@superfunctions/middleware 0.1.0 → 0.3.0

package/dist/rate-limit.d.ts

@@ -1,4 +1,5 @@
-import type { Adapter, KVStoreAdapter } from '@superfunctions/db';
+import { type Adapter, type AtomicKVStoreAdapter, type KVStoreAdapter } from '@superfunctions/db';
+import { type ObservabilityInput } from '@superfunctions/observability';
 export { KVStoreAdapter };
 export type LegacyWindowAlgorithm = 'sliding-window' | 'fixed-window';
 export type RateLimitAlgorithm = LegacyWindowAlgorithm | 'token-bucket';
@@ -7,8 +8,11 @@ export interface RateLimitConfig {
     maxRequests: number;
     keyPrefix?: string;
     persistence?: Adapter | KVStoreAdapter;
+    atomicStore?: AtomicKVStoreAdapter;
     algorithm?: RateLimitAlgorithm;
     now?: () => number;
+    observability?: ObservabilityInput;
+    component?: string;
 }
 export interface RateLimitResult {
     allowed: boolean;
@@ -21,8 +25,24 @@ export interface CheckLimitInput {
     windowSeconds?: number;
     limit?: number;
 }
+export interface CheckManyLimitsInput {
+    keys: string[];
+    /** Override the shared limit for each unprefixed key. */
+    limitsByKey?: Record<string, number>;
+    windowSeconds?: number;
+    limit?: number;
+}
+export interface RateLimitManyResult {
+    allowed: boolean;
+    blockedKeys?: string[];
+    remainingByKey: Map<string, number>;
+    resetAtByKey: Map<string, string>;
+    resetAt: string;
+    total: number;
+}
 export interface RateLimiter {
     check(input: CheckLimitInput): Promise<RateLimitResult>;
+    checkMany(input: CheckManyLimitsInput): Promise<RateLimitManyResult>;
     reset(key: string): Promise<void>;
 }
 declare function createInMemoryKVStore(now?: () => number): KVStoreAdapter;

package/dist/rate-limit.js

@@ -1,3 +1,5 @@
+import { instrumentKVStore } from '@superfunctions/db';
+import { normalizeObservability } from '@superfunctions/observability';
 function createInMemoryKVStore(now = Date.now) {
     const store = new Map();
     return {
@@ -59,8 +61,7 @@ function ensureKV(p, now) {
     }
     return p;
 }
-async function getState(kv, key) {
-    const data = await kv.get(key);
+function parseState(data) {
     if (!data)
         return null;
     try {
@@ -70,20 +71,25 @@ async function getState(kv, key) {
         return null;
     }
 }
-async function setState(kv, key, state, ttlMs) {
-    if (ttlMs <= 0) {
-        return;
-    }
-    await kv.set({
-        key,
-        value: JSON.stringify(state),
-        ttlSeconds: Math.ceil(ttlMs / 1000),
-    });
-}
 export function createRateLimiter(config) {
     const now = config.now ?? Date.now;
-    const { windowMs, maxRequests, keyPrefix = 'ratelimit:', persistence = createInMemoryKVStore(now), algorithm = 'fixed-window', } = config;
-    const kv = ensureKV(persistence, now);
+    const { windowMs, maxRequests, keyPrefix = 'ratelimit:', persistence = createInMemoryKVStore(now), atomicStore, algorithm = 'fixed-window', observability: observabilityInput, component = 'rate-limit', } = config;
+    const observability = normalizeObservability(observabilityInput)?.child({ component });
+    if (atomicStore && typeof atomicStore.compareAndSet !== 'function') {
+        throw new Error('RATE_LIMIT_ATOMIC_CAS_REQUIRED');
+    }
+    const atomic = atomicStore
+        ? instrumentKVStore(atomicStore, {
+            observability,
+            kind: 'cache',
+            component: `${component}.atomic`,
+        })
+        : undefined;
+    const kv = instrumentKVStore(ensureKV(persistence, now), {
+        observability,
+        kind: 'cache',
+        component: `${component}.cache`,
+    });
     const keyLocks = new Map();
     async function withKeyLock(key, work) {
         const prior = keyLocks.get(key) ?? Promise.resolve();
@@ -104,89 +110,236 @@ export function createRateLimiter(config) {
             }
         }
     }
+    async function withKeyLocks(keys, work) {
+        const uniqueKeys = [...new Set(keys)].sort();
+        const releases = [];
+        const queuedLocks = [];
+        try {
+            for (const key of uniqueKeys) {
+                const prior = keyLocks.get(key) ?? Promise.resolve();
+                let resolveLock;
+                const current = new Promise((resolve) => {
+                    resolveLock = resolve;
+                });
