@lunora/ratelimit 1.0.0-alpha.123 → 1.0.0-alpha.125

package/dist/index.d.mts

@@ -80,6 +80,18 @@ interface RateLimitStore {
   delete: (storageKey: string) => Promise<void> | void;
   get: (storageKey: string) => Promise<RateLimitValue | undefined> | RateLimitValue | undefined;
   set: (storageKey: string, value: RateLimitValue) => Promise<void> | void;
+  /**
+   * Optional conditional write: persist `value` only while the stored value is
+   * still `prior` (what `get` returned for this consume, `undefined` for no
+   * row), and resolve `false` when it no longer is. When present the limiter
+   * writes through it instead of `set`, and a `false` makes it read and decide
+   * again rather than admit off a stale read.
+   *
+   * A store whose `get` and write cannot be interleaved by another consume
+   * (memory, SQL: synchronous) needs none. One whose calls can be
+   * (`createDbStore`: every call is awaited I/O) must have it.
+   */
+  setIf?: (storageKey: string, value: RateLimitValue, prior: RateLimitValue | undefined) => Promise<boolean>;
 }
 /** Inputs to {@link evaluate}. */
 interface EvaluateOptions {
@@ -173,6 +185,16 @@ declare class RateLimiter<Names extends string = string> {
   reset(name: Names, args?: {
     key?: string;
   }): Promise<void>;
+  /**
+   * Read, evaluate and write one consume. A store that reports the write lost
+   * (`setIf` resolved `false`: another consume changed the value since this one
+   * read it) gets a fresh read and a fresh decision, so the admission always
+   * rests on the value the write replaced. Bounded: each lost round means some
+   * other consume was admitted (a refusal writes nothing), and past
+   * {@link MAX_DECIDE_ATTEMPTS} the call is refused with `retryAfter: 0` rather
+   * than admitted.
+   */
+  private decide;
   private normalizeKey;
   private resolve;
   private run;
@@ -249,34 +271,14 @@ interface SqlStoreOptions {
  * SQLite-backed store for durable, per-DO rate-limit state. Persists each
  * `(name, key)` pair as one row so limits survive hibernation and eviction.
  *
- * **Atomicity:** the store does not wrap individual operations in an explicit
- * SQL transaction. Inside a Durable Object the DO's input gate serializes
- * every RPC call against the storage, so the limiter's read-modify-write
- * sequence runs to completion without interleaving — this is the same
- * guarantee the surrounding `evaluate()` step depends on. **Outside a DO**
- * (e.g. driving `createSqlStore` from a long-lived `node:sqlite` connection in
- * tests or a custom host) the caller is responsible for serialization; the
- * SQL surface used here (`exec`) is not a substitute for transactional
- * isolation across concurrent invocations.
+ * **Atomicity:** `exec` is synchronous and the limiter does not yield between a
+ * synchronous store's read and its write, so one consume's read, decision and
+ * write run as a single JavaScript step. No other call on the same isolate can
+ * interleave, which is what makes concurrent consumes admit exactly the
+ * configured rate. Two isolates sharing one SQLite file (not a Durable Object
+ * case) are not covered; serialize those yourself.
  */
 declare const createSqlStore: (options: SqlStoreOptions) => RateLimitStore;
-/**
- * The slice of an index-range builder the store uses. Mirrors `@lunora/server`'s
- * `IndexRangeBuilder` field-for-field so the real `ctx.db` query builder is
- * assignable; only `eq` is exercised.
- */
-interface RateLimitDatabaseIndexRange {
-  eq: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-  gt: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-  gte: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-  lt: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-  lte: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-}
-/** The slice of a `ctx.db` table query the store relies on. */
-interface RateLimitDatabaseQuery {
-  first: () => Promise<Record<string, unknown> | null>;
-  withIndex: (indexName: string, range: (q: RateLimitDatabaseIndexRange) => RateLimitDatabaseIndexRange) => RateLimitDatabaseQuery;
-}
 /**
  * The READ slice — everything the store needs to answer `RateLimiter.getValue`
  * and `check`, which the docs describe as projecting the stored value forward to
@@ -287,9 +289,16 @@ interface RateLimitDatabaseQuery {
  * at all — every remaining-quota display had to cast, and a cast that appears
  * often enough stops carrying information. The distinction was already in the
  * methods: `getValue`/`check` read, `limit`/`reset` write.
+ *
+ * `findFirst` rather than `query(table).withIndex(...)`: a `.global()` table's
+ * reader has no `withIndex`, so the indexed builder failed every read there.
+ * `findFirst` routes to whichever backend owns the table, and an equality on the
+ * key column still uses its index.
  */
 interface RateLimitDatabaseReader {
-  query: (table: string) => RateLimitDatabaseQuery;
+  findFirst: (table: string, args?: {
+    where?: Record<string, unknown>;
+  }) => Promise<Record<string, unknown> | null>;
 }
 /**
  * The slice of the Lunora ORM writer (`ctx.db` on a mutation/action) the store
@@ -299,14 +308,20 @@ interface RateLimitDatabaseReader {
  */
 interface RateLimitDatabase extends RateLimitDatabaseReader {
   delete: <T extends string>(id: Id<T>) => Promise<void>;
-  insert: <T extends string>(table: T, document: Record<string, unknown>) => Promise<Id<T>>;
-  patch: <T extends string>(id: Id<T>, patch: Record<string, unknown>) => Promise<void>;
+  insert: <T extends string>(table: T, document: Record<string, unknown>, options?: {
+    clientId?: string;
+  }) => Promise<Id<T>>;
+  patchIf: <T extends string>(table: T, id: Id<T>, args: {
