@voltro/plugin-ratelimit 0.69.1 → 0.71.0

package/README.md

@@ -20,14 +20,6 @@ Installation, guides, the full API reference, and examples all live in the
 **[Voltro documentation](https://docs.voltro.dev/docs/intro/getting-started)** — the single source of truth. This README is
 deliberately short so there is nothing here to drift out of date.
 
-## Inspection
-
-Both dashboards expose declared rules and process-local decisions under **Rate
-limits**, with an explicit choice for multiple instances. The read-only
-`GET /state` inspect endpoint distinguishes actual checks from requests passed
-through an unbound or failing store. See the [inspection guide](https://docs.voltro.dev/docs/plugins/ratelimit#inspect-rate-limits)
-for scope, privacy and custom-store decision reporting.
-
 ## License
 
 Proprietary. © 2026 Voltro UG. Your use is governed by the

package/dist/index.d.ts

@@ -95,6 +95,15 @@ export declare interface RateLimitContext {
     /** Convenience: the subject's tenant (`null` only for unscoped anonymous). */
     readonly tenantId: string | null;
     readonly traceId: string;
+    /** `'rest'` when the call came through the `publicApi` projection; absent
+     *  on the rpc wire. */
+    readonly surface?: 'rest';
+    /** The descriptor's own `publicApi.rateLimit`, on a projected call — the
+     *  endpoint's rule for that surface, ahead of `rules` and `default`. */
+    readonly publicApiRateLimit?: {
+        readonly limit: number;
+        readonly window: string;
+    };
 }
 
 export declare interface RateLimitDecision {

package/dist/index.js

@@ -177,8 +177,29 @@ var l = (e) => typeof e == "function" ? "dynamic" : e, u = (e) => typeof e == "f
 	kind: e.kind,
 	subject: e.subject,
 	tenantId: e.subject.tenantId ?? null,
-	traceId: e.traceId
-}), A = a({ scope: "voltro:ratelimit" }), j = (n = {}) => {
+	traceId: e.traceId,
+	...e.surface === void 0 ? {} : { surface: e.surface },
+	...e.surface === "rest" && e.publicApi?.rateLimit !== void 0 ? { publicApiRateLimit: e.publicApi.rateLimit } : {}
+}), A = (e) => e.publicApiRateLimit === void 0 ? void 0 : {
+	ruleId: "publicApi",
+	effective: {
+		limit: e.publicApiRateLimit.limit,
+		window: e.publicApiRateLimit.window,
+		algorithm: void 0,
+		burst: void 0,
+		by: "subject",
+		scope: "tag",
+		disabled: !1
+	}
+}, j = (e) => {
+	let t = e, n = Date.now();
+	return {
+		"retry-after": String(Math.max(1, Math.ceil(t.retryAfterMs / 1e3))),
+		"ratelimit-limit": String(t.limit),
+		"ratelimit-remaining": "0",
+		"ratelimit-reset": String(Math.max(0, Math.ceil((t.resetAtMs - n) / 1e3)))
+	};
+}, M = a({ scope: "voltro:ratelimit" }), N = (n = {}) => {
 	let a = n.rules ?? [], l = n.store === void 0 || n.store === "memory" ? m() : n.store === "postgres" ? g() : n.store === "redis" ? r() : n.store, u = p(n, l), d = (e) => {
 		let t = n.enabled;
 		return t === void 0 ? !0 : typeof t == "function" ? t(e) : t;
@@ -205,7 +226,7 @@ var l = (e) => typeof e == "function" ? "dynamic" : e, u = (e) => typeof e == "f
 	}, _ = (t, r) => i.suspend(() => {
 		let o = k(r);
 		if (!d(o)) return u.bypass(), t;
-		let s = C(a, n.default, o);
+		let s = A(o) ?? C(a, n.default, o);
 		if (!s || s.effective.disabled) return u.bypass(), t;
 		let c = E(w(s.effective, o));
 		return h(o, c).pipe(i.flatMap((n) => {
@@ -241,7 +262,7 @@ var l = (e) => typeof e == "function" ? "dynamic" : e, u = (e) => typeof e == "f
 				remaining: 0,
 				resetAtMs: c,
 				retryAfterMs: 0
-			}), A.warn("http shield store failure — request ALLOWED without a limit check", { cause: String(t) }), e();
+			}), M.warn("http shield store failure — request ALLOWED without a limit check", { cause: String(t) }), e();
 		}
 		u.record("http", d);
 		let f = String(Math.max(0, Math.ceil((d.resetAtMs - c) / 1e3)));
@@ -319,6 +340,10 @@ var l = (e) => typeof e == "function" ? "dynamic" : e, u = (e) => typeof e == "f
 			import: {
 				module: "@voltro/plugin-ratelimit/errors",
 				name: "RateLimited"
+			},
+			rest: {
+				status: 429,
+				headers: j
 			}
 		}],
 		interceptMutation: _,
@@ -348,4 +373,4 @@ var l = (e) => typeof e == "function" ? "dynamic" : e, u = (e) => typeof e == "f
 	});
 };
 //#endregion
-export { e as RateLimited, n as consumeBucket, m as memoryStore, t as parseWindow, j as rateLimitPlugin, r as redisStore };
+export { e as RateLimited, n as consumeBucket, m as memoryStore, t as parseWindow, N as rateLimitPlugin, r as redisStore };

