@voltro/plugin-ratelimit 0.85.0 → 0.87.0

package/dist/index.d.ts

@@ -1,8 +1,12 @@
 import { ColumnBuilder } from '@voltro/database';
+import { ConnectionRef } from '@voltro/kv/connection';
+import { ConnectionRegistryShape } from '@voltro/kv/connection';
 import { DataStore } from '@voltro/database';
 import { Effect } from 'effect';
 import { FieldDefinitions } from '@voltro/database';
-import { RespClient } from '@voltro/kv/connection';
+import { HotRateLimitState } from '@voltro/kv/hot';
+import { HotRateLimitState as HotRateLimitState_2 } from '@voltro/kv/hot/contract';
+import { HotStoreShape } from '@voltro/kv/hot';
 import { RpcKind } from '@voltro/protocol';
 import { Schema } from 'effect';
 import { Subject } from '@voltro/protocol';
@@ -19,20 +23,7 @@ declare interface BucketResult {
 
 /** Opaque per-key state. The store persists it verbatim; only this
  *  module reads its shape. */
-export declare type BucketState = {
-    readonly kind: 'fixed';
-    readonly windowStart: number;
-    readonly count: number;
-} | {
-    readonly kind: 'sliding';
-    readonly currStart: number;
-    readonly currCount: number;
-    readonly prevCount: number;
-} | {
-    readonly kind: 'token';
-    readonly tokens: number;
-    readonly lastRefill: number;
-};
+export declare type BucketState = HotRateLimitState_2;
 
 export declare const consumeBucket: (prev: BucketState | undefined, limit: ResolvedLimit, now: number) => BucketResult;
 
@@ -101,14 +92,15 @@ export declare interface RateLimitContext {
     /** Convenience: the subject's tenant (`null` only for unscoped anonymous). */
     readonly tenantId: string | null;
     readonly traceId: string;
-    /** `'rest'` when the call came through the `publicApi` projection; absent
+    /** `'rest'` for a hand-authored REST route or `publicApi` projection; absent
      *  on the rpc wire. */
     readonly surface?: 'rest';
-    /** The descriptor's own `publicApi.rateLimit`, on a projected call — the
-     *  endpoint's rule for that surface, ahead of `rules` and `default`. */
+    /** The descriptor's own REST quota — `rateLimit` or `publicApi.rateLimit`,
+     *  ahead of `rules` and `default`. */
     readonly publicApiRateLimit?: {
         readonly limit: number;
         readonly window: string;
+        readonly by?: 'subject' | 'tenant' | 'apiKey' | 'ip' | 'global';
     };
     /** The caller's address, resolved by the listener through the app's
      *  `security.trustedProxies` — what `by: 'ip'` keys on. Absent for a call
@@ -179,17 +171,16 @@ export declare interface RateLimitPluginOptions {
     /**
      * Counter backend:
      *   - `'memory'` (default) — single-node, zero-config.
-     *   - `'postgres'` — multi-node correct; opens its own pool from the
-     *     same `DB_*`/`PG_*` env the framework reads, creates
-     *     `_voltro_ratelimit`, mutates state under a row lock. Fails OPEN
-     *     on db errors (degrades to no-limit, never to 500s).
-     *   - `'redis'` — multi-node, fastest; connects ioredis from
-     *     `CACHE_REDIS_URL`/`REDIS_URL`, runs the whole decision in one
-     *     atomic Lua script. For a custom client/url use the
-     *     `redisStore({...})` factory from `@voltro/plugin-ratelimit/redis`.
+     * - `'postgres'` — counters in the app's declared schema, bound through
+     *   `DataStore`; atomic transactions, fail-open on unavailable storage.
+     * - `'redis'` — atomic HotStore decisions over the app-owned registry.
+     *   Use `redis.connection` to select a declared Redis connection or
+     *   `redis.hotStore` to borrow a replacement port.
      *   - a custom `RateLimitStore`.
