kitcn 0.22.1 → 0.24.0

package/dist/aggregate/index.d.ts

@@ -1,4 +1,4 @@
-import { C as ConvexNumberBuilderInitial, E as ConvexIdBuilderInitial, N as ConvexCustomBuilderInitial, dn as ConvexTableWithColumns, tr as ConvexTextBuilderInitial } from "../where-clause-compiler-B_H3oio5.js";
+import { C as ConvexNumberBuilderInitial, E as ConvexIdBuilderInitial, N as ConvexCustomBuilderInitial, dn as ConvexTableWithColumns, tr as ConvexTextBuilderInitial } from "../where-clause-compiler-DW6jy2er.js";
 import * as convex_values0 from "convex/values";
 import { GenericId, Infer, Value } from "convex/values";
 import { DocumentByName, GenericDataModel, GenericDatabaseReader, GenericDatabaseWriter, TableNamesInDataModel } from "convex/server";

package/dist/auth/nextjs/index.d.ts

@@ -1,4 +1,4 @@
-import { H as ConvexContext, W as LazyCaller } from "../../procedure-name-exVcmr_p.js";
+import { H as ConvexContext, W as LazyCaller } from "../../procedure-name-C20pFZnk.js";
 import { t as GetTokenOptions } from "../../token-B9Bjcqug.js";
 
 //#region src/auth-nextjs/index.d.ts

package/dist/auth/nextjs/index.js

@@ -1,6 +1,6 @@
 import { t as getToken } from "../../token-xlpENMVn.js";
 import { n as defaultIsUnauthorized } from "../../error-Bvo7YEhk.js";
-import { t as createCallerFactory } from "../../caller-factory-DHywSoGZ.js";
+import { t as createCallerFactory } from "../../caller-factory-CWa0ELLD.js";
 
 //#region src/auth-nextjs/index.ts
 /** biome-ignore-all lint/suspicious/noExplicitAny: lib */