package/dist/redisStore.js

@@ -8,28 +8,32 @@ var n = "\nlocal key = KEYS[1]\nlocal algo = ARGV[1]\nlocal limit = tonumber(ARG
 		remaining: e.limit,
 		resetAtMs: t + e.windowMs,
 		retryAfterMs: 0
-	});
+	}), c, l = (e) => r.url ?? e.RATELIMIT_REDIS_URL ?? e.CACHE_REDIS_URL ?? e.REDIS_URL, u = (n) => a ? Promise.resolve() : (c === void 0 && (c = (async () => {
+		let i = l(n);
+		if (!i) throw Error("@voltro/plugin-ratelimit redisStore: no client and no url (set RATELIMIT_REDIS_URL / REDIS_URL or pass { url }).");
+		let s = r.driver ?? ((n.RATELIMIT_REDIS_DRIVER ?? n.CACHE_REDIS_DRIVER) === "http" ? "http" : "resp"), c = r.token ?? n.RATELIMIT_REDIS_TOKEN ?? n.CACHE_REDIS_TOKEN ?? n.UPSTASH_REDIS_REST_TOKEN, u = {
+			url: i,
+			driver: s,
+			...c === void 0 ? {} : { token: c }
+		};
+		a = await e.runPromise(t(u)), o = !0;
+	})().finally(() => {
+		c = void 0;
+	})), c), d = (t, r, o) => {
+		let c = a;
+		return c ? e.tryPromise(async () => {
+			let e = await c.eval(n, 1, `${i}${t}`, r.algorithm, r.limit, r.windowMs, r.burst, o);
+			return JSON.parse(String(e));
+		}).pipe(e.catchAll(() => e.succeed(s(r, o, "store-error")))) : e.succeed(s(r, o, "unbound"));
+	};
 	return {
-		consume: (t, r, o) => {
-			let c = a;
-			return c ? e.tryPromise(async () => {
-				let e = await c.eval(n, 1, `${i}${t}`, r.algorithm, r.limit, r.windowMs, r.burst, o);
-				return JSON.parse(String(e));
-			}).pipe(e.catchAll(() => e.succeed(s(r, o, "store-error")))) : e.succeed(s(r, o, "unbound"));
-		},
+		consume: (t, n, r) => a ? d(t, n, r) : l(process.env) === void 0 ? e.succeed(s(n, r, "unbound")) : e.tryPromise(() => u(process.env)).pipe(e.matchEffect({
+			onFailure: () => e.succeed(s(n, r, "store-error")),
+			onSuccess: () => d(t, n, r)
+		})),
 		sweep: () => {},
 		size: () => -1,
-		activate: async (n) => {
-			if (a) return;
-			let i = r.url ?? n.RATELIMIT_REDIS_URL ?? n.CACHE_REDIS_URL ?? n.REDIS_URL;
-			if (!i) throw Error("@voltro/plugin-ratelimit redisStore: no client and no url (set RATELIMIT_REDIS_URL / REDIS_URL or pass { url }).");
-			let s = r.driver ?? ((n.RATELIMIT_REDIS_DRIVER ?? n.CACHE_REDIS_DRIVER) === "http" ? "http" : "resp"), c = r.token ?? n.RATELIMIT_REDIS_TOKEN ?? n.CACHE_REDIS_TOKEN ?? n.UPSTASH_REDIS_REST_TOKEN, l = {
-				url: i,
-				driver: s,
-				...c === void 0 ? {} : { token: c }
-			};
-			a = await e.runPromise(t(l)), o = !0;
-		},
+		activate: (e) => u(e),
 		deactivate: async () => {
 			let e = a;
 			a = null, e && o && await e.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-ratelimit",
-  "version": "0.69.1",
+  "version": "0.71.0",
   "description": "Rate-limiting plugin — per-endpoint, per-subject and per-tenant request limits via the RPC interceptors. Highly configurable rules (fixed-window / sliding-window / token-bucket), composite keying, static per-tenant overrides and a dynamic resolve() hook. Stores: memory (default, single-node), postgres + redis (multi-node, atomic).",
   "keywords": [
     "voltro",
@@ -48,9 +48,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/kv": "0.69.1",
-    "@voltro/logger": "0.69.1",
-    "@voltro/protocol": "0.69.1"
+    "@voltro/kv": "0.71.0",
+    "@voltro/logger": "0.71.0",
+    "@voltro/protocol": "0.71.0"
   },
   "optionalDependencies": {
     "@effect/sql": "^0.52.1"