@voltro/plugin-ratelimit 0.85.0 → 0.86.0

package/dist/index.d.ts

@@ -101,14 +101,15 @@ export declare interface RateLimitContext {
     /** Convenience: the subject's tenant (`null` only for unscoped anonymous). */
     readonly tenantId: string | null;
     readonly traceId: string;
-    /** `'rest'` when the call came through the `publicApi` projection; absent
+    /** `'rest'` for a hand-authored REST route or `publicApi` projection; absent
      *  on the rpc wire. */
     readonly surface?: 'rest';
-    /** The descriptor's own `publicApi.rateLimit`, on a projected call — the
-     *  endpoint's rule for that surface, ahead of `rules` and `default`. */
+    /** The descriptor's own REST quota — `rateLimit` or `publicApi.rateLimit`,
+     *  ahead of `rules` and `default`. */
     readonly publicApiRateLimit?: {
         readonly limit: number;
         readonly window: string;
+        readonly by?: 'subject' | 'tenant' | 'apiKey' | 'ip' | 'global';
     };
     /** The caller's address, resolved by the listener through the app's
      *  `security.trustedProxies` — what `by: 'ip'` keys on. Absent for a call

package/dist/index.js

@@ -1,162 +1,18 @@
 import { RateLimited as e } from "./errors.js";
-import { a as t, i as n, n as r, r as i, t as a } from "./postgresStore-D_oHSGXq.js";
-import { redisStore as o } from "./redisStore.js";
-import { Effect as s } from "effect";
-import { createLogger as c } from "@voltro/logger";
-import { replicaEvidence as l } from "@voltro/protocol/identity";
-import { definePlugin as u, pluginInstanceName as d } from "@voltro/protocol";
-//#region src/inspect.ts
-var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "function" ? "dynamic" : e, m = (e, n) => ({
-	id: n === null ? "default" : `r${n}`,
-	match: "match" in e ? e.match instanceof RegExp ? String(e.match) : Array.isArray(e.match) ? e.match.join(", ") : e.match ?? "*" : "*",
-	kinds: e.kind === void 0 ? [] : typeof e.kind == "string" ? [e.kind] : e.kind,
-	limit: f(e.limit),
-	windowMs: typeof e.window == "function" ? "dynamic" : t(e.window),
-	algorithm: e.algorithm ?? "sliding-window",
-	burst: e.burst === void 0 ? f(e.limit) : f(e.burst),
-	by: Array.isArray(e.by) ? e.by.map(p) : [p(e.by ?? "subject")],
-	scope: e.scope ?? "tag",
-	tenantOverrides: Object.keys(e.tenants ?? {}).length
-}), h = () => ({
-	allowed: 0,
-	rejected: 0,
-	bypassed: 0,
-	unbound: 0,
-	storeErrors: 0,
-	lastRejectedAt: null,
-	lastStoreErrorAt: null
-}), g = (e, n) => {
-	let r = Date.now(), i = {
-		rpc: h(),
-		http: h()
-	}, a = n.bind ? "waiting" : "not-required";
-	return {
-		binding: (e) => {
-			a = e;
-		},
-		bypass: () => {
-			i.rpc.bypassed++;
-		},
-		record: (e, t) => {
-			let n = i[e];
-			t.failOpenReason === "unbound" ? n.unbound++ : t.failOpenReason === "store-error" ? (n.storeErrors++, n.lastStoreErrorAt = Date.now()) : t.allowed ? n.allowed++ : (n.rejected++, n.lastRejectedAt = Date.now());
-		},
-		snapshot: () => {
-			let o = null;
-			try {
-				let e = n.size();
-				Number.isFinite(e) && e >= 0 && (o = e);
-			} catch {}
-			let s = typeof e.store == "string" ? e.store : e.store === void 0 ? "memory" : "custom";