package/dist/{builder-Dwy6D2QA.js → builder-CsxVc5xC.js}

@@ -1,7 +1,6 @@
-import { i as pick } from "./upstream-BR6sBLg3.js";
 import { o as vRequired, t as addFieldsToValidator } from "./validators-C7LelqTN.js";
 import { n as customCtx, t as NoOp } from "./customFunctions-DxEEO4Dq.js";
-import { s as getTransformer } from "./transformer-C6pGVHqx.js";
+import { s as getTransformer } from "./transformer-yZuBWo8v.js";
 import { ConvexError, v } from "convex/values";
 import { HttpRouter, actionGeneric, httpActionGeneric, internalActionGeneric, internalMutationGeneric, internalQueryGeneric, mutationGeneric, queryGeneric } from "convex/server";
 import { z } from "zod";
@@ -501,25 +500,43 @@ function withSystemFields(tableName, zObject) {
 		_creationTime: z$1.number()
 	};
 }
+/**
+* Single-pass `pick` over own keys, preserving `obj`'s insertion order.
+*
+* The shared `pick` helper is `Object.fromEntries(Object.entries(obj).filter(
+* ([k]) => keys.includes(k)))`, i.e. O(fields^2) with three intermediate
+* allocations. This runs on every request, so it gets a Set instead.
+*/
+function pickKeys(obj, keys) {
+	const result = {};
+	for (const key of Object.keys(obj)) if (keys.has(key)) result[key] = obj[key];
+	return result;
+}
 function customFnBuilder(builder, customization) {
 	const customInput = customization.input ?? NoOp.input;
 	const inputArgs = customization.args ?? NoOp.args;
 	return function customBuilder(fn) {
-		const { args, handler = fn, skipConvexValidation = false, returns: maybeObject, ...extra } = fn;
+		const { args, handler = fn, skipConvexValidation = false, skipZodReturnsValidation = false, returns: maybeObject, ...extra } = fn;
 		const returns = maybeObject && !(maybeObject instanceof zCore.$ZodType) ? z$1.object(maybeObject) : maybeObject;
 		const returnValidator = returns && !skipConvexValidation ? { returns: zodOutputToConvex(returns) } : null;
+		const parseReturns = returns && !skipZodReturnsValidation ? (value) => returns.parseAsync(value === void 0 ? null : value) : null;
 		if (args) {
 			let argsValidator = args;
 			if (argsValidator instanceof zCore.$ZodType) if (argsValidator instanceof zCore.$ZodObject) argsValidator = argsValidator._zod.def.shape;
 			else throw new Error("Unsupported zod type as args validator: " + argsValidator.constructor.name);
 			const convexValidator = zodToConvexFields(argsValidator);
+			const inputArgKeys = Object.keys(inputArgs);
+			const inputArgKeySet = new Set(inputArgKeys);
+			const argKeySet = new Set(Object.keys(argsValidator));
+			let argsSchema;
 			return builder({
 				args: skipConvexValidation ? void 0 : addFieldsToValidator(convexValidator, inputArgs),
 				...returnValidator,
 				handler: async (ctx, allArgs) => {
-					const added = await customInput(ctx, pick(allArgs, Object.keys(inputArgs)), extra);
-					const rawArgs = pick(allArgs, Object.keys(argsValidator));
-					const parsed = await z$1.object(argsValidator).safeParseAsync(rawArgs);
+					const added = await customInput(ctx, inputArgKeys.length === 0 ? {} : pickKeys(allArgs, inputArgKeySet), extra);
+					const rawArgs = pickKeys(allArgs, argKeySet);
+					argsSchema ??= z$1.object(argsValidator);
+					const parsed = await argsSchema.safeParseAsync(rawArgs);
 					if (!parsed.success) throw new ConvexError({ ZodError: JSON.parse(JSON.stringify(parsed.error.issues, null, 2)) });
 					const args = parsed.data;
 					const ret = await handler({
@@ -529,7 +546,7 @@ function customFnBuilder(builder, customization) {
 						...args,
 						...added.args
 					});
-					const result = returns ? await returns.parseAsync(ret === void 0 ? null : ret) : ret;
+					const result = parseReturns ? await parseReturns(ret) : ret;
 					if (added.onSuccess) await added.onSuccess({
 						ctx,
 						args,
@@ -551,7 +568,7 @@ function customFnBuilder(builder, customization) {
 					...args,
 					...added.args
 				});
-				const result = returns ? await returns.parseAsync(ret === void 0 ? null : ret) : ret;
+				const result = parseReturns ? await parseReturns(ret) : ret;
 				if (added.onSuccess) await added.onSuccess({
 					ctx,
 					args,
@@ -971,29 +988,51 @@ function getBaseSchema(schema) {
 	if (schema instanceof z.ZodDefault) return getBaseSchema(schema._def.innerType);
 	return schema;
 }
-function isArraySchema(schema) {
-	return getBaseSchema(schema) instanceof z.ZodArray;
-}
-function isNumberSchema(schema) {
-	return getBaseSchema(schema) instanceof z.ZodNumber;
-}
-function isBooleanSchema(schema) {
-	return getBaseSchema(schema) instanceof z.ZodBoolean;
+/**
+* Resolve each field's coercion kind from the query schema, once.
+*
+* The kind is a static property of the schema, but zod 4 overrides
+* `Symbol.hasInstance`, so leaving it in the request path pays a `Set.has`
+* per unwrap step per field per request.
+*
+* Fields absent from the map fall through to the raw string(s) branch, which
+* is also where a non-`ZodObject` query schema lands (it has no readable
+* shape, so it gets no coercion at all).
+*/
+function buildQueryCoercion(schema) {
+	const coercion = /* @__PURE__ */ new Map();
+	if (!(schema instanceof z.ZodObject)) return coercion;
+	for (const [key, fieldSchema] of Object.entries(schema.shape)) {
+		const base = getBaseSchema(fieldSchema);
+		if (base instanceof z.ZodArray) coercion.set(key, "array");
+		else if (base instanceof z.ZodNumber) coercion.set(key, "number");
+		else if (base instanceof z.ZodBoolean) coercion.set(key, "boolean");
+	}
+	return coercion;
 }
-function parseQueryParams(url, schema) {
+function parseQueryParams(url, coercion) {
 	const params = {};
-	const keys = new Set(url.searchParams.keys());