      */
     readonly store?: 'memory' | 'postgres' | 'redis' | RateLimitStore;
+    /** Registry reference or replacement HotStore for the Redis counter backend. */
+    readonly redis?: RedisStoreOptions;
     /**
      * Master gate. `false` disables all limiting; a function lets you gate
      * per-call (e.g. exempt a tenant, or a maintenance bypass). Returning
@@ -262,7 +253,7 @@ export declare interface RateLimitStore {
     readonly size: () => number;
     /** Optional one-shot setup at plugin activate (open pools, create
      *  tables). Receives the process env. */
-    readonly activate?: (env: NodeJS.ProcessEnv) => Promise<void>;
+    readonly activate?: (env: NodeJS.ProcessEnv, connectionRegistry?: ConnectionRegistryShape) => Promise<void>;
     /** Optional teardown at plugin deactivate (close pools). */
     readonly deactivate?: () => Promise<void>;
     /** Optional bind of the app's `DataStore` (the plugin's `bindDataStore`).
@@ -277,37 +268,20 @@ export declare interface RateLimitStore {
 export declare const rateLimitTable: Table<"_voltro_ratelimit", FieldDefinitions<{
     readonly id: ColumnBuilder<number, "id", boolean>;
     readonly key: ColumnBuilder<string, "text", boolean>;
-    readonly state: ColumnBuilder<BucketState | null, "json", boolean>;
+    readonly state: ColumnBuilder< HotRateLimitState | null, "json", boolean>;
     readonly touchedAt: ColumnBuilder<Date, "timestamp", true>;
     readonly touched: ColumnBuilder<unknown, "text", boolean>;
 }>, false, never>;
 
+/** Redis limiter decisions go only through HotStore. The app owns every socket. */
 export declare const redisStore: (options?: RedisStoreOptions) => RateLimitStore;
 
 export declare interface RedisStoreOptions {
-    /** Connection url. `resp` driver: `redis://…` / `rediss://…`. `http`
-     *  driver: the Upstash REST url. Falls back to `CACHE_REDIS_URL` /
-     *  `REDIS_URL` env at activate time. */
-    readonly url?: string;
-    /**
-     * How to talk to the server — mirrors the cache plugin's axis:
-     *   - `'resp'` (default) — ioredis over TCP. Works for Redis, Valkey,
-     *     KeyDB, Dragonfly, and Upstash's TCP endpoint.
-     *   - `'http'` — `@upstash/redis` over REST, for serverless/edge where
-     *     TCP isn't available.
-     * Resolved from `CACHE_REDIS_DRIVER` env when omitted. `'redis'` as a
-     * store value is the umbrella for the whole RESP family — the server
-     * brand is just the url; only the DRIVER is a real choice.
-     */
-    readonly driver?: 'resp' | 'http';
-    /** Auth token — `http` (Upstash REST) driver only. Falls back to
-     *  `CACHE_REDIS_TOKEN` / `UPSTASH_REDIS_REST_TOKEN` env. */
-    readonly token?: string;
-    /** Bring your own already-connected RESP client (from
-     *  `@voltro/kv/connection`'s `connect`, or the shared registry). Takes
-     *  precedence over `url` / `driver`. */
-    readonly client?: RespClient;
-    /** Key namespace. Default `'voltro:rl:'`. */
+    /** Registry reference. Omit to use the app's default Redis connection. */
+    readonly connection?: ConnectionRef<'redis'>;
+    /** Borrow a replacement HotStore port. Its owner retains disposal. */
+    readonly hotStore?: HotStoreShape;
+    /** HotStore namespace. Default 'voltro:rl'; cannot contain braces. */
     readonly keyPrefix?: string;
 }
 

package/dist/index.js

@@ -1,162 +1,18 @@
 import { RateLimited as e } from "./errors.js";
-import { a as t, i as n, n as r, r as i, t as a } from "./postgresStore-D_oHSGXq.js";