-			return {
-				capturedAt: Date.now(),
-				startedAt: r,
-				rpcGate: e.enabled === !1 ? "disabled" : typeof e.enabled == "function" ? "dynamic" : "enabled",
-				dynamicResolver: e.resolve !== void 0,
-				store: {
-					kind: s,
-					scope: s === "memory" ? "process" : s === "custom" ? "unknown" : "shared-store",
-					sqlBinding: a,
-					trackedBuckets: o
-				},
-				rules: (e.rules ?? []).map((e, t) => m(e, t)),
-				defaultRule: e.default ? m(e.default, null) : null,
-				http: e.http ? {
-					limit: e.http.limit,
-					windowMs: t(e.http.window),
-					algorithm: e.http.algorithm ?? "fixed-window"
-				} : null,
-				counters: {
-					rpc: { ...i.rpc },
-					http: { ...i.http }
-				}
-			};
-		}
-	};
-}, _ = (e = {}) => {
-	let t = e.maxKeys ?? 1e5, r = e.staleAfterMs ?? 36e5, i = /* @__PURE__ */ new Map(), a = (e) => {
-		if (i.size <= t) return;
-		let n = i.size - t, r = 0;
-		for (let t of i.keys()) {
-			if (r >= n) break;
-			t !== e && (i.delete(t), r += 1);
-		}
-	};
-	return {
-		consume: (e, t, r) => s.sync(() => {
-			let o = i.get(e), { state: s, decision: c } = n(o?.state, t, r);
-			return i.set(e, {
-				state: s,
-				touched: r
-			}), a(e), c;
-		}),
-		sweep: (e) => {
-			let t = e - r;
-			for (let [e, n] of i) n.touched < t && i.delete(e);
-		},
-		size: () => i.size
-	};
-}, v = (e, t) => typeof e == "function" ? e(t) : e, y = /* @__PURE__ */ new WeakMap(), b = (e) => {
-	if (!e.global && !e.sticky) return e;
-	let t = y.get(e);
-	return t === void 0 && (t = new RegExp(e.source, e.flags.replace(/[gy]/g, "")), y.set(e, t)), t;
-}, x = (e, t) => e === void 0 ? !0 : typeof e == "string" ? e === t : Array.isArray(e) ? e.includes(t) : b(e).test(t), S = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, C = (e, t) => {
-	let n = t === null ? void 0 : e.tenants?.[t];
-	return {
-		limit: n?.limit ?? e.limit,
-		window: n?.window ?? e.window,
-		algorithm: n?.algorithm ?? e.algorithm,
-		burst: n?.burst ?? e.burst,
-		by: e.by ?? "subject",
-		scope: e.scope ?? "tag",
-		disabled: n?.disabled ?? !1
-	};
-}, w = (e, t, n) => {
-	for (let t = 0; t < e.length; t++) {
-		let r = e[t];
-		if (x(r.match, n.tag) && S(r.kind, n.kind)) return {
-			effective: C(r, n.tenantId),
-			ruleId: `r${t}`
-		};
-	}
-	if (t && S(t.kind, n.kind)) return {
-		effective: C(t, n.tenantId),
-		ruleId: "default"
-	};
-}, T = (e, n) => {
-	let r = v(e.limit, n);
-	return {
-		limit: r,
-		windowMs: t(v(e.window, n)),
-		algorithm: e.algorithm ?? "sliding-window",
-		burst: e.burst === void 0 ? r : v(e.burst, n)
-	};
-}, E = (e) => {
-	let n = e.limit;
-	return {
-		limit: n,
-		windowMs: t(e.window),
-		algorithm: e.algorithm ?? "sliding-window",
-		burst: e.burst ?? n
-	};
-}, D = (e) => ({
-	limit: e.limit,
-	window: e.windowMs,
-	algorithm: e.algorithm,
-	burst: e.burst
-}), O = (e, t) => {
-	if (typeof e == "function") return e(t);
-	switch (e) {
-		case "subject": return `s:${t.tenantId ?? "∅"}:${t.subject.id ?? "anon"}`;
-		case "tenant": return `t:${t.tenantId ?? "∅"}`;
-		case "apiKey": return t.subject.type === "apiKey" ? `k:${t.subject.id}` : `s:${t.tenantId ?? "∅"}:${t.subject.id ?? "anon"}`;