+                const queued = prior.then(() => current);
+                keyLocks.set(key, queued);
+                queuedLocks.push({ key, queued });
+                releases.push(resolveLock);
+                await prior;
+            }
+            return await work();
+        }
+        finally {
+            for (let index = releases.length - 1; index >= 0; index -= 1) {
+                releases[index]();
+            }
+            for (const { key, queued } of queuedLocks) {
+                if (keyLocks.get(key) === queued) {
+                    keyLocks.delete(key);
+                }
+            }
+        }
+    }
+    function evaluateState(rawState, currentTime, effectiveWindowMs, effectiveLimit, commit) {
+        if (!Number.isFinite(effectiveWindowMs) || effectiveWindowMs <= 0) {
+            throw new Error('RATE_LIMIT_WINDOW_INVALID');
+        }
+        if (!Number.isFinite(effectiveLimit) || effectiveLimit < 0) {
+            throw new Error('RATE_LIMIT_LIMIT_INVALID');
+        }
+        if (algorithm === 'sliding-window') {
+            const state = parseState(rawState) ?? { timestamps: [] };
+            const floor = currentTime - effectiveWindowMs;
+            const timestamps = state.timestamps.filter((timestamp) => timestamp > floor);
+            const allowed = timestamps.length < effectiveLimit;
+            if (allowed && commit) {
+                timestamps.push(currentTime);
+            }
+            const oldest = timestamps[0] ?? currentTime;
+            const resetAt = oldest + effectiveWindowMs;
+            return {
+                result: {
+                    allowed,
+                    remaining: Math.max(0, effectiveLimit - timestamps.length),
+                    resetAt: new Date(resetAt).toISOString(),
+                    total: effectiveLimit,
+                },
+                ...(commit
+                    ? {
+                        nextState: { timestamps, expiresAt: resetAt },
+                        ttlMs: Math.max(1, resetAt - currentTime),
+                    }
+                    : {}),
+            };
+        }
+        if (algorithm === 'token-bucket') {
+            if (effectiveLimit <= 0) {
+                const resetAt = currentTime + Math.max(0, effectiveWindowMs);
+                return {
+                    result: {
+                        allowed: false,
+                        remaining: 0,
+                        resetAt: new Date(resetAt).toISOString(),
+                        total: effectiveLimit,
+                    },
+                };
+            }
+            const refillRatePerMs = effectiveLimit / effectiveWindowMs;
+            const state = parseState(rawState) ?? {
+                tokens: effectiveLimit,
+                lastRefill: currentTime,
+            };
+            const elapsed = Math.max(0, currentTime - state.lastRefill);
+            const tokens = Math.min(effectiveLimit, state.tokens + elapsed * refillRatePerMs);
+            const allowed = tokens >= 1;
+            const nextTokens = allowed && commit ? tokens - 1 : tokens;
+            const msUntilNextToken = nextTokens >= 1 ? 0 : Math.ceil((1 - nextTokens) / refillRatePerMs);
+            const msUntilFull = Math.ceil((effectiveLimit - nextTokens) / refillRatePerMs);
+            const resetAt = currentTime + msUntilNextToken;
+            return {
+                result: {
+                    allowed,
+                    remaining: Math.max(0, Math.floor(nextTokens)),
+                    resetAt: new Date(resetAt).toISOString(),
+                    total: effectiveLimit,
+                },
+                ...(commit
+                    ? {
+                        nextState: {
+                            tokens: nextTokens,
+                            lastRefill: currentTime,
+                            expiresAt: currentTime + Math.max(1, msUntilFull),
+                        },
+                        ttlMs: Math.max(1, msUntilFull),
+                    }
+                    : {}),
+            };
+        }
+        const state = parseState(rawState) ?? {
+            count: 0,
+            windowStart: currentTime,
+        };
+        const windowState = currentTime >= state.windowStart + effectiveWindowMs