-import { redisStore as o } from "./redisStore.js";
-import { Effect as s } from "effect";
-import { createLogger as c } from "@voltro/logger";
-import { replicaEvidence as l } from "@voltro/protocol/identity";
-import { definePlugin as u, pluginInstanceName as d } from "@voltro/protocol";
-//#region src/inspect.ts
-var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "function" ? "dynamic" : e, m = (e, n) => ({
-	id: n === null ? "default" : `r${n}`,
-	match: "match" in e ? e.match instanceof RegExp ? String(e.match) : Array.isArray(e.match) ? e.match.join(", ") : e.match ?? "*" : "*",
-	kinds: e.kind === void 0 ? [] : typeof e.kind == "string" ? [e.kind] : e.kind,
-	limit: f(e.limit),
-	windowMs: typeof e.window == "function" ? "dynamic" : t(e.window),
-	algorithm: e.algorithm ?? "sliding-window",
-	burst: e.burst === void 0 ? f(e.limit) : f(e.burst),
-	by: Array.isArray(e.by) ? e.by.map(p) : [p(e.by ?? "subject")],
-	scope: e.scope ?? "tag",
-	tenantOverrides: Object.keys(e.tenants ?? {}).length
-}), h = () => ({
-	allowed: 0,
-	rejected: 0,
-	bypassed: 0,
-	unbound: 0,
-	storeErrors: 0,
-	lastRejectedAt: null,
-	lastStoreErrorAt: null
-}), g = (e, n) => {
-	let r = Date.now(), i = {
-		rpc: h(),
-		http: h()
-	}, a = n.bind ? "waiting" : "not-required";
-	return {
-		binding: (e) => {
-			a = e;
-		},
-		bypass: () => {
-			i.rpc.bypassed++;
-		},
-		record: (e, t) => {
-			let n = i[e];
-			t.failOpenReason === "unbound" ? n.unbound++ : t.failOpenReason === "store-error" ? (n.storeErrors++, n.lastStoreErrorAt = Date.now()) : t.allowed ? n.allowed++ : (n.rejected++, n.lastRejectedAt = Date.now());
-		},
-		snapshot: () => {
-			let o = null;
-			try {
-				let e = n.size();
-				Number.isFinite(e) && e >= 0 && (o = e);
-			} catch {}
-			let s = typeof e.store == "string" ? e.store : e.store === void 0 ? "memory" : "custom";
-			return {
-				capturedAt: Date.now(),
-				startedAt: r,
-				rpcGate: e.enabled === !1 ? "disabled" : typeof e.enabled == "function" ? "dynamic" : "enabled",
-				dynamicResolver: e.resolve !== void 0,
-				store: {
-					kind: s,
-					scope: s === "memory" ? "process" : s === "custom" ? "unknown" : "shared-store",
-					sqlBinding: a,
-					trackedBuckets: o
-				},
-				rules: (e.rules ?? []).map((e, t) => m(e, t)),
-				defaultRule: e.default ? m(e.default, null) : null,
-				http: e.http ? {
-					limit: e.http.limit,
-					windowMs: t(e.http.window),
-					algorithm: e.http.algorithm ?? "fixed-window"
-				} : null,
-				counters: {
-					rpc: { ...i.rpc },
-					http: { ...i.http }
-				}
-			};
-		}
-	};
-}, _ = (e = {}) => {
-	let t = e.maxKeys ?? 1e5, r = e.staleAfterMs ?? 36e5, i = /* @__PURE__ */ new Map(), a = (e) => {
-		if (i.size <= t) return;
-		let n = i.size - t, r = 0;
-		for (let t of i.keys()) {
-			if (r >= n) break;
-			t !== e && (i.delete(t), r += 1);
-		}
-	};
-	return {
-		consume: (e, t, r) => s.sync(() => {
-			let o = i.get(e), { state: s, decision: c } = n(o?.state, t, r);
-			return i.set(e, {
-				state: s,
-				touched: r
-			}), a(e), c;
-		}),
-		sweep: (e) => {
-			let t = e - r;
-			for (let [e, n] of i) n.touched < t && i.delete(e);
-		},
-		size: () => i.size
-	};
-}, v = (e, t) => typeof e == "function" ? e(t) : e, y = /* @__PURE__ */ new WeakMap(), b = (e) => {
-	if (!e.global && !e.sticky) return e;
-	let t = y.get(e);
-	return t === void 0 && (t = new RegExp(e.source, e.flags.replace(/[gy]/g, "")), y.set(e, t)), t;
-}, x = (e, t) => e === void 0 ? !0 : typeof e == "string" ? e === t : Array.isArray(e) ? e.includes(t) : b(e).test(t), S = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, C = (e, t) => {