-		case "global": return "g";
-		case "ip": return `i:${t.remoteAddr ?? "unknown"}`;
-	}
-}, k = (e, t) => {
-	let { effective: n, ruleId: r } = e, i = n.scope === "rule" ? `rule#${r}` : `tag:${t.tag}`, a = n.by;
-	return `${i}|${Array.isArray(a) ? a.map((e) => O(e, t)).join("|") : O(a, t)}`;
-}, A = (e) => ({
+import { consumeBucket as t, parseWindow as n } from "./window.js";
+import { makeRateLimitInspect as r } from "./inspect.js";
+import { memoryStore as i } from "./store.js";
+import { RATELIMIT_TABLE as a, postgresStore as o, rateLimitTable as s } from "./postgresStore.js";
+import { redisStore as c } from "./redisStore.js";
+import { buildKey as l, limitFromOverride as u, matchRule as d, resolveLimit as f, toOverride as p } from "./resolve.js";
+import { Effect as m } from "effect";
+import { restError as h } from "@voltro/protocol/rest";
+import { createLogger as g } from "@voltro/logger";
+import { newTraceId as _ } from "@voltro/runtime";
+import { replicaEvidence as v } from "@voltro/protocol/identity";
+import { definePlugin as y, pluginInstanceName as b } from "@voltro/protocol";
+//#region src/index.ts
+var x = (e) => ({
 	tag: e.tag,
 	kind: e.kind,
 	subject: e.subject,
@@ -165,18 +21,18 @@ var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "f
 	...e.surface === void 0 ? {} : { surface: e.surface },
 	...e.remoteAddr === void 0 ? {} : { remoteAddr: e.remoteAddr },
 	...e.surface === "rest" && e.publicApi?.rateLimit !== void 0 ? { publicApiRateLimit: e.publicApi.rateLimit } : {}
-}), j = (e) => e.publicApiRateLimit === void 0 ? void 0 : {
+}), S = (e) => e.publicApiRateLimit === void 0 ? void 0 : {
 	ruleId: "publicApi",
 	effective: {
 		limit: e.publicApiRateLimit.limit,
 		window: e.publicApiRateLimit.window,
 		algorithm: void 0,
 		burst: void 0,
-		by: "subject",
+		by: e.publicApiRateLimit.by ?? "subject",
 		scope: "tag",
 		disabled: !1
 	}
-}, M = (e) => {
+}, C = (e) => {
 	let t = e, n = Date.now();
 	return {
 		"retry-after": String(Math.max(1, Math.ceil(t.retryAfterMs / 1e3))),
@@ -184,108 +40,108 @@ var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "f
 		"ratelimit-remaining": "0",
 		"ratelimit-reset": String(Math.max(0, Math.ceil((t.resetAtMs - n) / 1e3)))
 	};
-}, N = c({ scope: "voltro:ratelimit" }), P = (n = {}) => {
-	let a = n.rules ?? [], c = n.store === void 0 || n.store === "memory" ? _() : n.store === "postgres" ? r() : n.store === "redis" ? o() : n.store, f = g(n, c), p = (e) => {
-		let t = n.enabled;
-		return t === void 0 ? !0 : typeof t == "function" ? t(e) : t;
-	}, m = (e, t, r, i) => {
-		if (!n.onLimited) return;
+}, w = g({ scope: "voltro:ratelimit" }), T = (t = {}) => {
+	let a = t.rules ?? [], g = t.store === void 0 || t.store === "memory" ? i() : t.store === "postgres" ? o() : t.store === "redis" ? c() : t.store, T = r(t, g), E = (e) => {
+		let n = t.enabled;
+		return n === void 0 ? !0 : typeof n == "function" ? n(e) : n;
+	}, D = (e, n, r, i) => {
+		if (!t.onLimited) return;
 		let a = {
 			tag: e.tag,
 			kind: e.kind,
-			key: t,
+			key: n,