+    patch: Record<string, unknown>;
+    where: Record<string, unknown>;
+  }) => Promise<{
+    applied: boolean;
+    doc: Record<string, unknown> | null;
+  }>;
 }
-/** The table/column/index knobs shared by the read-only and read-write stores. */
+/** The table/column knobs shared by the read-only and read-write stores. */
 interface DatabaseStoreLocation {
-  /** Index that resolves a row by its key column. Defaults to `by_key`. */
-  index?: string;
-  /** Column storing the opaque key. Defaults to `key`. */
+  /** Column storing the opaque key. Defaults to `key`. Index it: every consume reads by it. */
   keyField?: string;
   /** Table holding one row per `(name, key)` pair. Defaults to `rateLimits`. */
   table?: string;
@@ -320,9 +335,10 @@ interface ReadOnlyDatabaseStoreOptions extends DatabaseStoreLocation {
   db: RateLimitDatabaseReader;
 }
 /**
- * Store backed by a Lunora table through `ctx.db`, for durable per-DO limits
- * inside a procedure (the procedure context exposes no raw SQL). Declare a
- * table with the key column and its index, e.g.
+ * Store backed by a Lunora table through `ctx.db`, for durable limits inside a
+ * procedure (the procedure context exposes no raw SQL). Works on a shard-local
+ * table and on a `.global()` one. Declare a table with the key column and its
+ * index, e.g.
  *
  * ```ts
  * rateLimits: defineTable({
@@ -333,15 +349,22 @@ interface ReadOnlyDatabaseStoreOptions extends DatabaseStoreLocation {
  * }).index("by_key", ["key"])
  * ```
  *
- * Each operation is a read-then-write; inside a mutation/action that pair runs
- * under the DO's input gate, so it is atomic against concurrent calls.
+ * **Atomic against concurrent consumes.** `setIf` writes only if the row still
+ * holds the value `get` returned: an existing row through `ctx.db.patchIf` with
+ * that value as its `where`, a new row through an `insert` under an id derived
+ * from the key, which a concurrent creator's insert collides with. A consume
+ * that loses either race gets `false` back and the limiter reads and decides
+ * again, so a limit of 1 admits one caller however many arrive together — on a
+ * `.global()` table too, where D1 calls do not hold the Durable Object's input
+ * gate.
  *
  * **Consumption commits with the procedure.** A mutation's `ctx.db` writes ride
  * its storage transaction, so a handler that throws after `limit()` rolls the
  * consumed unit back with everything else — inside a mutation this store counts
  * successful calls, not attempts. To charge every attempt (a login limiter),
  * consume from an action, where each write commits on its own, or return a
- * failure value from the mutation instead of throwing.
+ * failure value from the mutation instead of throwing. A `.global()` table's
+ * row lives in D1, outside the DO transaction, so there the unit stays spent.
  */
 declare const createDatabaseStore: (options: DatabaseStoreOptions) => RateLimitStore;
 /**
@@ -370,8 +393,8 @@ declare const createReadOnlyDatabaseStore: (options: ReadOnlyDatabaseStoreOption
  * on the DO the procedure runs on). Every query/mutation/action ctx exposes a
  * compatible `db`, so it slots straight into a `.use(...)` chain.
  *
- * Pass `options.store` to point at a non-default backing table/index/key column
- * (defaults: table `rateLimits`, index `by_key`, key column `key`); the rest of
+ * Pass `options.store` to point at a non-default backing table/key column
+ * (defaults: table `rateLimits`, key column `key`); the rest of
  * `options` (`key`, `count`, `failOpen`, `message`) is forwarded to
  * {@link rateLimit} unchanged. When `config` is precisely typed, `name`
  * autocompletes to its declared limit names.
@@ -496,4 +519,4 @@ interface TokenBudget {
  */
 declare const tokenBudget: <Names extends string>(limiter: RateLimiter<Names>, name: Names) => TokenBudget;
 declare const VERSION = "0.0.0";
-export { type DatabaseStoreOptions as DbStoreOptions, type EvaluateOptions, type EvaluateResult, type LimiterResolver, type RateLimitArgs, type RateLimitConfig, type RateLimitConfigMap, type RateLimitDatabase as RateLimitDb, type RateLimitDatabaseIndexRange as RateLimitDbIndexRange, type RateLimitDatabaseQuery as RateLimitDbQuery, type RateLimitDatabaseReader as RateLimitDbReader, RateLimitError, type RateLimitKind, type RateLimitMiddlewareOptions, type RateLimitReason, type RateLimitStatus, type RateLimitStore, type RateLimitValue, RateLimiter, type RateLimiterOptions, type RatelimitApiContext, type ReadOnlyDatabaseStoreOptions as ReadOnlyDbStoreOptions, type SqlLike, type SqlStoreOptions, type TokenBudget, VERSION, availableAt, createDatabaseStore as createDbStore, createMemoryStore, createReadOnlyDatabaseStore as createReadOnlyDbStore, createSqlStore, databaseRateLimit as dbRateLimit, evaluate, rateLimit, ratelimitPlugin, tokenBudget };
+export { type DatabaseStoreOptions as DbStoreOptions, type EvaluateOptions, type EvaluateResult, type LimiterResolver, type RateLimitArgs, type RateLimitConfig, type RateLimitConfigMap, type RateLimitDatabase as RateLimitDb, type RateLimitDatabaseReader as RateLimitDbReader, RateLimitError, type RateLimitKind, type RateLimitMiddlewareOptions, type RateLimitReason, type RateLimitStatus, type RateLimitStore, type RateLimitValue, RateLimiter, type RateLimiterOptions, type RatelimitApiContext, type ReadOnlyDatabaseStoreOptions as ReadOnlyDbStoreOptions, type SqlLike, type SqlStoreOptions, type TokenBudget, VERSION, availableAt, createDatabaseStore as createDbStore, createMemoryStore, createReadOnlyDatabaseStore as createReadOnlyDbStore, createSqlStore, databaseRateLimit as dbRateLimit, evaluate, rateLimit, ratelimitPlugin, tokenBudget };

