. */
+  readonly algorithm?: Dynamic<M, Algorithm>;
+  /** Count rejected (over-limit) requests against the limit (default `false`) — fixed, or per request. */
+  readonly countRejected?: Dynamic<M, boolean>;
+  /** Backend store (default an in-process `memoryStore`). */
+  readonly store?: RateLimitStore;
+  /** Key prefix/namespace (default `'rl:'`). */
+  readonly prefix?: string;
   /** Over-limit status code (default `429`). */
   readonly status?: number;
   /** Over-limit body — string, JSON value, or a function of (info, io). */
-  readonly message?: string | Json | ((info: RateLimitInfo, io: RateKeyIO<Ctx>) => string | Json);
+  readonly message?: string | Json | ((info: RateLimitInfo, io: RateKeyIO<StackCtx<ReqOf<M>>>) => string | Json);
   /** Response headers (see `RateLimitResponseOptions`). */
   readonly headers?: boolean | ((info: RateLimitInfo) => Record<string, string>);
   /** Also emit the `RateLimit-*` headers on allowed/skipped responses (default `false`). */
   readonly alwaysHeaders?: boolean;
   /** Bypass the limiter for some requests (e.g. an allow-list). */
-  readonly skip?: (io: RateKeyIO<Ctx>) => boolean;
+  readonly skip?: RateKeyFn<M, boolean>;
   /** Serve through (as allowed) when the **store** errors, instead of failing the request. Default `false` (fail-closed). */
   readonly failOpen?: boolean;
   /** Observe a store error (e.g. Redis down). Fires regardless of `failOpen`. Off by default; must not throw. */
@@ -191,30 +207,24 @@ interface RateLimitServerOptions<Ctx extends object, R extends readonly AnyMiddl
 }
 ```
 
+> **Dynamic policy.** `limit`, `window`, `algorithm`, and `countRejected` each accept a plain
+> value **or** a `(io) => value` resolved per request — so different callers get different
+> limits (e.g. a higher `limit` for a premium plan, a longer `window` for a trusted key). `io`
+> is the same `{ req, ctx }` `key`/`skip` receive, with `io.ctx` typed from the def's `requires`.
+> Resolve `window`/`algorithm` from a **stable** property of the identity (a given key should
+> always map to the same window/algorithm) — the store buckets its per-key state by them, so
+> varying them for one key across requests gives inconsistent accounting. Varying only `limit`
+> is always safe.
+
 > **Store errors.** By default the limiter is **fail-closed**: if the store (e.g. a Redis
 > outage) throws, the error propagates and the request is rejected — a store outage doesn't
 > silently lift the limit. Set `failOpen: true` to serve such requests through instead, and/or
 > `onError` to observe the failure (it fires either way). `rateLimitedDoer` takes an `onError`
 > too: a store error there is reported and admission retried — it never strands pending tasks.
 
-…plus everything from `LimiterOptions`:
-
-```ts
-interface LimiterOptions {
-  /** Max requests (or token-bucket capacity) per window. */
-  readonly limit: number;
-  /** Window length in milliseconds (also the token refill period). */
-  readonly window: number;
-  /** Algorithm (default `'fixed-window'`). */
-  readonly algorithm?: Algorithm;
-  /** Backend store (default an in-process `memoryStore`). */
-  readonly store?: RateLimitStore;
-  /** Key prefix/namespace (default `'rl:'`). */
-  readonly prefix?: string;
-  /** Count requests that are themselves rejected (over-limit) against the limit (default `false`). */
-  readonly countRejected?: boolean;
-}
-```
+> The standalone `limiter()` primitive (and `rateLimitedDoer`) still takes a **static**
+> `LimiterOptions` (`limit`/`window`/`algorithm`/`store`/`prefix`/`countRejected`) — dynamic
+> resolution is a middleware feature, since only the request path carries an `io`.