 			tenantId: e.tenantId,
 			limit: r.limit,
 			windowMs: r.windowMs,
 			retryAfterMs: i.retryAfterMs
 		};
 		try {
-			n.onLimited(a);
+			t.onLimited(a);
 		} catch {}
-	}, h = (e, t) => {
-		let r = n.resolve;
-		return r ? s.suspend(() => {
-			let n = r(e, t);
-			return (s.isEffect(n) ? n : n instanceof Promise ? s.promise(() => n) : s.succeed(n)).pipe(s.map((e) => e === "exempt" ? "exempt" : E(e === void 0 ? t : e)));
-		}) : s.succeed(E(t));
-	}, v = (t, r) => s.suspend(() => {
-		let i = A(r);
-		if (!p(i)) return f.bypass(), t;
-		let o = j(i) ?? w(a, n.default, i);
-		if (!o || o.effective.disabled) return f.bypass(), t;
-		let l = D(T(o.effective, i));
-		return h(i, l).pipe(s.flatMap((n) => {
-			if (n === "exempt") return f.bypass(), t;
-			let r = k(o, i);
-			return c.consume(r, n, Date.now()).pipe(s.catchDefect((e) => s.as(s.logWarning(`[ratelimit] store error — failing open for ${i.tag}: ${String(e)}`), {
+	}, O = (e, n) => {
+		let r = t.resolve;
+		return r ? m.suspend(() => {
+			let t = r(e, n);
+			return (m.isEffect(t) ? t : t instanceof Promise ? m.promise(() => t) : m.succeed(t)).pipe(m.map((e) => e === "exempt" ? "exempt" : u(e === void 0 ? n : e)));
+		}) : m.succeed(u(n));
+	}, k = (n, r) => m.suspend(() => {
+		let i = x(r);
+		if (!E(i)) return T.bypass(), n;
+		let o = S(i) ?? d(a, t.default, i);
+		if (!o || o.effective.disabled) return T.bypass(), n;
+		let s = p(f(o.effective, i));
+		return O(i, s).pipe(m.flatMap((t) => {
+			if (t === "exempt") return T.bypass(), n;
+			let r = l(o, i);
+			return g.consume(r, t, Date.now()).pipe(m.catchDefect((e) => m.as(m.logWarning(`[ratelimit] store error — failing open for ${i.tag}: ${String(e)}`), {
 				allowed: !0,
 				failOpenReason: "store-error",
-				remaining: n.limit,
+				remaining: t.limit,
 				resetAtMs: Date.now(),
 				retryAfterMs: 0
-			})), s.tap((e) => s.sync(() => f.record("rpc", e))), s.flatMap((a) => a.allowed ? t : s.andThen(s.sync(() => m(i, r, n, a)), s.fail(new e({
+			})), m.tap((e) => m.sync(() => T.record("rpc", e))), m.flatMap((a) => a.allowed ? n : m.andThen(m.sync(() => D(i, r, t, a)), m.fail(new e({
 				tag: i.tag,
-				limit: n.limit,
-				windowMs: n.windowMs,
+				limit: t.limit,
+				windowMs: t.windowMs,
 				retryAfterMs: a.retryAfterMs,
 				resetAtMs: a.resetAtMs
 			})))));
 		}));
-	}), y = n.http ? async (e, r) => {
-		let i = n.http, a = {
+	}), A = t.http ? async (e, r) => {
+		let i = t.http, a = {
 			limit: i.limit,
-			windowMs: t(i.window),
+			windowMs: n(i.window),
 			algorithm: i.algorithm ?? "fixed-window",
 			burst: i.limit
-		}, o = r.remoteAddr ?? "unknown", l = Date.now(), u;
+		}, o = r.remoteAddr ?? "unknown", s = Date.now(), c;
 		try {
-			u = await s.runPromise(c.consume(`http:ip:${o}`, a, l));
+			c = await m.runPromise(g.consume(`http:ip:${o}`, a, s));
 		} catch (t) {
-			return f.record("http", {
+			return T.record("http", {
 				allowed: !0,
 				failOpenReason: "store-error",
 				remaining: 0,
-				resetAtMs: l,
+				resetAtMs: s,
 				retryAfterMs: 0
-			}), N.warn("http shield store failure — request ALLOWED without a limit check", { cause: String(t) }), e();