+            ? { count: 0, windowStart: currentTime }
+            : { ...state };
+        const allowed = windowState.count < effectiveLimit;
+        if (allowed && commit) {
+            windowState.count += 1;
+        }
+        const resetAt = windowState.windowStart + effectiveWindowMs;
+        return {
+            result: {
+                allowed,
+                remaining: Math.max(0, effectiveLimit - windowState.count),
+                resetAt: new Date(resetAt).toISOString(),
+                total: effectiveLimit,
+            },
+            ...(commit
+                ? {
+                    nextState: { ...windowState, expiresAt: resetAt },
+                    ttlMs: Math.max(1, resetAt - currentTime),
+                }
+                : {}),
+        };
+    }
+    async function evaluateKey(key, currentTime, effectiveWindowMs, effectiveLimit, commit) {
+        const evaluation = evaluateState(await kv.get(key), currentTime, effectiveWindowMs, effectiveLimit, commit);
+        if (commit && evaluation.nextState !== undefined && evaluation.ttlMs !== undefined) {
+            await kv.set({
+                key,
+                value: JSON.stringify(evaluation.nextState),
+                ttlSeconds: Math.ceil(evaluation.ttlMs / 1000),
+            });
+        }
+        return evaluation.result;
+    }
+    async function evaluateAtomicKey(key, currentTime, effectiveWindowMs, effectiveLimit, commit) {
+        if (!atomic?.compareAndSet) {
+            throw new Error('RATE_LIMIT_ATOMIC_CAS_REQUIRED');
+        }
+        for (let attempt = 0; attempt < 16; attempt += 1) {
+            const expected = await atomic.get(key);
+            const evaluation = evaluateState(expected, currentTime, effectiveWindowMs, effectiveLimit, commit);
+            if (!commit || evaluation.nextState === undefined || evaluation.ttlMs === undefined) {
+                return evaluation.result;
+            }
+            const result = await atomic.compareAndSet({
+                key,
+                expected,
+                value: JSON.stringify(evaluation.nextState),
+                ttlSeconds: Math.ceil(evaluation.ttlMs / 1000),
+            });
+            if (result.updated) {
+                return evaluation.result;
+            }
+        }
+        throw new Error('RATE_LIMIT_ATOMIC_CONTENTION');
+    }
+    const evaluateConfiguredKey = atomic ? evaluateAtomicKey : evaluateKey;
     return {
         async check(input) {
             const key = `${keyPrefix}${input.key}`;
             return withKeyLock(key, async () => {
                 const effectiveWindowMs = (input.windowSeconds !== undefined ? input.windowSeconds * 1000 : undefined) ?? windowMs;
                 const effectiveLimit = input.limit ?? maxRequests;
+                return evaluateConfiguredKey(key, now(), effectiveWindowMs, effectiveLimit, true);
+            });
+        },
+        async checkMany(input) {
+            const uniqueKeys = [...new Set(input.keys)];
+            const effectiveWindowMs = (input.windowSeconds !== undefined ? input.windowSeconds * 1000 : undefined) ?? windowMs;
+            const effectiveLimit = input.limit ?? maxRequests;
+            const limits = uniqueKeys.map((key) => input.limitsByKey && Object.prototype.hasOwnProperty.call(input.limitsByKey, key) ? input.limitsByKey[key] ?? effectiveLimit : effectiveLimit);
+            const namespacedKeys = uniqueKeys.map((key) => `${keyPrefix}${key}`);
+            if (uniqueKeys.length === 0) {
+                return {
+                    allowed: true,
+                    remainingByKey: new Map(),
+                    resetAtByKey: new Map(),
+                    resetAt: new Date(now()).toISOString(),
+                    total: effectiveLimit,
+                };
+            }
+            return withKeyLocks(namespacedKeys, async () => {
                 const currentTime = now();
-                if (!Number.isFinite(effectiveWindowMs) || effectiveWindowMs <= 0) {
-                    throw new Error('RATE_LIMIT_WINDOW_INVALID');
-                }
-                if (!Number.isFinite(effectiveLimit) || effectiveLimit < 0) {
-                    throw new Error('RATE_LIMIT_LIMIT_INVALID');
-                }
-                if (algorithm === 'sliding-window') {