-	let n = t === null ? void 0 : e.tenants?.[t];
-	return {
-		limit: n?.limit ?? e.limit,
-		window: n?.window ?? e.window,
-		algorithm: n?.algorithm ?? e.algorithm,
-		burst: n?.burst ?? e.burst,
-		by: e.by ?? "subject",
-		scope: e.scope ?? "tag",
-		disabled: n?.disabled ?? !1
-	};
-}, w = (e, t, n) => {
-	for (let t = 0; t < e.length; t++) {
-		let r = e[t];
-		if (x(r.match, n.tag) && S(r.kind, n.kind)) return {
-			effective: C(r, n.tenantId),
-			ruleId: `r${t}`
-		};
-	}
-	if (t && S(t.kind, n.kind)) return {
-		effective: C(t, n.tenantId),
-		ruleId: "default"
-	};
-}, T = (e, n) => {
-	let r = v(e.limit, n);
-	return {
-		limit: r,
-		windowMs: t(v(e.window, n)),
-		algorithm: e.algorithm ?? "sliding-window",
-		burst: e.burst === void 0 ? r : v(e.burst, n)
-	};
-}, E = (e) => {
-	let n = e.limit;
-	return {
-		limit: n,
-		windowMs: t(e.window),
-		algorithm: e.algorithm ?? "sliding-window",
-		burst: e.burst ?? n
-	};
-}, D = (e) => ({
-	limit: e.limit,
-	window: e.windowMs,
-	algorithm: e.algorithm,
-	burst: e.burst
-}), O = (e, t) => {
-	if (typeof e == "function") return e(t);
-	switch (e) {
-		case "subject": return `s:${t.tenantId ?? "∅"}:${t.subject.id ?? "anon"}`;
-		case "tenant": return `t:${t.tenantId ?? "∅"}`;
-		case "apiKey": return t.subject.type === "apiKey" ? `k:${t.subject.id}` : `s:${t.tenantId ?? "∅"}:${t.subject.id ?? "anon"}`;
-		case "global": return "g";
-		case "ip": return `i:${t.remoteAddr ?? "unknown"}`;
-	}
-}, k = (e, t) => {
-	let { effective: n, ruleId: r } = e, i = n.scope === "rule" ? `rule#${r}` : `tag:${t.tag}`, a = n.by;
-	return `${i}|${Array.isArray(a) ? a.map((e) => O(e, t)).join("|") : O(a, t)}`;
-}, A = (e) => ({
+import { consumeBucket as t, parseWindow as n } from "./window.js";
+import { makeRateLimitInspect as r } from "./inspect.js";
+import { memoryStore as i } from "./store.js";
+import { RATELIMIT_TABLE as a, postgresStore as o, rateLimitTable as s } from "./postgresStore.js";
+import { redisStore as c } from "./redisStore.js";
+import { buildKey as l, limitFromOverride as u, matchRule as d, resolveLimit as f, toOverride as p } from "./resolve.js";
+import { Effect as m } from "effect";
+import { newTraceId as h } from "@voltro/shared";
+import { restError as g } from "@voltro/protocol/rest";
+import { createLogger as _ } from "@voltro/logger";
+import { replicaEvidence as v } from "@voltro/protocol/identity";
+import { definePlugin as y, pluginInstanceName as b } from "@voltro/protocol";
+//#region src/index.ts
+var x = (e) => ({
 	tag: e.tag,
 	kind: e.kind,
 	subject: e.subject,
@@ -165,18 +21,18 @@ var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "f
 	...e.surface === void 0 ? {} : { surface: e.surface },
 	...e.remoteAddr === void 0 ? {} : { remoteAddr: e.remoteAddr },
 	...e.surface === "rest" && e.publicApi?.rateLimit !== void 0 ? { publicApiRateLimit: e.publicApi.rateLimit } : {}
-}), j = (e) => e.publicApiRateLimit === void 0 ? void 0 : {
+}), S = (e) => e.publicApiRateLimit === void 0 ? void 0 : {
 	ruleId: "publicApi",
 	effective: {
 		limit: e.publicApiRateLimit.limit,
 		window: e.publicApiRateLimit.window,
 		algorithm: void 0,
 		burst: void 0,
-		by: "subject",
+		by: e.publicApiRateLimit.by ?? "subject",
 		scope: "tag",
 		disabled: !1
 	}
-}, M = (e) => {
+}, C = (e) => {
 	let t = e, n = Date.now();
 	return {
 		"retry-after": String(Math.max(1, Math.ceil(t.retryAfterMs / 1e3))),