package/dist/index.d.ts

@@ -80,6 +80,18 @@ interface RateLimitStore {
   delete: (storageKey: string) => Promise<void> | void;
   get: (storageKey: string) => Promise<RateLimitValue | undefined> | RateLimitValue | undefined;
   set: (storageKey: string, value: RateLimitValue) => Promise<void> | void;
+  /**
+   * Optional conditional write: persist `value` only while the stored value is
+   * still `prior` (what `get` returned for this consume, `undefined` for no
+   * row), and resolve `false` when it no longer is. When present the limiter
+   * writes through it instead of `set`, and a `false` makes it read and decide
+   * again rather than admit off a stale read.
+   *
+   * A store whose `get` and write cannot be interleaved by another consume
+   * (memory, SQL: synchronous) needs none. One whose calls can be
+   * (`createDbStore`: every call is awaited I/O) must have it.
+   */
+  setIf?: (storageKey: string, value: RateLimitValue, prior: RateLimitValue | undefined) => Promise<boolean>;
 }
 /** Inputs to {@link evaluate}. */
 interface EvaluateOptions {
@@ -173,6 +185,16 @@ declare class RateLimiter<Names extends string = string> {
   reset(name: Names, args?: {
     key?: string;
   }): Promise<void>;
+  /**
+   * Read, evaluate and write one consume. A store that reports the write lost
+   * (`setIf` resolved `false`: another consume changed the value since this one
+   * read it) gets a fresh read and a fresh decision, so the admission always
+   * rests on the value the write replaced. Bounded: each lost round means some
+   * other consume was admitted (a refusal writes nothing), and past
+   * {@link MAX_DECIDE_ATTEMPTS} the call is refused with `retryAfter: 0` rather
+   * than admitted.
+   */
+  private decide;
   private normalizeKey;
   private resolve;
   private run;
@@ -249,34 +271,14 @@ interface SqlStoreOptions {
  * SQLite-backed store for durable, per-DO rate-limit state. Persists each
  * `(name, key)` pair as one row so limits survive hibernation and eviction.
  *
- * **Atomicity:** the store does not wrap individual operations in an explicit
- * SQL transaction. Inside a Durable Object the DO's input gate serializes
- * every RPC call against the storage, so the limiter's read-modify-write
- * sequence runs to completion without interleaving — this is the same
- * guarantee the surrounding `evaluate()` step depends on. **Outside a DO**
- * (e.g. driving `createSqlStore` from a long-lived `node:sqlite` connection in
- * tests or a custom host) the caller is responsible for serialization; the
- * SQL surface used here (`exec`) is not a substitute for transactional
- * isolation across concurrent invocations.
+ * **Atomicity:** `exec` is synchronous and the limiter does not yield between a
+ * synchronous store's read and its write, so one consume's read, decision and
+ * write run as a single JavaScript step. No other call on the same isolate can
+ * interleave, which is what makes concurrent consumes admit exactly the
+ * configured rate. Two isolates sharing one SQLite file (not a Durable Object
+ * case) are not covered; serialize those yourself.
  */
 declare const createSqlStore: (options: SqlStoreOptions) => RateLimitStore;
-/**
- * The slice of an index-range builder the store uses. Mirrors `@lunora/server`'s
- * `IndexRangeBuilder` field-for-field so the real `ctx.db` query builder is
- * assignable; only `eq` is exercised.
- */
-interface RateLimitDatabaseIndexRange {
-  eq: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-  gt: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-  gte: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-  lt: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-  lte: (field: string, value: unknown) => RateLimitDatabaseIndexRange;
-}
-/** The slice of a `ctx.db` table query the store relies on. */
-interface RateLimitDatabaseQuery {
-  first: () => Promise<Record<string, unknown> | null>;
-  withIndex: (indexName: string, range: (q: RateLimitDatabaseIndexRange) => RateLimitDatabaseIndexRange) => RateLimitDatabaseQuery;
-}
 /**
  * The READ slice — everything the store needs to answer `RateLimiter.getValue`
  * and `check`, which the docs describe as projecting the stored value forward to
@@ -287,9 +289,16 @@ interface RateLimitDatabaseQuery {
  * at all — every remaining-quota display had to cast, and a cast that appears
  * often enough stops carrying information. The distinction was already in the
  * methods: `getValue`/`check` read, `limit`/`reset` write.
+ *
+ * `findFirst` rather than `query(table).withIndex(...)`: a `.global()` table's
+ * reader has no `withIndex`, so the indexed builder failed every read there.
+ * `findFirst` routes to whichever backend owns the table, and an equality on the
+ * key column still uses its index.
  */
 interface RateLimitDatabaseReader {
-  query: (table: string) => RateLimitDatabaseQuery;
+  findFirst: (table: string, args?: {
+    where?: Record<string, unknown>;
+  }) => Promise<Record<string, unknown> | null>;
 }
 /**
  * The slice of the Lunora ORM writer (`ctx.db` on a mutation/action) the store
@@ -299,14 +308,20 @@ interface RateLimitDatabaseReader {
  */
 interface RateLimitDatabase extends RateLimitDatabaseReader {
   delete: <T extends string>(id: Id<T>) => Promise<void>;
-  insert: <T extends string>(table: T, document: Record<string, unknown>) => Promise<Id<T>>;
-  patch: <T extends string>(id: Id<T>, patch: Record<string, unknown>) => Promise<void>;
+  insert: <T extends string>(table: T, document: Record<string, unknown>, options?: {
+    clientId?: string;
+  }) => Promise<Id<T>>;
+  patchIf: <T extends string>(table: T, id: Id<T>, args: {
