@ayepi/rate 0.2.0 → 0.4.0

package/dist/server.d.ts

@@ -5,22 +5,47 @@ import { AnyMiddleware, BoundMiddleware, Json, StackCtx } from "@ayepi/core";
 
 /** The `requires` chain of a middleware def. */
 type ReqOf<M extends AnyMiddleware> = M['__req'];
+/** The `io` (request + accumulated, typed context) passed to every per-request option of a bound {@link rateLimit}. */
+type KeyIO<M extends AnyMiddleware> = RateKeyIO<StackCtx<ReqOf<M>>>;
+/**
+ * A per-request option: derive `T` from the rate-limit key {@link RateKeyIO} — the same
+ * `(io) => T` shape `key` and `skip` use. `io.ctx` is typed from the def's `requires`.
+ */
+type RateKeyFn<M extends AnyMiddleware, T> = (io: KeyIO<M>) => T;
+/**
+ * A {@link RateLimitServerOptions} field that is either a fixed `T` or resolved **per request**
+ * from the key {@link RateKeyIO}. Use a function to vary the policy by caller — e.g. a larger
+ * `limit` for a premium plan, a longer `window` for a trusted client.
+ */
+type Dynamic<M extends AnyMiddleware, T> = T | RateKeyFn<M, T>;
 /**
  * Server-side options for binding a {@link rateLimit} def — the limiting policy and
  * response customization, with `key`/`skip`/`message` typed against the def's
  * `requires` context.
  *
+ * The rule itself — `limit`, `window`, `algorithm`, `countRejected` — can be a fixed value or
+ * a `(io) => T` resolved per request, so limits can differ by caller (plan, tenant, API key).
+ * **Resolve these from a stable property of the identity** (the same key should always map to
+ * the same `window`/`algorithm`): the store buckets its per-key state by them, so varying
+ * `window`/`algorithm` for one key across requests gives inconsistent accounting. Varying only
+ * `limit` is always safe. See {@link Dynamic}.
+ *
  * @typeParam M - the rate-limit def being bound.
  */
 interface RateLimitServerOptions<M extends AnyMiddleware> {
   /** Derive the rate-limit key from the request context (e.g. `io.ctx.user.id`). */
-  readonly key: (io: RateKeyIO<StackCtx<ReqOf<M>>>) => string;
-  /** Max requests (or token-bucket capacity) per window. */
-  readonly limit: number;
-  /** Window length in milliseconds (also the token refill period). */
-  readonly window: number;
-  /** Algorithm (default `'fixed-window'`). */
-  readonly algorithm?: Algorithm;
+  readonly key: RateKeyFn<M, string>;
+  /** Max requests (or token-bucket capacity) per window — fixed, or per request. */
+  readonly limit: Dynamic<M, number>;
+  /** Window length in milliseconds (also the token refill period) — fixed, or per request. */
+  readonly window: Dynamic<M, number>;
+  /** Algorithm (default `'fixed-window'`) — fixed, or per request. */
+  readonly algorithm?: Dynamic<M, Algorithm>;
+  /**
+   * Count requests that are themselves rejected (over-limit) against the limit — fixed, or per
+   * request. Default `false`; see {@link RateLimitRule.countRejected}.
+   */
+  readonly countRejected?: Dynamic<M, boolean>;
   /** Backend store (default an in-process memory store). */
   readonly store?: RateLimitStore;
   /** Key prefix/namespace (default `'rl:'`). */
@@ -28,7 +53,7 @@ interface RateLimitServerOptions<M extends AnyMiddleware> {
   /** Over-limit status code (default `429`). */
   readonly status?: number;
   /** Over-limit body — a string, a JSON value, or a function of the limiter info and request. */
-  readonly message?: string | Json | ((info: RateLimitInfo, io: RateKeyIO<StackCtx<ReqOf<M>>>) => string | Json);
+  readonly message?: string | Json | ((info: RateLimitInfo, io: KeyIO<M>) => string | Json);
   /** Response headers (draft `RateLimit-*` + `Retry-After` by default; `false` for none; a function for your own). */
   readonly headers?: boolean | ((info: RateLimitInfo) => Record<string, string>);
   /**
@@ -39,7 +64,7 @@ interface RateLimitServerOptions<M extends AnyMiddleware> {
    */
   readonly alwaysHeaders?: boolean;
   /** Bypass the limiter for some requests (e.g. an allow-list). */
-  readonly skip?: (io: RateKeyIO<StackCtx<ReqOf<M>>>) => boolean;
+  readonly skip?: RateKeyFn<M, boolean>;
   /**
    * What to do when the **store itself errors** (e.g. Redis is down) — `true` serves the
    * request through (as if allowed, full budget); `false` (default) is fail-**closed**: the
@@ -64,4 +89,4 @@ declare const rateLimit: typeof rateLimit$1 & {
   server: typeof rateLimitServer;
 };
 //#endregion
-export { RateLimitServerOptions, rateLimit };
+export { Dynamic, RateKeyFn, RateLimitServerOptions, rateLimit };