@@ -184,143 +40,113 @@ var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "f
 		"ratelimit-remaining": "0",
 		"ratelimit-reset": String(Math.max(0, Math.ceil((t.resetAtMs - n) / 1e3)))
 	};
-}, N = c({ scope: "voltro:ratelimit" }), P = (n = {}) => {
-	let a = n.rules ?? [], c = n.store === void 0 || n.store === "memory" ? _() : n.store === "postgres" ? r() : n.store === "redis" ? o() : n.store, f = g(n, c), p = (e) => {
-		let t = n.enabled;
-		return t === void 0 ? !0 : typeof t == "function" ? t(e) : t;
-	}, m = (e, t, r, i) => {
-		if (!n.onLimited) return;
+}, w = _({ scope: "voltro:ratelimit" }), T = (t = {}) => {
+	if (t.redis !== void 0 && t.store !== "redis") throw Error("Rate limiter redis options require store: redis");
+	let a = t.rules ?? [], _ = t.store === void 0 || t.store === "memory" ? i() : t.store === "postgres" ? o() : t.store === "redis" ? c(t.redis) : t.store, T = r(t, _), E = (e) => {
+		let n = t.enabled;
+		return n === void 0 ? !0 : typeof n == "function" ? n(e) : n;
+	}, D = (e, n, r, i) => {
+		if (!t.onLimited) return;
 		let a = {
 			tag: e.tag,
 			kind: e.kind,
-			key: t,
+			key: n,
 			tenantId: e.tenantId,
 			limit: r.limit,
 			windowMs: r.windowMs,
 			retryAfterMs: i.retryAfterMs
 		};
 		try {
-			n.onLimited(a);
+			t.onLimited(a);
 		} catch {}
-	}, h = (e, t) => {
-		let r = n.resolve;
-		return r ? s.suspend(() => {
-			let n = r(e, t);
-			return (s.isEffect(n) ? n : n instanceof Promise ? s.promise(() => n) : s.succeed(n)).pipe(s.map((e) => e === "exempt" ? "exempt" : E(e === void 0 ? t : e)));
-		}) : s.succeed(E(t));
-	}, v = (t, r) => s.suspend(() => {
-		let i = A(r);
-		if (!p(i)) return f.bypass(), t;
-		let o = j(i) ?? w(a, n.default, i);
-		if (!o || o.effective.disabled) return f.bypass(), t;
-		let l = D(T(o.effective, i));
-		return h(i, l).pipe(s.flatMap((n) => {
-			if (n === "exempt") return f.bypass(), t;
-			let r = k(o, i);
-			return c.consume(r, n, Date.now()).pipe(s.catchDefect((e) => s.as(s.logWarning(`[ratelimit] store error — failing open for ${i.tag}: ${String(e)}`), {
+	}, O = (e, n) => {
+		let r = t.resolve;
+		return r ? m.suspend(() => {
+			let t = r(e, n);
+			return (m.isEffect(t) ? t : t instanceof Promise ? m.promise(() => t) : m.succeed(t)).pipe(m.map((e) => e === "exempt" ? "exempt" : u(e === void 0 ? n : e)));
+		}) : m.succeed(u(n));
+	}, k = (n, r) => m.suspend(() => {
+		let i = x(r);
+		if (!E(i)) return T.bypass(), n;
+		let o = S(i) ?? d(a, t.default, i);
+		if (!o || o.effective.disabled) return T.bypass(), n;
+		let s = p(f(o.effective, i));
+		return O(i, s).pipe(m.flatMap((t) => {
+			if (t === "exempt") return T.bypass(), n;
+			let r = l(o, i);
+			return _.consume(r, t, Date.now()).pipe(m.catchDefect((e) => m.as(m.logWarning(`[ratelimit] store error — failing open for ${i.tag}: ${String(e)}`), {
 				allowed: !0,
 				failOpenReason: "store-error",
-				remaining: n.limit,
+				remaining: t.limit,
 				resetAtMs: Date.now(),
 				retryAfterMs: 0
-			})), s.tap((e) => s.sync(() => f.record("rpc", e))), s.flatMap((a) => a.allowed ? t : s.andThen(s.sync(() => m(i, r, n, a)), s.fail(new e({
+			})), m.tap((e) => m.sync(() => T.record("rpc", e))), m.flatMap((a) => a.allowed ? n : m.andThen(m.sync(() => D(i, r, t, a)), m.fail(new e({
 				tag: i.tag,
-				limit: n.limit,
-				windowMs: n.windowMs,
+				limit: t.limit,
+				windowMs: t.windowMs,
 				retryAfterMs: a.retryAfterMs,
 				resetAtMs: a.resetAtMs
 			})))));
 		}));
-	}), y = n.http ? async (e, r) => {
-		let i = n.http, a = {