+    patch: Record<string, unknown>;
+    where: Record<string, unknown>;
+  }) => Promise<{
+    applied: boolean;
+    doc: Record<string, unknown> | null;
+  }>;
 }
-/** The table/column/index knobs shared by the read-only and read-write stores. */
+/** The table/column knobs shared by the read-only and read-write stores. */
 interface DatabaseStoreLocation {
-  /** Index that resolves a row by its key column. Defaults to `by_key`. */
-  index?: string;
-  /** Column storing the opaque key. Defaults to `key`. */
+  /** Column storing the opaque key. Defaults to `key`. Index it: every consume reads by it. */
   keyField?: string;
   /** Table holding one row per `(name, key)` pair. Defaults to `rateLimits`. */
   table?: string;
@@ -320,9 +335,10 @@ interface ReadOnlyDatabaseStoreOptions extends DatabaseStoreLocation {
   db: RateLimitDatabaseReader;
 }
 /**
- * Store backed by a Lunora table through `ctx.db`, for durable per-DO limits
- * inside a procedure (the procedure context exposes no raw SQL). Declare a
- * table with the key column and its index, e.g.
+ * Store backed by a Lunora table through `ctx.db`, for durable limits inside a
+ * procedure (the procedure context exposes no raw SQL). Works on a shard-local
+ * table and on a `.global()` one. Declare a table with the key column and its
+ * index, e.g.
  *
  * ```ts
  * rateLimits: defineTable({
@@ -333,15 +349,22 @@ interface ReadOnlyDatabaseStoreOptions extends DatabaseStoreLocation {
  * }).index("by_key", ["key"])
  * ```
  *
- * Each operation is a read-then-write; inside a mutation/action that pair runs
- * under the DO's input gate, so it is atomic against concurrent calls.
+ * **Atomic against concurrent consumes.** `setIf` writes only if the row still
+ * holds the value `get` returned: an existing row through `ctx.db.patchIf` with
+ * that value as its `where`, a new row through an `insert` under an id derived
+ * from the key, which a concurrent creator's insert collides with. A consume
+ * that loses either race gets `false` back and the limiter reads and decides
+ * again, so a limit of 1 admits one caller however many arrive together — on a
+ * `.global()` table too, where D1 calls do not hold the Durable Object's input
+ * gate.
  *
  * **Consumption commits with the procedure.** A mutation's `ctx.db` writes ride
  * its storage transaction, so a handler that throws after `limit()` rolls the
  * consumed unit back with everything else — inside a mutation this store counts
  * successful calls, not attempts. To charge every attempt (a login limiter),
  * consume from an action, where each write commits on its own, or return a
- * failure value from the mutation instead of throwing.
+ * failure value from the mutation instead of throwing. A `.global()` table's
+ * row lives in D1, outside the DO transaction, so there the unit stays spent.
  */
 declare const createDatabaseStore: (options: DatabaseStoreOptions) => RateLimitStore;
 /**
@@ -370,8 +393,8 @@ declare const createReadOnlyDatabaseStore: (options: ReadOnlyDatabaseStoreOption
  * on the DO the procedure runs on). Every query/mutation/action ctx exposes a
  * compatible `db`, so it slots straight into a `.use(...)` chain.
  *
- * Pass `options.store` to point at a non-default backing table/index/key column
- * (defaults: table `rateLimits`, index `by_key`, key column `key`); the rest of
+ * Pass `options.store` to point at a non-default backing table/key column
+ * (defaults: table `rateLimits`, key column `key`); the rest of
  * `options` (`key`, `count`, `failOpen`, `message`) is forwarded to
  * {@link rateLimit} unchanged. When `config` is precisely typed, `name`
  * autocompletes to its declared limit names.
@@ -496,4 +519,4 @@ interface TokenBudget {
  */
 declare const tokenBudget: <Names extends string>(limiter: RateLimiter<Names>, name: Names) => TokenBudget;
 declare const VERSION = "0.0.0";
-export { type DatabaseStoreOptions as DbStoreOptions, type EvaluateOptions, type EvaluateResult, type LimiterResolver, type RateLimitArgs, type RateLimitConfig, type RateLimitConfigMap, type RateLimitDatabase as RateLimitDb, type RateLimitDatabaseIndexRange as RateLimitDbIndexRange, type RateLimitDatabaseQuery as RateLimitDbQuery, type RateLimitDatabaseReader as RateLimitDbReader, RateLimitError, type RateLimitKind, type RateLimitMiddlewareOptions, type RateLimitReason, type RateLimitStatus, type RateLimitStore, type RateLimitValue, RateLimiter, type RateLimiterOptions, type RatelimitApiContext, type ReadOnlyDatabaseStoreOptions as ReadOnlyDbStoreOptions, type SqlLike, type SqlStoreOptions, type TokenBudget, VERSION, availableAt, createDatabaseStore as createDbStore, createMemoryStore, createReadOnlyDatabaseStore as createReadOnlyDbStore, createSqlStore, databaseRateLimit as dbRateLimit, evaluate, rateLimit, ratelimitPlugin, tokenBudget };
+export { type DatabaseStoreOptions as DbStoreOptions, type EvaluateOptions, type EvaluateResult, type LimiterResolver, type RateLimitArgs, type RateLimitConfig, type RateLimitConfigMap, type RateLimitDatabase as RateLimitDb, type RateLimitDatabaseReader as RateLimitDbReader, RateLimitError, type RateLimitKind, type RateLimitMiddlewareOptions, type RateLimitReason, type RateLimitStatus, type RateLimitStore, type RateLimitValue, RateLimiter, type RateLimiterOptions, type RatelimitApiContext, type ReadOnlyDatabaseStoreOptions as ReadOnlyDbStoreOptions, type SqlLike, type SqlStoreOptions, type TokenBudget, VERSION, availableAt, createDatabaseStore as createDbStore, createMemoryStore, createReadOnlyDatabaseStore as createReadOnlyDbStore, createSqlStore, databaseRateLimit as dbRateLimit, evaluate, rateLimit, ratelimitPlugin, tokenBudget };