+			}), w.warn("http shield store failure — request ALLOWED without a limit check", { cause: String(t) }), e();
 		}
-		f.record("http", u);
-		let d = String(Math.max(0, Math.ceil((u.resetAtMs - l) / 1e3)));
-		return u.allowed ? e() : {
+		T.record("http", c);
+		let l = String(Math.max(0, Math.ceil((c.resetAtMs - s) / 1e3)));
+		return c.allowed ? e() : {
 			status: 429,
 			body: "Too Many Requests",
 			headers: {
 				"content-type": "text/plain; charset=utf-8",
-				"retry-after": String(Math.max(1, Math.ceil(u.retryAfterMs / 1e3))),
+				"retry-after": String(Math.max(1, Math.ceil(c.retryAfterMs / 1e3))),
 				"ratelimit-limit": String(a.limit),
-				"ratelimit-remaining": String(Math.max(0, u.remaining)),
-				"ratelimit-reset": d
+				"ratelimit-remaining": String(Math.max(0, c.remaining)),
+				"ratelimit-reset": l
 			}
 		};
-	} : void 0, b = [
+	} : void 0, j = [
 		"inspect:read",
 		"rpc:intercept:mutation",
 		"rpc:intercept:query",
 		"rpc:intercept:action",
 		"rpc:intercept:workflow",
-		...n.http ? ["http:intercept"] : [],
-		...n.store === "postgres" ? ["store:write"] : []
-	], x, S;
-	return u({
-		name: d({
+		"http:intercept",
+		...t.store === "postgres" ? ["store:write"] : []
+	], M, N;
+	return y({
+		name: b({
 			base: "@voltro/plugin-ratelimit",
-			instance: n.name
+			instance: t.name
 		}),
 		description: "Per-endpoint / per-subject / per-tenant rate limiting via the rpc interceptors. Configurable rules, three algorithms, static + dynamic per-tenant overrides.",
-		permissions: b,
+		permissions: j,
 		inspectEndpoints: [{
 			method: "GET",
 			path: "/state",
 			scope: "process",
 			description: "Declared rules and process-local limiting evidence, without bucket identities.",
-			handler: () => s.sync(() => ({
+			handler: () => m.sync(() => ({
 				kind: "json",
-				data: f.snapshot()
+				data: T.snapshot()
 			}))
 		}],
 		declaredEnv: [
@@ -320,7 +176,7 @@ var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "f
 				description: "Fallback Upstash REST token for the http redis driver."
 			}
 		],
-		...y ? { onHttpRequest: y } : {},
+		...A ? { onHttpRequest: A } : {},
 		errorSchemas: [{
 			schema: e,
 			import: {
@@ -329,34 +185,47 @@ var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "f
 			},
 			rest: {
 				status: 429,
-				headers: M
+				headers: C
 			}
 		}],
-		interceptMutation: v,
-		interceptQuery: v,
-		interceptAction: v,
-		interceptWorkflow: v,
-		...n.store === "postgres" ? { extendSchema: { tables: [i] } } : {},
+		restRateLimit: (t, n, r) => k(m.void, {
+			tag: `${r.method} ${r.path}`,
+			kind: "action",
+			input: void 0,
+			subject: n.subject,
+			traceId: _(),
+			surface: "rest",
+			publicApi: { rateLimit: t },
+			...n.remoteAddr === void 0 ? {} : { remoteAddr: n.remoteAddr }
+		}).pipe(m.catch((t) => m.fail(t instanceof e ? h(429, {
+			error: "RateLimited",
+			message: "Rate limit exceeded"
+		}, C(t)) : t))),
+		interceptMutation: k,
+		interceptQuery: k,
+		interceptAction: k,
+		interceptWorkflow: k,
+		...t.store === "postgres" ? { extendSchema: { tables: [s] } } : {},