-                    const state = (await getState(kv, key)) ?? { timestamps: [] };
-                    const floor = currentTime - effectiveWindowMs;
-                    state.timestamps = state.timestamps.filter((timestamp) => timestamp > floor);
-                    const allowed = state.timestamps.length < effectiveLimit;
-                    if (allowed) {
-                        state.timestamps.push(currentTime);
-                    }
-                    const oldest = state.timestamps[0] ?? currentTime;
-                    const resetAt = oldest + effectiveWindowMs;
-                    const ttlMs = Math.max(1, resetAt - currentTime);
-                    await setState(kv, key, state, ttlMs);
+                const preflight = await Promise.all(namespacedKeys.map((key, index) => evaluateConfiguredKey(key, currentTime, effectiveWindowMs, limits[index], false)));
+                const blocked = preflight.filter((result) => !result.allowed);
+                if (blocked.length > 0) {
                     return {
-                        allowed,
-                        remaining: Math.max(0, effectiveLimit - state.timestamps.length),
-                        resetAt: new Date(resetAt).toISOString(),
+                        allowed: false,
+                        blockedKeys: uniqueKeys.filter((_key, index) => !preflight[index].allowed),
+                        remainingByKey: new Map(uniqueKeys.map((key, index) => [key, preflight[index].remaining])),
+                        resetAtByKey: new Map(uniqueKeys.map((key, index) => [key, preflight[index].resetAt])),
+                        resetAt: new Date(Math.max(...blocked.map((result) => Date.parse(result.resetAt)))).toISOString(),
                         total: effectiveLimit,
                     };
                 }
-                if (algorithm === 'token-bucket') {
-                    if (effectiveLimit <= 0) {
-                        const resetAt = currentTime + Math.max(0, effectiveWindowMs);
+                const committed = [];
+                for (let index = 0; index < namespacedKeys.length; index += 1) {
+                    const key = namespacedKeys[index];
+                    // Commit each key through the configured store. If a later commit
+                    // becomes blocked or fails, retain earlier quota charges (fail
+                    // closed) instead of restoring stale snapshots over concurrent work.
+                    const result = await evaluateConfiguredKey(key, currentTime, effectiveWindowMs, limits[index], true);
+                    committed.push(result);
+                    if (!result.allowed) {
+                        const actual = preflight.map((entry, entryIndex) => committed[entryIndex] ?? entry);
+                        const blockedActual = actual.filter((entry) => !entry.allowed);
                         return {
                             allowed: false,
-                            remaining: 0,
-                            resetAt: new Date(resetAt).toISOString(),
+                            blockedKeys: uniqueKeys.filter((_key, index) => !actual[index].allowed),
+                            remainingByKey: new Map(uniqueKeys.map((entry, entryIndex) => [entry, actual[entryIndex].remaining])),
+                            resetAtByKey: new Map(uniqueKeys.map((entry, entryIndex) => [entry, actual[entryIndex].resetAt])),
+                            resetAt: new Date(Math.max(...blockedActual.map((entry) => Date.parse(entry.resetAt)))).toISOString(),
                             total: effectiveLimit,
                         };
                     }
-                    const refillRatePerMs = effectiveLimit / effectiveWindowMs;
-                    const state = (await getState(kv, key)) ?? {
-                        tokens: effectiveLimit,
-                        lastRefill: currentTime,
-                    };
-                    const elapsed = Math.max(0, currentTime - state.lastRefill);
-                    state.tokens = Math.min(effectiveLimit, state.tokens + elapsed * refillRatePerMs);
-                    state.lastRefill = currentTime;
-                    const allowed = state.tokens >= 1;
-                    if (allowed) {
-                        state.tokens -= 1;
-                    }