+	}), A = t.http ? async (e, r) => {
+		let i = t.http, a = {
 			limit: i.limit,
-			windowMs: t(i.window),
+			windowMs: n(i.window),
 			algorithm: i.algorithm ?? "fixed-window",
 			burst: i.limit
-		}, o = r.remoteAddr ?? "unknown", l = Date.now(), u;
+		}, o = r.remoteAddr ?? "unknown", s = Date.now(), c;
 		try {
-			u = await s.runPromise(c.consume(`http:ip:${o}`, a, l));
+			c = await m.runPromise(_.consume(`http:ip:${o}`, a, s));
 		} catch (t) {
-			return f.record("http", {
+			return T.record("http", {
 				allowed: !0,
 				failOpenReason: "store-error",
 				remaining: 0,
-				resetAtMs: l,
+				resetAtMs: s,
 				retryAfterMs: 0
-			}), N.warn("http shield store failure — request ALLOWED without a limit check", { cause: String(t) }), e();
+			}), w.warn("http shield store failure — request ALLOWED without a limit check", { cause: String(t) }), e();
 		}
-		f.record("http", u);
-		let d = String(Math.max(0, Math.ceil((u.resetAtMs - l) / 1e3)));
-		return u.allowed ? e() : {
+		T.record("http", c);
+		let l = String(Math.max(0, Math.ceil((c.resetAtMs - s) / 1e3)));
+		return c.allowed ? e() : {
 			status: 429,
 			body: "Too Many Requests",
 			headers: {
 				"content-type": "text/plain; charset=utf-8",
-				"retry-after": String(Math.max(1, Math.ceil(u.retryAfterMs / 1e3))),
+				"retry-after": String(Math.max(1, Math.ceil(c.retryAfterMs / 1e3))),
 				"ratelimit-limit": String(a.limit),
-				"ratelimit-remaining": String(Math.max(0, u.remaining)),
-				"ratelimit-reset": d
+				"ratelimit-remaining": String(Math.max(0, c.remaining)),
+				"ratelimit-reset": l
 			}
 		};
-	} : void 0, b = [
+	} : void 0, j = [
 		"inspect:read",
 		"rpc:intercept:mutation",
 		"rpc:intercept:query",
 		"rpc:intercept:action",
 		"rpc:intercept:workflow",
-		...n.http ? ["http:intercept"] : [],
-		...n.store === "postgres" ? ["store:write"] : []
-	], x, S;
-	return u({
-		name: d({
+		"http:intercept",
+		...t.store === "postgres" ? ["store:write"] : []
+	], M, N;
+	return y({
+		name: b({
 			base: "@voltro/plugin-ratelimit",
-			instance: n.name
+			instance: t.name
 		}),
 		description: "Per-endpoint / per-subject / per-tenant rate limiting via the rpc interceptors. Configurable rules, three algorithms, static + dynamic per-tenant overrides.",
-		permissions: b,
+		permissions: j,
 		inspectEndpoints: [{
 			method: "GET",
 			path: "/state",
 			scope: "process",
 			description: "Declared rules and process-local limiting evidence, without bucket identities.",
-			handler: () => s.sync(() => ({
+			handler: () => m.sync(() => ({
 				kind: "json",
-				data: f.snapshot()
+				data: T.snapshot()
 			}))
 		}],
-		declaredEnv: [
-			{
-				name: "CACHE_REDIS_URL",
-				required: !1,
-				secret: !0,
-				description: "Redis connection URL for the redis store (credential-carrying). Falls back to REDIS_URL."
-			},
-			{
-				name: "REDIS_URL",
-				required: !1,
-				secret: !0,
-				description: "Fallback Redis connection URL for the redis store (credential-carrying)."
-			},
-			{
-				name: "CACHE_REDIS_DRIVER",
-				required: !1,
-				secret: !1,
-				description: "Redis driver selector: \"http\" for the Upstash REST client, otherwise RESP."
-			},
-			{
-				name: "CACHE_REDIS_TOKEN",
-				required: !1,
-				secret: !0,
-				description: "Upstash REST token for the http redis driver. Falls back to UPSTASH_REDIS_REST_TOKEN."
-			},
-			{
-				name: "UPSTASH_REDIS_REST_TOKEN",
-				required: !1,
-				secret: !0,
-				description: "Fallback Upstash REST token for the http redis driver."