 		bindDataStore: (e) => {
-			c.bind && (f.binding("binding"), c.bind(e).then(() => {
-				S = void 0, f.binding("bound");
+			g.bind && (T.binding("binding"), g.bind(e).then(() => {
+				N = void 0, T.binding("bound");
 			}).catch((e) => {
-				f.binding("failed"), S = e;
+				T.binding("failed"), N = e;
 			}));
 		},
-		onActivate: (e) => s.gen(function* () {
-			c.activate && (yield* s.promise(() => c.activate(e.env))), x = setInterval(() => c.sweep(Date.now()), 6e4), x.unref?.(), S !== void 0 && e.logger.warn("rate-limit: SQL store bind failed — limiter runs fail-open", { error: S instanceof Error ? S.message : String(S) });
-			let t = n.store === void 0 || n.store === "memory" ? l(e.env) : null;
-			t !== null && e.logger.warn(`rate-limit: the counter store is PROCESS-LOCAL (the default), but ${t}, which means several replicas. Each pod counts on its own, so every limit is effectively multiplied by the number of replicas. Set \`store: 'redis'\` or \`store: 'postgres'\` to share the counters.`), e.logger.info("rate-limit active", {
+		onActivate: (e) => m.gen(function* () {
+			g.activate && (yield* m.promise(() => g.activate(e.env))), M = setInterval(() => g.sweep(Date.now()), 6e4), M.unref?.(), N !== void 0 && e.logger.warn("rate-limit: SQL store bind failed — limiter runs fail-open", { error: N instanceof Error ? N.message : String(N) });
+			let n = t.store === void 0 || t.store === "memory" ? v(e.env) : null;
+			n !== null && e.logger.warn(`rate-limit: the counter store is PROCESS-LOCAL (the default), but ${n}, which means several replicas. Each pod counts on its own, so every limit is effectively multiplied by the number of replicas. Set \`store: 'redis'\` or \`store: 'postgres'\` to share the counters.`), e.logger.info("rate-limit active", {
 				rules: a.length,
-				hasDefault: n.default !== void 0,
-				store: typeof n.store == "string" ? n.store : n.store === void 0 ? "memory" : "custom"
+				hasDefault: t.default !== void 0,
+				store: typeof t.store == "string" ? t.store : t.store === void 0 ? "memory" : "custom"
 			});
 		}),
-		onDeactivate: () => s.gen(function* () {
-			x && clearInterval(x), c.deactivate && (yield* s.promise(() => c.deactivate()));
+		onDeactivate: () => m.gen(function* () {
+			M && clearInterval(M), g.deactivate && (yield* m.promise(() => g.deactivate()));
 		})
 	});
 };
 //#endregion
-export { a as RATELIMIT_TABLE, e as RateLimited, n as consumeBucket, _ as memoryStore, t as parseWindow, r as postgresStore, P as rateLimitPlugin, i as rateLimitTable, o as redisStore };
+export { a as RATELIMIT_TABLE, e as RateLimited, t as consumeBucket, i as memoryStore, n as parseWindow, o as postgresStore, T as rateLimitPlugin, s as rateLimitTable, c as redisStore };

package/dist/inspect.js

@@ -0,0 +1,72 @@
+import { parseWindow as e } from "./window.js";
+//#region src/inspect.ts
+var t = (e) => typeof e == "function" ? "dynamic" : e, n = (e) => typeof e == "function" ? "dynamic" : e, r = (r, i) => ({
+	id: i === null ? "default" : `r${i}`,
+	match: "match" in r ? r.match instanceof RegExp ? String(r.match) : Array.isArray(r.match) ? r.match.join(", ") : r.match ?? "*" : "*",