-                    const msUntilNextToken = state.tokens >= 1 ? 0 : Math.ceil((1 - state.tokens) / refillRatePerMs);
-                    const msUntilFull = Math.ceil((effectiveLimit - state.tokens) / refillRatePerMs);
-                    const resetAt = currentTime + msUntilNextToken;
-                    await setState(kv, key, state, Math.max(1, msUntilFull));
-                    return {
-                        allowed,
-                        remaining: Math.max(0, Math.floor(state.tokens)),
-                        resetAt: new Date(resetAt).toISOString(),
-                        total: effectiveLimit,
-                    };
-                }
-                const state = (await getState(kv, key)) ?? {
-                    count: 0,
-                    windowStart: currentTime,
-                };
-                if (currentTime >= state.windowStart + effectiveWindowMs) {
-                    state.count = 0;
-                    state.windowStart = currentTime;
-                }
-                const allowed = state.count < effectiveLimit;
-                if (allowed) {
-                    state.count += 1;
                 }
-                const resetAt = state.windowStart + effectiveWindowMs;
-                await setState(kv, key, state, Math.max(1, resetAt - currentTime));
                 return {
-                    allowed,
-                    remaining: Math.max(0, effectiveLimit - state.count),
-                    resetAt: new Date(resetAt).toISOString(),
+                    allowed: true,
+                    remainingByKey: new Map(uniqueKeys.map((key, index) => [key, committed[index].remaining])),
+                    resetAtByKey: new Map(uniqueKeys.map((key, index) => [key, committed[index].resetAt])),
+                    resetAt: new Date(Math.min(...committed.map((result) => Date.parse(result.resetAt)))).toISOString(),
                     total: effectiveLimit,
                 };
             });
@@ -194,7 +347,7 @@ export function createRateLimiter(config) {
         async reset(key) {
             const namespacedKey = `${keyPrefix}${key}`;
             await withKeyLock(namespacedKey, async () => {
-                await kv.delete(namespacedKey);
+                await (atomic ?? kv).delete(namespacedKey);
             });
         },
     };

package/dist/rate-limit.test.js

@@ -1,4 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { createObservability, readObservationGroup } from '@superfunctions/observability';
+import { createMemoryAtomicKVStore } from '@superfunctions/db/adapters';
 import { createRateLimiter, createInMemoryKVStore } from './rate-limit.js';
 describe('rate-limit', () => {
     beforeEach(() => {
@@ -109,6 +111,106 @@ describe('rate-limit', () => {
             expect((await limiter.check({ key: 'user2' })).allowed).toBe(true);
             expect((await limiter.check({ key: 'user1' })).allowed).toBe(false);
         });
+        it('checks multiple keys without consuming partial capacity when one key is blocked', async () => {
+            const limiter = createRateLimiter({
+                windowMs: 60000,
+                maxRequests: 1,
+                algorithm: 'token-bucket',
+            });
+            expect((await limiter.check({ key: 'provider' })).allowed).toBe(true);
+            const multi = await limiter.checkMany({ keys: ['provider', 'tenant'] });
+            expect(multi.allowed).toBe(false);
+            expect(multi.remainingByKey.get('provider')).toBe(0);
+            expect(multi.remainingByKey.get('tenant')).toBe(1);
+            expect((await limiter.check({ key: 'tenant' })).allowed).toBe(true);
+        });
+        it('uses the latest blocked reset time for multi-key denials', async () => {
+            vi.useFakeTimers();
+            vi.setSystemTime(new Date('2026-03-12T00:00:00.000Z'));
+            const limiter = createRateLimiter({
+                windowMs: 1000,
+                maxRequests: 1,
+                algorithm: 'token-bucket',
+            });
+            await limiter.check({ key: 'provider' });
+            vi.setSystemTime(new Date('2026-03-12T00:00:00.500Z'));
+            await limiter.check({ key: 'tenant' });
+            vi.setSystemTime(new Date('2026-03-12T00:00:00.600Z'));
