@upstash/ratelimit 2.1.0 → 2.2.0

package/dist/index.d.mts

@@ -172,7 +172,7 @@ declare class Analytics {
     }>;
 }
 
-type Unit = "ms" | "s" | "m" | "h" | "d";
+type Unit = "ms" | "s" | "m" | "h" | "d" | "w";
 type Duration = `${number} ${Unit}` | `${number}${Unit}`;
 
 type RatelimitConfig<TContext> = {

package/dist/index.d.ts

@@ -172,7 +172,7 @@ declare class Analytics {
     }>;
 }
 
-type Unit = "ms" | "s" | "m" | "h" | "d";
+type Unit = "ms" | "s" | "m" | "h" | "d" | "w";
 type Duration = `${number} ${Unit}` | `${number}${Unit}`;
 
 type RatelimitConfig<TContext> = {

package/dist/index.js

@@ -137,33 +137,30 @@ var DYNAMIC_LIMIT_KEY_SUFFIX = ":dynamic:global";
 var DEFAULT_PREFIX = "@upstash/ratelimit";
 
 // src/duration.ts
+var MULTIPLIERS = {
+  ms: 1,
+  s: 1e3,
+  m: 1e3 * 60,
+  h: 1e3 * 60 * 60,
+  d: 1e3 * 60 * 60 * 24,
+  w: 1e3 * 60 * 60 * 24 * 7
+};
 function ms(d) {
-  const match = d.match(/^(\d+)\s?(ms|s|m|h|d)$/);
+  const match = d.match(/^(\d+(?:\.\d+)?)\s?(ms|s|m|h|d|w)$/);
   if (!match) {
     throw new Error(`Unable to parse window size: ${d}`);
   }
-  const time = Number.parseInt(match[1]);
+  const time = Number.parseFloat(match[1]);
   const unit = match[2];
-  switch (unit) {
-    case "ms": {
-      return time;
-    }
-    case "s": {
-      return time * 1e3;
-    }
-    case "m": {
-      return time * 1e3 * 60;
-    }
-    case "h": {
-      return time * 1e3 * 60 * 60;
-    }
-    case "d": {
-      return time * 1e3 * 60 * 60 * 24;
-    }
-    default: {
-      throw new Error(`Unable to parse window size: ${d}`);
-    }
+  const multiplier = MULTIPLIERS[unit];
+  if (multiplier === void 0) {
+    throw new Error(`Unable to parse window size: ${d}`);
   }
+  const result = Math.round(time * multiplier);
+  if (result < 1) {
+    throw new Error(`Window size must be at least 1 ms, got: ${d}`);
+  }
+  return result;
 }
 
 // src/hash.ts
@@ -342,8 +339,12 @@ var tokenBucketLimitScript = `#!lua flags=allow-key-locking
     refilledAt = refilledAt + numRefills * interval
   end
 
-  -- Only reject if tokens are 0 and we're consuming (not refunding)
-  if tokens == 0 and incrementBy > 0 then
+  -- Only reject when consuming (not refunding) and there are not enough tokens
+  -- for this request. Checking tokens == 0 only covered incrementBy == 1: with
+  -- a larger rate (e.g. 2 tokens left, incrementBy 5) the request fell through,
+  -- drove tokens negative and still wrote it back, so a rejected request
+  -- consumed tokens and a single large rate could lock the identifier out.
+  if incrementBy > 0 and tokens < incrementBy then
     return {-1, refilledAt + interval, effectiveLimit}
   end
 
@@ -542,7 +543,7 @@ var SCRIPTS = {
     tokenBucket: {
       limit: {
         script: tokenBucketLimitScript,
-        hash: "a9873a8026b509e99a49a0e5a2049756c693c384"
+        hash: "d60be5bd3d83482ae229309f1f7425424f891204"
       },
       getRemaining: {
         script: tokenBucketRemainingTokensScript,
@@ -871,7 +872,7 @@ var Ratelimit = class {
         throw new Error("This should not happen");
       }
       const wait = Math.min(res.reset, deadline) - Date.now();
-      await new Promise((r) => setTimeout(r, wait));
+      await new Promise((r) => setTimeout(r, wait > 0 ? wait : 100));
       if (Date.now() > deadline) {
         break;
       }
@@ -1060,7 +1061,7 @@ var Ratelimit = class {
 };
 
 // src/version.ts
-var VERSION = "2.1.0";
+var VERSION = "2.2.0";
 
 // src/telemetry.ts
 var taggedClients = /* @__PURE__ */ new WeakSet();
@@ -1801,7 +1802,7 @@ var RegionRatelimit = class extends Ratelimit {
         const hit = typeof ctx.cache.get(key) === "number";
         if (hit) {
           const cachedTokensAfterUpdate = ctx.cache.incr(key, incrementBy);
-          const success = cachedTokensAfterUpdate < tokens;
+          const success = cachedTokensAfterUpdate <= tokens;
           const pending = success ? safeEval(
             ctx,
             SCRIPTS.singleRegion.cachedFixedWindow.limit,