package/dist/index.mjs

@@ -1 +1 @@
-import{availableAt as o,evaluate as a}from"./packem_shared/availableAt-BSKYrouo.mjs";import{default as i}from"./packem_shared/dbRateLimit-BuvEF1x0.mjs";import{default as l}from"./packem_shared/RateLimitError-9Y5OLxpl.mjs";import{rateLimit as x}from"./packem_shared/rateLimit-CWZur6XE.mjs";import{ratelimitPlugin as c}from"./packem_shared/ratelimitPlugin-CFnDs9rj.mjs";import{RateLimiter as u}from"./packem_shared/RateLimiter-Cbc67DNk.mjs";import{createDbStore as b,createMemoryStore as n,createReadOnlyDbStore as L,createSqlStore as s}from"./packem_shared/createDbStore-ve7GsO2i.mjs";import{tokenBudget as v}from"./packem_shared/tokenBudget-BRlWn1im.mjs";const e="0.0.0";export{l as RateLimitError,u as RateLimiter,e as VERSION,o as availableAt,b as createDbStore,n as createMemoryStore,L as createReadOnlyDbStore,s as createSqlStore,i as dbRateLimit,a as evaluate,x as rateLimit,c as ratelimitPlugin,v as tokenBudget};
+import{availableAt as o,evaluate as a}from"./packem_shared/availableAt-BSKYrouo.mjs";import{default as i}from"./packem_shared/dbRateLimit-B1Jf_kBi.mjs";import{default as l}from"./packem_shared/RateLimitError-9Y5OLxpl.mjs";import{rateLimit as x}from"./packem_shared/rateLimit-CWZur6XE.mjs";import{ratelimitPlugin as c}from"./packem_shared/ratelimitPlugin-CFnDs9rj.mjs";import{RateLimiter as u}from"./packem_shared/RateLimiter-Cr80iRjQ.mjs";import{createDbStore as b,createMemoryStore as n,createReadOnlyDbStore as L,createSqlStore as s}from"./packem_shared/createDbStore-k6ol27eT.mjs";import{tokenBudget as v}from"./packem_shared/tokenBudget-BRlWn1im.mjs";const e="0.0.0";export{l as RateLimitError,u as RateLimiter,e as VERSION,o as availableAt,b as createDbStore,n as createMemoryStore,L as createReadOnlyDbStore,s as createSqlStore,i as dbRateLimit,a as evaluate,x as rateLimit,c as ratelimitPlugin,v as tokenBudget};