+	kinds: r.kind === void 0 ? [] : typeof r.kind == "string" ? [r.kind] : r.kind,
+	limit: t(r.limit),
+	windowMs: typeof r.window == "function" ? "dynamic" : e(r.window),
+	algorithm: r.algorithm ?? "sliding-window",
+	burst: r.burst === void 0 ? t(r.limit) : t(r.burst),
+	by: Array.isArray(r.by) ? r.by.map(n) : [n(r.by ?? "subject")],
+	scope: r.scope ?? "tag",
+	tenantOverrides: Object.keys(r.tenants ?? {}).length
+}), i = () => ({
+	allowed: 0,
+	rejected: 0,
+	bypassed: 0,
+	unbound: 0,
+	storeErrors: 0,
+	lastRejectedAt: null,
+	lastStoreErrorAt: null
+}), a = (t, n) => {
+	let a = Date.now(), o = {
+		rpc: i(),
+		http: i()
+	}, s = n.bind ? "waiting" : "not-required";
+	return {
+		binding: (e) => {
+			s = e;
+		},
+		bypass: () => {
+			o.rpc.bypassed++;
+		},
+		record: (e, t) => {
+			let n = o[e];
+			t.failOpenReason === "unbound" ? n.unbound++ : t.failOpenReason === "store-error" ? (n.storeErrors++, n.lastStoreErrorAt = Date.now()) : t.allowed ? n.allowed++ : (n.rejected++, n.lastRejectedAt = Date.now());
+		},
+		snapshot: () => {
+			let i = null;
+			try {
+				let e = n.size();
+				Number.isFinite(e) && e >= 0 && (i = e);
+			} catch {}
+			let c = typeof t.store == "string" ? t.store : t.store === void 0 ? "memory" : "custom";
+			return {
+				capturedAt: Date.now(),
+				startedAt: a,
+				rpcGate: t.enabled === !1 ? "disabled" : typeof t.enabled == "function" ? "dynamic" : "enabled",
+				dynamicResolver: t.resolve !== void 0,
+				store: {
+					kind: c,
+					scope: c === "memory" ? "process" : c === "custom" ? "unknown" : "shared-store",
+					sqlBinding: s,
+					trackedBuckets: i
+				},
+				rules: (t.rules ?? []).map((e, t) => r(e, t)),
+				defaultRule: t.default ? r(t.default, null) : null,
+				http: t.http ? {
+					limit: t.http.limit,
+					windowMs: e(t.http.window),
+					algorithm: t.http.algorithm ?? "fixed-window"
+				} : null,
+				counters: {
+					rpc: { ...o.rpc },
+					http: { ...o.http }
+				}
+			};
+		}
+	};
+};
+//#endregion
+export { a as makeRateLimitInspect };

package/dist/postgresStore.js

@@ -1,2 +1,48 @@
-import { n as e, r as t, t as n } from "./postgresStore-D_oHSGXq.js";
-export { n as RATELIMIT_TABLE, e as postgresStore, t as rateLimitTable };
+import { consumeBucket as e } from "./window.js";
+import { Effect as t } from "effect";
+import { dropped as n, eq as r, id as i, json as a, lt as o, queryFor as s, table as c, text as l, timestamp as u } from "@voltro/database";
+//#region src/postgresStore.ts
+var d = "_voltro_ratelimit", f = c(d, {
+	id: i({ scheme: "numeric" }),
+	key: l().maxLength(512),
+	state: a().nullable(),
+	touchedAt: u().default("now"),
+	touched: n()
+}).unique("rateLimitKey", ["key"]).nonReactive(), p = (n = {}) => {
+	let i = n.staleAfterMs ?? 36e5, a = null, c = (e, t, n) => ({
+		failOpenReason: n,
+		allowed: !0,
+		remaining: e.limit,
+		resetAtMs: t + e.windowMs,
+		retryAfterMs: 0
+	}), l = async (t, n, i, a) => {
+		let o = new Date(a);
+		return await t.insertIgnore(d, {
+			key: n,
+			state: null,
+			touchedAt: o
+		}, { conflictColumns: ["key"] }), t.transactional(async (t) => {