+            const multi = await limiter.checkMany({ keys: ['provider', 'tenant'] });
+            expect(multi.allowed).toBe(false);
+            expect(multi.resetAt).toBe('2026-03-12T00:00:01.500Z');
+            expect(multi.resetAtByKey.get('provider')).toBe('2026-03-12T00:00:01.000Z');
+            expect(multi.resetAtByKey.get('tenant')).toBe('2026-03-12T00:00:01.500Z');
+        });
+        it('fails closed without overwriting concurrent quota when a later write fails', async () => {
+            const internalStore = new Map();
+            let failTenantWrite = true;
+            const customStore = {
+                async get(key) {
+                    return internalStore.get(key) ?? null;
+                },
+                async set(input) {
+                    if (input.key === 'ratelimit:tenant' && failTenantWrite) {
+                        failTenantWrite = false;
+                        internalStore.set('ratelimit:provider', JSON.stringify({ count: 2, windowStart: 0, expiresAt: 60000 }));
+                        throw new Error('write failed');
+                    }
+                    internalStore.set(input.key, input.value);
+                },
+                async delete(key) {
+                    internalStore.delete(key);
+                },
+            };
+            const limiter = createRateLimiter({
+                windowMs: 60000,
+                maxRequests: 1,
+                algorithm: 'fixed-window',
+                persistence: customStore,
+                now: () => 0,
+            });
+            await expect(limiter.checkMany({ keys: ['provider', 'tenant'] })).rejects.toThrow('write failed');
+            expect(JSON.parse(internalStore.get('ratelimit:provider') ?? '{}')).toMatchObject({
+                count: 2,
+            });
+            expect((await limiter.check({ key: 'provider' })).allowed).toBe(false);
+        });
+        it('retains prior quota charges after a partial commit failure', async () => {
+            const internalStore = new Map();
+            const ttlByKey = new Map();
+            let currentTime = 0;
+            const customStore = {
+                async get(key) {
+                    return internalStore.get(key) ?? null;
+                },
+                async set(input) {
+                    if (input.key === 'ratelimit:tenant') {
+                        throw new Error('write failed');
+                    }
+                    internalStore.set(input.key, input.value);
+                    ttlByKey.set(input.key, input.ttlSeconds);
+                },
+                async delete(key) {
+                    internalStore.delete(key);
+                    ttlByKey.delete(key);
+                },
+            };
+            const limiter = createRateLimiter({
+                windowMs: 60000,
+                maxRequests: 2,
+                algorithm: 'fixed-window',
+                persistence: customStore,
+                now: () => currentTime,
+            });
+            await limiter.check({ key: 'provider' });
+            currentTime = 30000;
+            await expect(limiter.checkMany({ keys: ['provider', 'tenant'], windowSeconds: 10 })).rejects.toThrow('write failed');
+            expect(ttlByKey.get('ratelimit:provider')).toBe(10);
+            expect(JSON.parse(internalStore.get('ratelimit:provider') ?? '{}')).toMatchObject({
+                count: 1,
+                windowStart: 30000,
+                expiresAt: 40000,
+            });
+        });
         it('resets key state', async () => {
             const limiter = createRateLimiter({
                 windowMs: 60000,
@@ -172,6 +274,54 @@ describe('rate-limit', () => {
             await limiter.check({ key: 'user1' });
             expect(internalStore.size).toBe(1);
         });
+        it('uses atomic compare-and-set across limiter instances', async () => {
+            const atomicStore = createMemoryAtomicKVStore();
+            const first = createRateLimiter({
+                windowMs: 60000,
+                maxRequests: 1,
+                atomicStore,
+            });
+            const second = createRateLimiter({
+                windowMs: 60000,
+                maxRequests: 1,
+                atomicStore,
+            });
+            const results = await Promise.all([