-			}
-		],
-		...y ? { onHttpRequest: y } : {},
+		declaredEnv: [],
+		...A ? { onHttpRequest: A } : {},
 		errorSchemas: [{
 			schema: e,
 			import: {
@@ -329,34 +155,47 @@ var f = (e) => typeof e == "function" ? "dynamic" : e, p = (e) => typeof e == "f
 			},
 			rest: {
 				status: 429,
-				headers: M
+				headers: C
 			}
 		}],
-		interceptMutation: v,
-		interceptQuery: v,
-		interceptAction: v,
-		interceptWorkflow: v,
-		...n.store === "postgres" ? { extendSchema: { tables: [i] } } : {},
+		restRateLimit: (t, n, r) => k(m.void, {
+			tag: `${r.method} ${r.path}`,
+			kind: "action",
+			input: void 0,
+			subject: n.subject,
+			traceId: h(),
+			surface: "rest",
+			publicApi: { rateLimit: t },
+			...n.remoteAddr === void 0 ? {} : { remoteAddr: n.remoteAddr }
+		}).pipe(m.catch((t) => m.fail(t instanceof e ? g(429, {
+			error: "RateLimited",
+			message: "Rate limit exceeded"
+		}, C(t)) : t))),
+		interceptMutation: k,
+		interceptQuery: k,
+		interceptAction: k,
+		interceptWorkflow: k,
+		...t.store === "postgres" ? { extendSchema: { tables: [s] } } : {},
 		bindDataStore: (e) => {
-			c.bind && (f.binding("binding"), c.bind(e).then(() => {
-				S = void 0, f.binding("bound");
+			_.bind && (T.binding("binding"), _.bind(e).then(() => {
+				N = void 0, T.binding("bound");
 			}).catch((e) => {
-				f.binding("failed"), S = e;
+				T.binding("failed"), N = e;
 			}));
 		},
-		onActivate: (e) => s.gen(function* () {
-			c.activate && (yield* s.promise(() => c.activate(e.env))), x = setInterval(() => c.sweep(Date.now()), 6e4), x.unref?.(), S !== void 0 && e.logger.warn("rate-limit: SQL store bind failed — limiter runs fail-open", { error: S instanceof Error ? S.message : String(S) });
-			let t = n.store === void 0 || n.store === "memory" ? l(e.env) : null;
-			t !== null && e.logger.warn(`rate-limit: the counter store is PROCESS-LOCAL (the default), but ${t}, which means several replicas. Each pod counts on its own, so every limit is effectively multiplied by the number of replicas. Set \`store: 'redis'\` or \`store: 'postgres'\` to share the counters.`), e.logger.info("rate-limit active", {
+		onActivate: (e) => m.gen(function* () {
+			_.activate && (yield* m.promise(() => _.activate(e.env, e.connectionRegistry))), M = setInterval(() => _.sweep(Date.now()), 6e4), M.unref?.(), N !== void 0 && e.logger.warn("rate-limit: SQL store bind failed — limiter runs fail-open", { error: N instanceof Error ? N.message : String(N) });
+			let n = t.store === void 0 || t.store === "memory" ? v(e.env) : null;
+			n !== null && e.logger.warn(`rate-limit: the counter store is PROCESS-LOCAL (the default), but ${n}, which means several replicas. Each pod counts on its own, so every limit is effectively multiplied by the number of replicas. Set \`store: 'redis'\` or \`store: 'postgres'\` to share the counters.`), e.logger.info("rate-limit active", {
 				rules: a.length,
-				hasDefault: n.default !== void 0,
-				store: typeof n.store == "string" ? n.store : n.store === void 0 ? "memory" : "custom"
+				hasDefault: t.default !== void 0,
+				store: typeof t.store == "string" ? t.store : t.store === void 0 ? "memory" : "custom"
 			});
 		}),
-		onDeactivate: () => s.gen(function* () {
-			x && clearInterval(x), c.deactivate && (yield* s.promise(() => c.deactivate()));
+		onDeactivate: () => m.gen(function* () {
+			M && clearInterval(M), _.deactivate && (yield* m.promise(() => _.deactivate()));
 		})
 	});
 };
 //#endregion
-export { a as RATELIMIT_TABLE, e as RateLimited, n as consumeBucket, _ as memoryStore, t as parseWindow, r as postgresStore, P as rateLimitPlugin, i as rateLimitTable, o as redisStore };
+export { a as RATELIMIT_TABLE, e as RateLimited, t as consumeBucket, i as memoryStore, n as parseWindow, o as postgresStore, T as rateLimitPlugin, s as rateLimitTable, c as redisStore };