package/dist/packem_shared/RateLimiter-Cr80iRjQ.mjs

@@ -0,0 +1 @@
+import{LunoraError as h}from"@lunora/errors";import{availableAt as w,evaluate as p}from"./availableAt-BSKYrouo.mjs";import m from"./RateLimitError-9Y5OLxpl.mjs";import{createMemoryStore as y}from"./createDbStore-k6ol27eT.mjs";const v=/^[\d.:a-f]+$/iu,d=i=>{const t=i.indexOf("%"),e=t===-1?i:i.slice(0,t);if(!e.includes(":")||!v.test(e))return i;let r;try{r=new URL(`http://[${e}]/`).hostname.slice(1,-1)}catch{return i}const[c="",o]=r.split("::"),s=c===""?[]:c.split(":"),l=o===void 0||o===""?[]:o.split(":"),n=[...s,...Array.from({length:8-s.length-l.length},()=>"0"),...l].map(a=>Number.parseInt(a,16));if(n.slice(0,5).every(a=>a===0)&&n[5]===65535){const[a=0,f=0]=n.slice(6);return[a>>8,a&255,f>>8,f&255].join(".")}return`${n.slice(0,4).map(a=>a.toString(16)).join(":")}::/64`},u=(i,t)=>t===void 0?encodeURIComponent(i):`${encodeURIComponent(i)}:${encodeURIComponent(t)}`,b=16,N=i=>typeof i?.then=="function",g=i=>i?t=>d(i(t)):d,I="@lunora/ratelimit: new RateLimiter() was built with no explicit `store`, so it falls back to `createMemoryStore()` — an in-process Map. That Map is durable and correctly shared only for calls that land on the same Durable Object instance; it is NOT shared across `.shardBy(...)` shards or `.global()` replicas, and it resets when the DO instance is evicted/restarted. For a limit that must hold across any of those, pass a durable `store` (`createDbStore` or `createSqlStore`) instead. Pass `store: createMemoryStore()` explicitly once you've confirmed the in-memory default is correct here, to silence this warning.";class E{config;denyList;normalize;now;store;constructor(t){this.config=t.config,this.normalize=g(t.normalize),this.denyList=new Set([...t.denyList??[]].flatMap(e=>[e,this.normalize(e)])),this.now=t.now??Date.now,t.store===void 0&&console.warn(I),this.store=t.store??y();for(const[e,r]of Object.entries(this.config)){if(Object.hasOwn(r,"shards"))throw new h("INTERNAL",`rate limit "${e}": \`shards\` is no longer supported — remove it; the limit now enforces its full \`rate\` (lower \`rate\` if you raised it to offset the split)`);if(!Number.isFinite(r.period)||r.period<=0)throw new h("INTERNAL",`rate limit "${e}": period must be a positive number`);if(!Number.isFinite(r.rate)||r.rate<=0)throw new h("INTERNAL",`rate limit "${e}": rate must be a positive number`);if(r.capacity!==void 0&&(!Number.isFinite(r.capacity)||r.capacity<0))throw new h("INTERNAL",`rate limit "${e}": capacity must be a non-negative number`)}}async check(t,e={}){return this.run(t,e,!1)}async getValue(t,e={}){const r=this.resolve(t),c=this.now(),o=u(t,this.normalizeKey(e.key)),s=w(r,await this.store.get(o),c);return{config:r,ts:s.ts,value:s.value}}async limit(t,e={}){return this.run(t,e,!0)}async reset(t,e={}){this.resolve(t),await Promise.resolve(this.store.delete(u(t,this.normalizeKey(e.key))))}async decide(t,e,r){for(let c=0;c<b;c+=1){const o=this.store.get(e),s=N(o)?await o:o,{status:l,value:n}=p(t,s,{...r,now:this.now()});if(n===void 0)return l;if(this.store.setIf===void 0)return await this.store.set(e,n),l;if(await this.store.setIf(e,n,s))return l}return{ok:!1,reason:"rate",retryAfter:0}}normalizeKey(t){return t===void 0?void 0:this.normalize(t)}resolve(t){const e=this.config[t];if(!e)throw new h("INTERNAL",`rate limit "${t}" is not configured`);return e}async run(t,e,r){const c=this.resolve(t),o=this.normalizeKey(e.key);if(o!==void 0&&(this.denyList.has(o)||this.denyList.has(e.key))){const a={ok:!1,reason:"deny",retryAfter:Number.POSITIVE_INFINITY};if(e.throws)throw new m(a);return a}const s=e.count??1;if(!Number.isInteger(s)||s<=0)throw new h("INTERNAL",`rate limit "${t}": count must be a positive integer`);const l=u(t,o),n=await this.decide(c,l,{consume:r,count:s,reserve:e.reserve??!1});if(!n.ok&&e.throws)throw new m(n);return n}}export{E as RateLimiter};