+                first.check({ key: 'shared-user' }),
+                second.check({ key: 'shared-user' }),
+            ]);
+            expect(results.filter((result) => result.allowed)).toHaveLength(1);
+            expect(results.filter((result) => !result.allowed)).toHaveLength(1);
+        });
+        it('rejects atomic stores that cannot perform compare-and-set', () => {
+            expect(() => createRateLimiter({
+                windowMs: 60000,
+                maxRequests: 1,
+                atomicStore: {
+                    async get() { return null; },
+                    async set() { },
+                    async setIfAbsent() { return { inserted: true }; },
+                    async delete() { },
+                    async incr() { return { value: 1 }; },
+                },
+            })).toThrow('RATE_LIMIT_ATOMIC_CAS_REQUIRED');
+        });
+        it('records persistence latency through configured observability', async () => {
+            const observability = createObservability({ service: 'middleware-test' });
+            const request = observability.startRequest({ requestId: 'req_rate_limit' });
+            const limiter = createRateLimiter({
+                windowMs: 60000,
+                maxRequests: 2,
+                persistence: createInMemoryKVStore(),
+                observability,
+                component: 'test.rate-limit',
+            });
+            await observability.runWithRequest(request, () => limiter.check({ key: 'observed' }));
+            const snapshot = request.finish({ status: 200 });
+            const cache = readObservationGroup(snapshot, 'cache');
+            expect(cache.count).toBeGreaterThan(0);
+            expect(snapshot.metrics[0]?.component).toBe('test.rate-limit.cache');
+        });
     });
     describe('createInMemoryKVStore', () => {
         let store;
@@ -198,3 +348,15 @@ describe('rate-limit', () => {
         });
     });
 });
+it('uses only own limit overrides, including inherited property names', async () => {
+    const limiter = createRateLimiter({ windowMs: 60000, maxRequests: 2, algorithm: 'fixed-window' });
+    const keys = ['constructor', 'toString', '__proto__'];
+    const limitsByKey = Object.create({ constructor: 0 });
+    limitsByKey.toString = 1;
+    const first = await limiter.checkMany({ keys, limitsByKey });
+    expect(first.allowed).toBe(true);
+    expect(first.remainingByKey.get('constructor')).toBe(1);
+    expect(first.remainingByKey.get('toString')).toBe(0);
+    expect(first.remainingByKey.get('__proto__')).toBe(1);
+    expect((await limiter.checkMany({ keys, limitsByKey })).blockedKeys).toEqual(['toString']);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superfunctions/middleware",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Shared middleware utilities for Superfunctions",
   "type": "module",
   "main": "./dist/index.js",
@@ -15,34 +15,50 @@
       "default": "./dist/rate-limit.js"
     }
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "build": "tsc",
-    "test": "vitest",
+    "test": "vitest run",
     "test:watch": "vitest --watch",
     "typecheck": "tsc --noEmit",
     "clean": "rm -rf dist"
   },
-  "keywords": ["middleware", "rate-limit", "superfunctions"],
+  "keywords": [
+    "middleware",
+    "rate-limit",
+    "superfunctions"
+  ],
   "author": "21n",
   "license": "MIT",
-  "bugs": { "url": "https://github.com/21nCo/super-functions/issues" },
+  "bugs": {
+    "url": "https://github.com/21nCo/super-functions/issues"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/21nCo/super-functions.git",
     "directory": "packages/middleware"
   },
-  "publishConfig": { "access": "public" },
+  "publishConfig": {
+    "access": "public"
+  },
   "peerDependencies": {
-    "@superfunctions/db": "0.1.4"
+    "@superfunctions/db": "^0.2.0 || ^0.3.0"
   },
   "peerDependenciesMeta": {
-    "@superfunctions/db": { "optional": true }
+    "@superfunctions/db": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@superfunctions/observability": "0.0.1"
   },
   "devDependencies": {
-    "@superfunctions/db": "^0.1.3",
+    "@superfunctions/db": "0.3.0",
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
     "vitest": "^3.2.4"
-  }
+  },
+  "gitHead": "11f7e104d2d59f62ac94ab2dd06fc01144d0390b"
 }