+			let c = (await t.query(s(f).where(r("key", n)).forUpdate().descriptor))[0]?.state ?? void 0, { state: l, decision: u } = e(c ?? void 0, i, a);
+			return await t.updateMany(d, {
+				state: l,
+				touchedAt: o
+			}, { where: r("key", n) }), u;
+		});
+	};
+	return {
+		consume: (e, n, r) => {
+			let i = a;
+			return i ? t.tryPromise(() => l(i, e, n, r)).pipe(t.catch(() => t.succeed(c(n, r, "store-error")))) : t.succeed(c(n, r, "unbound"));
+		},
+		sweep: (e) => {
+			let t = a;
+			t && t.deleteMany(d, { where: o("touchedAt", new Date(e - i)) }).catch(() => {});
+		},
+		size: () => -1,
+		bind: async (e) => {
+			a = e;
+		}
+	};
+};
+//#endregion
+export { d as RATELIMIT_TABLE, p as postgresStore, f as rateLimitTable };

package/dist/resolve.js

@@ -0,0 +1,65 @@
+import { parseWindow as e } from "./window.js";
+//#region src/resolve.ts
+var t = (e, t) => typeof e == "function" ? e(t) : e, n = /* @__PURE__ */ new WeakMap(), r = (e) => {
+	if (!e.global && !e.sticky) return e;
+	let t = n.get(e);
+	return t === void 0 && (t = new RegExp(e.source, e.flags.replace(/[gy]/g, "")), n.set(e, t)), t;
+}, i = (e, t) => e === void 0 ? !0 : typeof e == "string" ? e === t : Array.isArray(e) ? e.includes(t) : r(e).test(t), a = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, o = (e, t) => {
+	let n = t === null ? void 0 : e.tenants?.[t];
+	return {
+		limit: n?.limit ?? e.limit,
+		window: n?.window ?? e.window,
+		algorithm: n?.algorithm ?? e.algorithm,
+		burst: n?.burst ?? e.burst,
+		by: e.by ?? "subject",
+		scope: e.scope ?? "tag",
+		disabled: n?.disabled ?? !1
+	};
+}, s = (e, t, n) => {
+	for (let t = 0; t < e.length; t++) {
+		let r = e[t];
+		if (i(r.match, n.tag) && a(r.kind, n.kind)) return {
+			effective: o(r, n.tenantId),
+			ruleId: `r${t}`
+		};
+	}
+	if (t && a(t.kind, n.kind)) return {
+		effective: o(t, n.tenantId),
+		ruleId: "default"
+	};
+}, c = (n, r) => {
+	let i = t(n.limit, r);
+	return {
+		limit: i,
+		windowMs: e(t(n.window, r)),
+		algorithm: n.algorithm ?? "sliding-window",
+		burst: n.burst === void 0 ? i : t(n.burst, r)
+	};
+}, l = (t) => {
+	let n = t.limit;
+	return {
+		limit: n,
+		windowMs: e(t.window),
+		algorithm: t.algorithm ?? "sliding-window",
+		burst: t.burst ?? n
+	};
+}, u = (e) => ({
+	limit: e.limit,
+	window: e.windowMs,
+	algorithm: e.algorithm,
+	burst: e.burst
+}), d = (e, t) => {
+	if (typeof e == "function") return e(t);
+	switch (e) {
+		case "subject": return `s:${t.tenantId ?? "∅"}:${t.subject.id ?? "anon"}`;
+		case "tenant": return `t:${t.tenantId ?? "∅"}`;
+		case "apiKey": return t.subject.type === "apiKey" ? `k:${t.subject.id}` : `s:${t.tenantId ?? "∅"}:${t.subject.id ?? "anon"}`;
+		case "global": return "g";
+		case "ip": return `i:${t.remoteAddr ?? "unknown"}`;
+	}
+}, f = (e, t) => {
+	let { effective: n, ruleId: r } = e, i = n.scope === "rule" ? `rule#${r}` : `tag:${t.tag}`, a = n.by;
+	return `${i}|${Array.isArray(a) ? a.map((e) => d(e, t)).join("|") : d(a, t)}`;
+};
+//#endregion
+export { f as buildKey, l as limitFromOverride, s as matchRule, c as resolveLimit, u as toOverride };