package/dist/packem_shared/createDbStore-k6ol27eT.mjs

@@ -0,0 +1 @@
+import{LunoraError as E}from"@lunora/errors";const m=()=>{const n=new Map;return{delete:t=>{n.delete(t)},get:t=>n.get(t),set:(t,c)=>{n.set(t,c)}}},u=(n,t,...c)=>n.exec.call(n,t,...c).toArray(),L=n=>{const{sql:t}=n,c=n.table??"_lunora_rate_limits";return u(t,`CREATE TABLE IF NOT EXISTS "${c}" (k TEXT PRIMARY KEY, value REAL NOT NULL, ts INTEGER NOT NULL, prev REAL)`),{delete:s=>{u(t,`DELETE FROM "${c}" WHERE k = ?`,s)},get:s=>{const l=u(t,`SELECT value, ts, prev FROM "${c}" WHERE k = ?`,s)[0];if(!l)return;const d={ts:l.ts,value:l.value};return l.prev!==null&&(d.prev=l.prev),d},set:(s,a)=>{u(t,`INSERT INTO "${c}" (k, value, ts, prev) VALUES (?, ?, ?, ?) ON CONFLICT(k) DO UPDATE SET value = excluded.value, ts = excluded.ts, prev = excluded.prev`,s,a.value,a.ts,a.prev??null)}}},b=n=>n.toString(16).padStart(2,"0"),S=async(n,t)=>{const s=[...new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(`${n}\0${t}`))).subarray(0,16)];s[6]=128+s[6]%16,s[8]=128+s[8]%64;const a=s.map(l=>b(l)).join("");return`${a.slice(0,8)}-${a.slice(8,12)}-${a.slice(12,16)}-${a.slice(16,20)}-${a.slice(20)}`},T=n=>n?.code==="CONFLICT",h=n=>{const{db:t}=n,c=n.table??"rateLimits",s=n.keyField??"key",a=new Map,l=async e=>{const r=await t.findFirst(c,{where:{[s]:e}});return a.set(e,r?r._id:void 0),r},d=async e=>(a.has(e)||await l(e),a.get(e)),v=(e,r)=>{const i={[s]:e,ts:r.ts,value:r.value};return r.prev!==void 0&&(i.prev=r.prev),i},w=async(e,r)=>{try{return a.set(e,await t.insert(c,r,{clientId:await S(c,e)})),!0}catch(i){if(T(i))return a.delete(e),!1;throw i}};return{delete:async e=>{const r=await d(e);r!==void 0&&await t.delete(r),a.delete(e)},get:async e=>{const r=await l(e);if(!r)return;const i={ts:r.ts,value:r.value};return r.prev!==null&&r.prev!==void 0&&(i.prev=r.prev),i},set:async(e,r)=>{const i=v(e,r);let o=await d(e);if(o===void 0){if(await w(e,i))return;await l(e),o=a.get(e)}o!==void 0&&await t.patchIf(c,o,{patch:i,where:{}})},setIf:async(e,r,i)=>{const o=v(e,r);if(i===void 0)return w(e,o);const f=await d(e);if(f===void 0)return!1;const{applied:p}=await t.patchIf(c,f,{patch:o,where:{prev:i.prev??null,ts:i.ts,value:i.value}});return p||a.delete(e),p}}},R=n=>{const t=s=>{throw new E("INTERNAL",`@lunora/ratelimit: \`${s}\` needs a writable \`ctx.db\`, but this store was created with \`createReadOnlyDbStore\` (a query context). Use \`createDbStore\` from a mutation or action; a query can only call \`getValue\`/\`check\`.`)},c=h({...n,db:{delete:()=>t("delete"),findFirst:n.db.findFirst.bind(n.db),insert:()=>t("insert"),patchIf:()=>t("patchIf")}});return{delete:()=>t("reset"),get:c.get,set:()=>t("limit"),setIf:()=>t("limit")}};export{h as createDbStore,m as createMemoryStore,R as createReadOnlyDbStore,L as createSqlStore};

package/dist/packem_shared/{dbRateLimit-BuvEF1x0.mjs → dbRateLimit-B1Jf_kBi.mjs}

@@ -1 +1 @@
-import{rateLimit as o}from"./rateLimit-CWZur6XE.mjs";import{RateLimiter as m}from"./RateLimiter-Cbc67DNk.mjs";import{createDbStore as i}from"./createDbStore-ve7GsO2i.mjs";const f=(e,r,t={})=>o(a=>new m({config:e,store:i({db:a.db,...t.store})}),r,t);export{f as default};
+import{rateLimit as o}from"./rateLimit-CWZur6XE.mjs";import{RateLimiter as m}from"./RateLimiter-Cr80iRjQ.mjs";import{createDbStore as i}from"./createDbStore-k6ol27eT.mjs";const f=(e,r,t={})=>o(a=>new m({config:e,store:i({db:a.db,...t.store})}),r,t);export{f as default};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/ratelimit",
-  "version": "1.0.0-alpha.123",
+  "version": "1.0.0-alpha.125",
   "description": "Rate limiting: token-bucket / fixed-window / sliding-window algorithms, deny list, pluggable stores, and procedure middleware",
   "keywords": [
     "cloudflare",