 
 Notes grounded in the source:
 
@@ -304,6 +314,24 @@ const app = implement(api)
   .server()
 ```
 
+### Example — per-caller limits (dynamic `limit`)
+
+```ts
+// shared.ts — auth provides { user: { id, plan } }
+const limit = rateLimit({ requires: [auth] })
+// server.ts
+rateLimit.server(limit, {
+  key: (io) => io.ctx.user.id,
+  limit: (io) => (io.ctx.user.plan === 'pro' ? 1_000 : 100), // premium callers get more
+  window: 60_000,                                            // keep window/algorithm stable per key
+  algorithm: 'sliding-window',
+})
+```
+
+Any of `limit` / `window` / `algorithm` / `countRejected` can be a `(io) => value`. Derive
+`window`/`algorithm` from a stable identity attribute (plan, tenant) — not from time or the
+request path — so a given key always maps to the same bucketing.
+
 ### Example — per-IP limiting without `requires`
 
 ```ts

package/dist/index.cjs

@@ -66,10 +66,10 @@ function limiter(opts) {
 	const rule = {
 		limit: opts.limit,
 		window: opts.window,
-		algorithm: opts.algorithm ?? DEFAULT_ALGORITHM,
+		algorithm: opts.algorithm ?? "fixed-window",
 		countRejected: opts.countRejected ?? false
 	};
-	const prefix = opts.prefix ?? DEFAULT_PREFIX;
+	const prefix = opts.prefix ?? "rl:";
 	return {
 		rule,
 		check: (key, now) => store.consume(prefix + key, rule, now ?? Date.now()),
@@ -329,6 +329,8 @@ function memoryStore() {
 	};
 }
 //#endregion
+exports.DEFAULT_ALGORITHM = DEFAULT_ALGORITHM;
+exports.DEFAULT_PREFIX = DEFAULT_PREFIX;
 exports.limiter = limiter;
 exports.memoryStore = memoryStore;
 exports.rateLimit = rateLimit;

package/dist/index.d.cts

@@ -3,6 +3,10 @@ import { Doer, DoerTaskOptions } from "@ayepi/core/doer";
 
 //#region src/index.d.ts
 
+/** Default key namespace. */
+declare const DEFAULT_PREFIX = "rl:";
+/** Default algorithm. */
+declare const DEFAULT_ALGORITHM: Algorithm;
 /** The rate-limiting algorithm. */
 type Algorithm = 'fixed-window' | 'sliding-window' | 'token-bucket';
 /** Limiter state for one key, exposed to handlers (via `ctx.ratelimit`) and response headers. */
@@ -186,4 +190,4 @@ declare function rateLimitedDoer(opts: RateLimitedDoerOptions): Doer;
  */
 declare function memoryStore(): RateLimitStore;
 //#endregion
-export { Algorithm, Limiter, LimiterOptions, RateKeyIO, RateLimitDef, RateLimitDefOptions, RateLimitInfo, RateLimitResponseOptions, RateLimitResult, RateLimitRule, RateLimitStore, RateLimitedDoerOptions, limiter, memoryStore, rateLimit, rateLimitHeaders, rateLimitResponse, rateLimitedDoer };
+export { Algorithm, DEFAULT_ALGORITHM, DEFAULT_PREFIX, Limiter, LimiterOptions, RateKeyIO, RateLimitDef, RateLimitDefOptions, RateLimitInfo, RateLimitResponseOptions, RateLimitResult, RateLimitRule, RateLimitStore, RateLimitedDoerOptions, limiter, memoryStore, rateLimit, rateLimitHeaders, rateLimitResponse, rateLimitedDoer };

package/dist/index.d.ts

@@ -3,6 +3,10 @@ import { Doer, DoerTaskOptions } from "@ayepi/core/doer";
 
 //#region src/index.d.ts
 
+/** Default key namespace. */
+declare const DEFAULT_PREFIX = "rl:";
+/** Default algorithm. */
+declare const DEFAULT_ALGORITHM: Algorithm;
 /** The rate-limiting algorithm. */
 type Algorithm = 'fixed-window' | 'sliding-window' | 'token-bucket';
 /** Limiter state for one key, exposed to handlers (via `ctx.ratelimit`) and response headers. */
@@ -186,4 +190,4 @@ declare function rateLimitedDoer(opts: RateLimitedDoerOptions): Doer;
  */
 declare function memoryStore(): RateLimitStore;
 //#endregion