package/dist/server.js

@@ -1,21 +1,33 @@
-import { limiter, rateLimit as rateLimit$1, rateLimitHeaders, rateLimitResponse } from "./index.js";
+import { memoryStore, rateLimit as rateLimit$1, rateLimitHeaders, rateLimitResponse } from "./index.js";
 //#region src/server.ts
+/** Resolve a {@link Dynamic} option for a request (calls it with `io` when it's a function). */
+function resolve(value, io) {
+	return typeof value === "function" ? value(io) : value;
+}
 /** Bind a {@link rateLimit} def to its runtime policy. */
 function rateLimitServer(def, opts) {
-	const lim = limiter(opts);
+	const store = opts.store ?? memoryStore();
+	const prefix = opts.prefix ?? "rl:";
 	const message = opts.message;
+	const ruleFor = (io) => ({
+		limit: resolve(opts.limit, io),
+		window: resolve(opts.window, io),
+		algorithm: (opts.algorithm !== void 0 ? resolve(opts.algorithm, io) : void 0) ?? "fixed-window",
+		countRejected: (opts.countRejected !== void 0 ? resolve(opts.countRejected, io) : void 0) ?? false
+	});
 	const run = async (io) => {
 		const kio = {
 			req: io.req,
 			ctx: io.ctx
 		};
+		const rule = ruleFor(kio);
 		const advertise = (info) => {
 			if (!opts.alwaysHeaders) return;
 			for (const [name, value] of Object.entries(rateLimitHeaders(info, opts.headers))) io.setHeader(name, value);
 		};
 		const fullBudget = () => ({
-			limit: lim.rule.limit,
-			remaining: lim.rule.limit,
+			limit: rule.limit,
+			remaining: rule.limit,
 			reset: 0,
 			retryAfter: 0
 		});
@@ -26,7 +38,7 @@ function rateLimitServer(def, opts) {
 		}
 		let result;
 		try {
-			result = await lim.check(opts.key(kio));
+			result = await store.consume(prefix + opts.key(kio), rule, Date.now());
 		} catch (err) {
 			try {
 				opts.onError?.(err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ayepi/rate",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Rate-limiting middleware for @ayepi/core — pluggable stores, multiple algorithms, customizable 429 responses",
   "license": "MIT",
   "publishConfig": {
@@ -59,7 +59,7 @@
   },
   "peerDependencies": {
     "ioredis": "^5",
-    "@ayepi/core": "^0.2.0"
+    "@ayepi/core": "^0.4.0"
   },
   "peerDependenciesMeta": {
     "ioredis": {
@@ -74,7 +74,7 @@
     "tsdown": "^0.12.0",
     "vitest": "^2.1.8",
     "zod": "^4.4.3",
-    "@ayepi/core": "0.2.0"
+    "@ayepi/core": "0.4.0"
   },
   "keywords": [
     "ayepi",