package/dist/packem_shared/RateLimiter-Cbc67DNk.mjs

@@ -1 +0,0 @@
-import{LunoraError as l}from"@lunora/errors";import{availableAt as p,evaluate as y}from"./availableAt-BSKYrouo.mjs";import f from"./RateLimitError-9Y5OLxpl.mjs";import{createMemoryStore as v}from"./createDbStore-ve7GsO2i.mjs";const b=/^[\d.:a-f]+$/iu,w=i=>{const t=i.indexOf("%"),e=t===-1?i:i.slice(0,t);if(!e.includes(":")||!b.test(e))return i;let r;try{r=new URL(`http://[${e}]/`).hostname.slice(1,-1)}catch{return i}const[a="",s]=r.split("::"),n=a===""?[]:a.split(":"),h=s===void 0||s===""?[]:s.split(":"),c=[...n,...Array.from({length:8-n.length-h.length},()=>"0"),...h].map(o=>Number.parseInt(o,16));if(c.slice(0,5).every(o=>o===0)&&c[5]===65535){const[o=0,m=0]=c.slice(6);return[o>>8,o&255,m>>8,m&255].join(".")}return`${c.slice(0,4).map(o=>o.toString(16)).join(":")}::/64`},u=(i,t)=>t===void 0?encodeURIComponent(i):`${encodeURIComponent(i)}:${encodeURIComponent(t)}`,g=i=>i?t=>w(i(t)):w,N="@lunora/ratelimit: new RateLimiter() was built with no explicit `store`, so it falls back to `createMemoryStore()` — an in-process Map. That Map is durable and correctly shared only for calls that land on the same Durable Object instance; it is NOT shared across `.shardBy(...)` shards or `.global()` replicas, and it resets when the DO instance is evicted/restarted. For a limit that must hold across any of those, pass a durable `store` (`createDbStore` or `createSqlStore`) instead. Pass `store: createMemoryStore()` explicitly once you've confirmed the in-memory default is correct here, to silence this warning.";class S{config;denyList;normalize;now;store;constructor(t){this.config=t.config,this.normalize=g(t.normalize),this.denyList=new Set([...t.denyList??[]].flatMap(e=>[e,this.normalize(e)])),this.now=t.now??Date.now,t.store===void 0&&console.warn(N),this.store=t.store??v();for(const[e,r]of Object.entries(this.config)){if(Object.hasOwn(r,"shards"))throw new l("INTERNAL",`rate limit "${e}": \`shards\` is no longer supported — remove it; the limit now enforces its full \`rate\` (lower \`rate\` if you raised it to offset the split)`);if(!Number.isFinite(r.period)||r.period<=0)throw new l("INTERNAL",`rate limit "${e}": period must be a positive number`);if(!Number.isFinite(r.rate)||r.rate<=0)throw new l("INTERNAL",`rate limit "${e}": rate must be a positive number`);if(r.capacity!==void 0&&(!Number.isFinite(r.capacity)||r.capacity<0))throw new l("INTERNAL",`rate limit "${e}": capacity must be a non-negative number`)}}async check(t,e={}){return this.run(t,e,!1)}async getValue(t,e={}){const r=this.resolve(t),a=this.now(),s=u(t,this.normalizeKey(e.key)),n=p(r,await this.store.get(s),a);return{config:r,ts:n.ts,value:n.value}}async limit(t,e={}){return this.run(t,e,!0)}async reset(t,e={}){this.resolve(t),await Promise.resolve(this.store.delete(u(t,this.normalizeKey(e.key))))}normalizeKey(t){return t===void 0?void 0:this.normalize(t)}resolve(t){const e=this.config[t];if(!e)throw new l("INTERNAL",`rate limit "${t}" is not configured`);return e}async run(t,e,r){const a=this.resolve(t),s=this.normalizeKey(e.key);if(s!==void 0&&(this.denyList.has(s)||this.denyList.has(e.key))){const d={ok:!1,reason:"deny",retryAfter:Number.POSITIVE_INFINITY};if(e.throws)throw new f(d);return d}const n=e.count??1;if(!Number.isInteger(n)||n<=0)throw new l("INTERNAL",`rate limit "${t}": count must be a positive integer`);const h=u(t,s),c=await this.store.get(h),{status:o,value:m}=y(a,c,{consume:r,count:n,now:this.now(),reserve:e.reserve??!1});if(m!==void 0&&await this.store.set(h,m),!o.ok&&e.throws)throw new f(o);return o}}export{S as RateLimiter};

package/dist/packem_shared/createDbStore-ve7GsO2i.mjs

@@ -1 +0,0 @@
-import{LunoraError as E}from"@lunora/errors";const p=()=>{const t=new Map;return{delete:e=>{t.delete(e)},get:e=>t.get(e),set:(e,n)=>{t.set(e,n)}}},i=(t,e,...n)=>t.exec.call(t,e,...n).toArray(),T=t=>{const{sql:e}=t,n=t.table??"_lunora_rate_limits";return i(e,`CREATE TABLE IF NOT EXISTS "${n}" (k TEXT PRIMARY KEY, value REAL NOT NULL, ts INTEGER NOT NULL, prev REAL)`),{delete:s=>{i(e,`DELETE FROM "${n}" WHERE k = ?`,s)},get:s=>{const c=i(e,`SELECT value, ts, prev FROM "${n}" WHERE k = ?`,s)[0];if(!c)return;const d={ts:c.ts,value:c.value};return c.prev!==null&&(d.prev=c.prev),d},set:(s,l)=>{i(e,`INSERT INTO "${n}" (k, value, ts, prev) VALUES (?, ?, ?, ?) ON CONFLICT(k) DO UPDATE SET value = excluded.value, ts = excluded.ts, prev = excluded.prev`,s,l.value,l.ts,l.prev??null)}}},w=t=>{const{db:e}=t,n=t.table??"rateLimits",s=t.index??"by_key",l=t.keyField??"key",c=new Map,d=async a=>{const r=await e.query(n).withIndex(s,o=>o.eq(l,a)).first();return c.set(a,r?r._id:void 0),r},v=async a=>(c.has(a)||await d(a),c.get(a));return{delete:async a=>{const r=await v(a);r!==void 0&&await e.delete(r),c.delete(a)},get:async a=>{const r=await d(a);if(!r)return;const o={ts:r.ts,value:r.value};return r.prev!==null&&r.prev!==void 0&&(o.prev=r.prev),o},set:async(a,r)=>{const o=await v(a),u={[l]:a,ts:r.ts,value:r.value};r.prev!==void 0&&(u.prev=r.prev),o===void 0?c.set(a,await e.insert(n,u)):await e.patch(o,u)}}},S=t=>{const e=s=>{throw new E("INTERNAL",`@lunora/ratelimit: \`${s}\` needs a writable \`ctx.db\`, but this store was created with \`createReadOnlyDbStore\` (a query context). Use \`createDbStore\` from a mutation or action; a query can only call \`getValue\`/\`check\`.`)},n=w({...t,db:{delete:()=>e("delete"),insert:()=>e("insert"),patch:()=>e("patch"),query:t.db.query.bind(t.db)}});return{delete:()=>e("reset"),get:n.get,set:()=>e("limit")}};export{w as createDbStore,p as createMemoryStore,S as createReadOnlyDbStore,T as createSqlStore};