-export { Algorithm, Limiter, LimiterOptions, RateKeyIO, RateLimitDef, RateLimitDefOptions, RateLimitInfo, RateLimitResponseOptions, RateLimitResult, RateLimitRule, RateLimitStore, RateLimitedDoerOptions, limiter, memoryStore, rateLimit, rateLimitHeaders, rateLimitResponse, rateLimitedDoer };
+export { Algorithm, DEFAULT_ALGORITHM, DEFAULT_PREFIX, Limiter, LimiterOptions, RateKeyIO, RateLimitDef, RateLimitDefOptions, RateLimitInfo, RateLimitResponseOptions, RateLimitResult, RateLimitRule, RateLimitStore, RateLimitedDoerOptions, limiter, memoryStore, rateLimit, rateLimitHeaders, rateLimitResponse, rateLimitedDoer };

package/dist/index.js

@@ -65,10 +65,10 @@ function limiter(opts) {
 	const rule = {
 		limit: opts.limit,
 		window: opts.window,
-		algorithm: opts.algorithm ?? DEFAULT_ALGORITHM,
+		algorithm: opts.algorithm ?? "fixed-window",
 		countRejected: opts.countRejected ?? false
 	};
-	const prefix = opts.prefix ?? DEFAULT_PREFIX;
+	const prefix = opts.prefix ?? "rl:";
 	return {
 		rule,
 		check: (key, now) => store.consume(prefix + key, rule, now ?? Date.now()),
@@ -328,4 +328,4 @@ function memoryStore() {
 	};
 }
 //#endregion
-export { limiter, memoryStore, rateLimit, rateLimitHeaders, rateLimitResponse, rateLimitedDoer };
+export { DEFAULT_ALGORITHM, DEFAULT_PREFIX, limiter, memoryStore, rateLimit, rateLimitHeaders, rateLimitResponse, rateLimitedDoer };

package/dist/server.cjs

@@ -1,22 +1,34 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_index = require("./index.cjs");
 //#region src/server.ts
+/** Resolve a {@link Dynamic} option for a request (calls it with `io` when it's a function). */
+function resolve(value, io) {
+	return typeof value === "function" ? value(io) : value;
+}
 /** Bind a {@link rateLimit} def to its runtime policy. */
 function rateLimitServer(def, opts) {
-	const lim = require_index.limiter(opts);
+	const store = opts.store ?? require_index.memoryStore();
+	const prefix = opts.prefix ?? "rl:";
 	const message = opts.message;
+	const ruleFor = (io) => ({
+		limit: resolve(opts.limit, io),
+		window: resolve(opts.window, io),
+		algorithm: (opts.algorithm !== void 0 ? resolve(opts.algorithm, io) : void 0) ?? "fixed-window",
+		countRejected: (opts.countRejected !== void 0 ? resolve(opts.countRejected, io) : void 0) ?? false
+	});
 	const run = async (io) => {
 		const kio = {
 			req: io.req,
 			ctx: io.ctx
 		};
+		const rule = ruleFor(kio);
 		const advertise = (info) => {
 			if (!opts.alwaysHeaders) return;
 			for (const [name, value] of Object.entries(require_index.rateLimitHeaders(info, opts.headers))) io.setHeader(name, value);
 		};
 		const fullBudget = () => ({
-			limit: lim.rule.limit,
-			remaining: lim.rule.limit,
+			limit: rule.limit,
+			remaining: rule.limit,
 			reset: 0,
 			retryAfter: 0
 		});
@@ -27,7 +39,7 @@ function rateLimitServer(def, opts) {
 		}
 		let result;
 		try {
-			result = await lim.check(opts.key(kio));
+			result = await store.consume(prefix + opts.key(kio), rule, Date.now());
 		} catch (err) {
 			try {
 				opts.onError?.(err);

package/dist/server.d.cts

@@ -5,22 +5,47 @@ import { AnyMiddleware, BoundMiddleware, Json, StackCtx } from "@ayepi/core";
 
 /** The `requires` chain of a middleware def. */
 type ReqOf<M extends AnyMiddleware> = M['__req'];
+/** The `io` (request + accumulated, typed context) passed to every per-request option of a bound {@link rateLimit}. */
+type KeyIO<M extends AnyMiddleware> = RateKeyIO<StackCtx<ReqOf<M>>>;
+/**
+ * A per-request option: derive `T` from the rate-limit key {@link RateKeyIO} — the same
+ * `(io) => T` shape `key` and `skip` use. `io.ctx` is typed from the def's `requires`.
+ */
+type RateKeyFn<M extends AnyMiddleware, T> = (io: KeyIO<M>) => T;
+/**
+ * A {@link RateLimitServerOptions} field that is either a fixed `T` or resolved **per request**
+ * from the key {@link RateKeyIO}. Use a function to vary the policy by caller — e.g. a larger
+ * `limit` for a premium plan, a longer `window` for a trusted client.
+ */
+type Dynamic<M extends AnyMiddleware, T> = T | RateKeyFn<M, T>;
 /**
  * Server-side options for binding a {@link rateLimit} def — the limiting policy and
  * response customization, with `key`/`skip`/`message` typed against the def's
  * `requires` context.
  *
+ * The rule itself — `limit`, `window`, `algorithm`, `countRejected` — can be a fixed value or
+ * a `(io) => T` resolved per request, so limits can differ by caller (plan, tenant, API key).
+ * **Resolve these from a stable property of the identity** (the same key should always map to
+ * the same `window`/`algorithm`): the store buckets its per-key state by them, so varying
+ * `window`/`algorithm` for one key across requests gives inconsistent accounting. Varying only
+ * `limit` is always safe. See {@link Dynamic}.
+ *
  * @typeParam M - the rate-limit def being bound.
  */
 interface RateLimitServerOptions<M extends AnyMiddleware> {
   /** Derive the rate-limit key from the request context (e.g. `io.ctx.user.id`). */
-  readonly key: (io: RateKeyIO<StackCtx<ReqOf<M>>>) => string;
-  /** Max requests (or token-bucket capacity) per window. */
-  readonly limit: number;
-  /** Window length in milliseconds (also the token refill period). */
-  readonly window: number;
-  /** Algorithm (default `'fixed-window'`). */
-  readonly algorithm?: Algorithm;
+  readonly key: RateKeyFn<M, string>;
+  /** Max requests (or token-bucket capacity) per window — fixed, or per request. */
+  readonly limit: Dynamic<M, number>;
+  /** Window length in milliseconds (also the token refill period) — fixed, or per request. */
+  readonly window: Dynamic<M, number>;
+  /** Algorithm (default `'fixed-window'`) — fixed, or per request. */
+  readonly algorithm?: Dynamic<M, Algorithm>;
+  /**
+   * Count requests that are themselves rejected (over-limit) against the limit — fixed, or per
+   * request. Default `false`; see {@link RateLimitRule.countRejected}.
+   */
+  readonly countRejected?: Dynamic<M, boolean>;
   /** Backend store (default an in-process memory store). */
   readonly store?: RateLimitStore;
   /** Key prefix/namespace (default `'rl:'`). */
@@ -28,7 +53,7 @@ interface RateLimitServerOptions<M extends AnyMiddleware> {
   /** Over-limit status code (default `429`). */
   readonly status?: number;
   /** Over-limit body — a string, a JSON value, or a function of the limiter info and request. */
-  readonly message?: string | Json | ((info: RateLimitInfo, io: RateKeyIO<StackCtx<ReqOf<M>>>) => string | Json);
+  readonly message?: string | Json | ((info: RateLimitInfo, io: KeyIO<M>) => string | Json);
   /** Response headers (draft `RateLimit-*` + `Retry-After` by default; `false` for none; a function for your own). */
   readonly headers?: boolean | ((info: RateLimitInfo) => Record<string, string>);
   /**
@@ -39,7 +64,7 @@ interface RateLimitServerOptions<M extends AnyMiddleware> {
    */
   readonly alwaysHeaders?: boolean;
   /** Bypass the limiter for some requests (e.g. an allow-list). */
-  readonly skip?: (io: RateKeyIO<StackCtx<ReqOf<M>>>) => boolean;
+  readonly skip?: RateKeyFn<M, boolean>;
   /**
    * What to do when the **store itself errors** (e.g. Redis is down) — `true` serves the
    * request through (as if allowed, full budget); `false` (default) is fail-**closed**: the
@@ -64,4 +89,4 @@ declare const rateLimit: typeof rateLimit$1 & {
   server: typeof rateLimitServer;
 };
 //#endregion
-export { RateLimitServerOptions, rateLimit };
+export { Dynamic, RateKeyFn, RateLimitServerOptions, rateLimit };

package/dist/server.d.ts

@@ -5,22 +5,47 @@ import { AnyMiddleware, BoundMiddleware, Json, StackCtx } from "@ayepi/core";
 
 /** The `requires` chain of a middleware def. */
 type ReqOf<M extends AnyMiddleware> = M['__req'];
+/** The `io` (request + accumulated, typed context) passed to every per-request option of a bound {@link rateLimit}. */
+type KeyIO<M extends AnyMiddleware> = RateKeyIO<StackCtx<ReqOf<M>>>;
+/**
+ * A per-request option: derive `T` from the rate-limit key {@link RateKeyIO} — the same
+ * `(io) => T` shape `key` and `skip` use. `io.ctx` is typed from the def's `requires`.
+ */
+type RateKeyFn<M extends AnyMiddleware, T> = (io: KeyIO<M>) => T;
+/**
+ * A {@link RateLimitServerOptions} field that is either a fixed `T` or resolved **per request**
+ * from the key {@link RateKeyIO}. Use a function to vary the policy by caller — e.g. a larger
+ * `limit` for a premium plan, a longer `window` for a trusted client.
+ */
+type Dynamic<M extends AnyMiddleware, T> = T | RateKeyFn<M, T>;
 /**
  * Server-side options for binding a {@link rateLimit} def — the limiting policy and
  * response customization, with `key`/`skip`/`message` typed against the def's
  * `requires` context.
  *
+ * The rule itself — `limit`, `window`, `algorithm`, `countRejected` — can be a fixed value or
+ * a `(io) => T` resolved per request, so limits can differ by caller (plan, tenant, API key).
+ * **Resolve these from a stable property of the identity** (the same key should always map to
+ * the same `window`/`algorithm`): the store buckets its per-key state by them, so varying
+ * `window`/`algorithm` for one key across requests gives inconsistent accounting. Varying only
+ * `limit` is always safe. See {@link Dynamic}.
+ *
  * @typeParam M - the rate-limit def being bound.
  */
 interface RateLimitServerOptions<M extends AnyMiddleware> {
   /** Derive the rate-limit key from the request context (e.g. `io.ctx.user.id`). */
-  readonly key: (io: RateKeyIO<StackCtx<ReqOf<M>>>) => string;
-  /** Max requests (or token-bucket capacity) per window. */
-  readonly limit: number;
-  /** Window length in milliseconds (also the token refill period). */
-  readonly window: number;
-  /** Algorithm (default `'fixed-window'`). */
-  readonly algorithm?: Algorithm;
+  readonly key: RateKeyFn<M, string>;
+  /** Max requests (or token-bucket capacity) per window — fixed, or per request. */
+  readonly limit: Dynamic<M, number>;
+  /** Window length in milliseconds (also the token refill period) — fixed, or per request. */
+  readonly window: Dynamic<M, number>;
+  /** Algorithm (default `'fixed-window'`) — fixed, or per request. */
+  readonly algorithm?: Dynamic<M, Algorithm>;
+  /**
+   * Count requests that are themselves rejected (over-limit) against the limit — fixed, or per
+   * request. Default `false`; see {@link RateLimitRule.countRejected}.
+   */
+  readonly countRejected?: Dynamic<M, boolean>;
   /** Backend store (default an in-process memory store). */
   readonly store?: RateLimitStore;
   /** Key prefix/namespace (default `'rl:'`). */
@@ -28,7 +53,7 @@ interface RateLimitServerOptions<M extends AnyMiddleware> {
   /** Over-limit status code (default `429`). */
   readonly status?: number;
   /** Over-limit body — a string, a JSON value, or a function of the limiter info and request. */
-  readonly message?: string | Json | ((info: RateLimitInfo, io: RateKeyIO<StackCtx<ReqOf<M>>>) => string | Json);
+  readonly message?: string | Json | ((info: RateLimitInfo, io: KeyIO<M>) => string | Json);
   /** Response headers (draft `RateLimit-*` + `Retry-After` by default; `false` for none; a function for your own). */
   readonly headers?: boolean | ((info: RateLimitInfo) => Record<string, string>);
   /**
@@ -39,7 +64,7 @@ interface RateLimitServerOptions<M extends AnyMiddleware> {
    */
   readonly alwaysHeaders?: boolean;
   /** Bypass the limiter for some requests (e.g. an allow-list). */
-  readonly skip?: (io: RateKeyIO<StackCtx<ReqOf<M>>>) => boolean;
+  readonly skip?: RateKeyFn<M, boolean>;
   /**
    * What to do when the **store itself errors** (e.g. Redis is down) — `true` serves the
    * request through (as if allowed, full budget); `false` (default) is fail-**closed**: the
@@ -64,4 +89,4 @@ declare const rateLimit: typeof rateLimit$1 & {
   server: typeof rateLimitServer;
 };
 //#endregion
-export { RateLimitServerOptions, rateLimit };
+export { Dynamic, RateKeyFn, RateLimitServerOptions, rateLimit };

package/dist/server.js

@@ -1,21 +1,33 @@
-import { limiter, rateLimit as rateLimit$1, rateLimitHeaders, rateLimitResponse } from "./index.js";
+import { memoryStore, rateLimit as rateLimit$1, rateLimitHeaders, rateLimitResponse } from "./index.js";
 //#region src/server.ts
+/** Resolve a {@link Dynamic} option for a request (calls it with `io` when it's a function). */
+function resolve(value, io) {
+	return typeof value === "function" ? value(io) : value;
+}
 /** Bind a {@link rateLimit} def to its runtime policy. */
 function rateLimitServer(def, opts) {
-	const lim = limiter(opts);
+	const store = opts.store ?? memoryStore();
+	const prefix = opts.prefix ?? "rl:";
 	const message = opts.message;
+	const ruleFor = (io) => ({
+		limit: resolve(opts.limit, io),
+		window: resolve(opts.window, io),
+		algorithm: (opts.algorithm !== void 0 ? resolve(opts.algorithm, io) : void 0) ?? "fixed-window",
+		countRejected: (opts.countRejected !== void 0 ? resolve(opts.countRejected, io) : void 0) ?? false
+	});
 	const run = async (io) => {
 		const kio = {
 			req: io.req,
 			ctx: io.ctx
 		};
+		const rule = ruleFor(kio);
 		const advertise = (info) => {
 			if (!opts.alwaysHeaders) return;
 			for (const [name, value] of Object.entries(rateLimitHeaders(info, opts.headers))) io.setHeader(name, value);
 		};
 		const fullBudget = () => ({
-			limit: lim.rule.limit,
-			remaining: lim.rule.limit,
+			limit: rule.limit,
+			remaining: rule.limit,
 			reset: 0,
 			retryAfter: 0
 		});
@@ -26,7 +38,7 @@ function rateLimitServer(def, opts) {
 		}
 		let result;
 		try {
-			result = await lim.check(opts.key(kio));
+			result = await store.consume(prefix + opts.key(kio), rule, Date.now());
 		} catch (err) {
 			try {
 				opts.onError?.(err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ayepi/rate",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Rate-limiting middleware for @ayepi/core — pluggable stores, multiple algorithms, customizable 429 responses",
   "license": "MIT",
   "publishConfig": {
@@ -59,7 +59,7 @@
   },
   "peerDependencies": {
     "ioredis": "^5",
-    "@ayepi/core": "^0.2.0"
+    "@ayepi/core": "^0.3.0"
   },
   "peerDependenciesMeta": {
     "ioredis": {
@@ -74,7 +74,7 @@
     "tsdown": "^0.12.0",
     "vitest": "^2.1.8",
     "zod": "^4.4.3",
-    "@ayepi/core": "0.2.0"
+    "@ayepi/core": "0.3.0"
   },
   "keywords": [
     "ayepi",