-	const shape = schema instanceof z.ZodObject ? schema.shape : {};
-	for (const key of keys) {
-		const values = url.searchParams.getAll(key);
-		const fieldSchema = shape[key];
-		if (fieldSchema) if (isArraySchema(fieldSchema)) params[key] = values;
-		else if (isNumberSchema(fieldSchema)) params[key] = Number(values[0]);
-		else if (isBooleanSchema(fieldSchema)) {
+	const collected = /* @__PURE__ */ new Map();
+	for (const [key, value] of url.searchParams) {
+		const existing = collected.get(key);
+		if (existing) existing.push(value);
+		else collected.set(key, [value]);
+	}
+	for (const [key, values] of collected) switch (coercion.get(key)) {
+		case "array":
+			params[key] = values;
+			break;
+		case "number":
+			params[key] = Number(values[0]);
+			break;
+		case "boolean": {
 			const val = values[0].toLowerCase();
 			params[key] = val === "true" || val === "1";
-		} else params[key] = values.length === 1 ? values[0] : values;
-		else params[key] = values.length === 1 ? values[0] : values;
+			break;
+		}
+		default:
+			params[key] = values.length === 1 ? values[0] : values;
+			break;
 	}
 	return params;
 }
@@ -1017,6 +1056,7 @@ function resolveHttpProcedureInfo(def) {
 function createProcedure(def, handler, _type) {
 	if (!def.route) throw new Error("Route must be defined before action. Use .route(path, method) first.");
 	const middlewareProcedure = resolveHttpProcedureInfo(def);
+	const queryCoercion = buildQueryCoercion(def.querySchema);
 	/**
 	* Hono-compatible handler function.
 	* When used with HttpRouterWithHono, Convex ctx is passed via c.env.
@@ -1046,7 +1086,7 @@ function createProcedure(def, handler, _type) {
 				}
 				let parsedQuery;
 				if (def.querySchema) {
-					const queryParams = parseQueryParams(url, def.querySchema);
+					const queryParams = parseQueryParams(url, queryCoercion);
 					try {
 						parsedQuery = def.querySchema.parse(queryParams);
 					} catch (error) {
@@ -1720,24 +1760,18 @@ const replaceUnencodableInputTypes = (schema) => {
 * unchanged) but carries no checks, transforms, or defaults. cRPC's own
 * `.input()` parse stays the single authoritative one, so refinements and
 * transforms never run twice.
+*
+* Throws when the shape has no Convex equivalent, which is also the
+* feasibility test `resolveConvexArgsShape` steps down its fallback ladder on.
 */
-const toWireShape = (shape) => {
-	try {
-		return convexToZodFields(zodToConvexFields(shape));
-	} catch {
-		return shape;
-	}
-};
+const toWireShape = (shape) => convexToZodFields(zodToConvexFields(shape));
 const resolveConvexArgsShape = (inputShape) => {
 	if (!inputShape) return;
-	const rawSchema = z.object(inputShape);
 	try {
-		zodToConvex(rawSchema);
 		return toWireShape(inputShape);
 	} catch {
-		const compatibleSchema = replaceUnencodableInputTypes(rawSchema);
+		const compatibleSchema = replaceUnencodableInputTypes(z.object(inputShape));
 		try {
-			zodToConvex(compatibleSchema);
 			return toWireShape(compatibleSchema.shape);
 		} catch {
 			return Object.fromEntries(Object.keys(inputShape).map((key) => [key, z.any()]));
@@ -1760,6 +1794,29 @@ const relaxSupersededKeys = (schema, superseded) => {
 		return schema;
 	}
 };
+const buildInputPlan = (inputSchemas) => {
+	if (inputSchemas.length === 1) return {
+		entries: [],
+		single: inputSchemas[0]
+	};
+	const ownerOf = /* @__PURE__ */ new Map();
+	inputSchemas.forEach((schema, index) => {
+		for (const key of Object.keys(schema.shape)) ownerOf.set(key, index);
+	});
+	return { entries: inputSchemas.map((schema, index) => {
+		const keys = Object.keys(schema.shape);
+		const owned = [];
+		const superseded = /* @__PURE__ */ new Set();
+		for (const key of keys) if (ownerOf.get(key) === index) owned.push(key);
+		else superseded.add(key);
+		return {
+			keys,
+			owned,
+			scoped: relaxSupersededKeys(schema, [...superseded]),
+			superseded
+		};
+	}) };
+};
 /**
 * Parse the wire payload through every `.input()` schema.
 *
@@ -1768,20 +1825,14 @@ const relaxSupersededKeys = (schema, superseded) => {
 * so object-level checks run against the shape they were written for without an
 * earlier, superseded declaration vetoing the payload.
 */
-const parseInput = (inputSchemas, value) => {
+const parseInput = (plan, value) => {
 	try {
-		if (inputSchemas.length === 1) return inputSchemas[0].parse(value);
-		const ownerOf = /* @__PURE__ */ new Map();
-		inputSchemas.forEach((schema, index) => {
-			for (const key of Object.keys(schema.shape)) ownerOf.set(key, index);
-		});
+		if (plan.single) return plan.single.parse(value);
+		const { entries } = plan;
 		const source = isPlainObject(value) ? value : {};
 		const parsed = {};
-		for (let index = inputSchemas.length - 1; index >= 0; index -= 1) {
-			const schema = inputSchemas[index];
-			const keys = Object.keys(schema.shape);
-			const superseded = new Set(keys.filter((key) => ownerOf.get(key) !== index));
-			const scoped = relaxSupersededKeys(schema, [...superseded]);
+		for (let index = entries.length - 1; index >= 0; index -= 1) {
+			const { keys, owned, scoped, superseded } = entries[index];
 			const narrowed = {};
 			for (const key of keys) {
 				if (superseded.has(key)) {
@@ -1791,7 +1842,7 @@ const parseInput = (inputSchemas, value) => {
 				if (Object.hasOwn(source, key)) narrowed[key] = source[key];
 			}
 			const result = scoped.parse(narrowed);
-			for (const key of keys) if (ownerOf.get(key) === index && key in result) parsed[key] = result[key];
+			for (const key of owned) if (key in result) parsed[key] = result[key];
 		}
 		return parsed;
 	} catch (cause) {
@@ -1877,19 +1928,21 @@ var ProcedureBuilder = class {
 	_createFunction(handler, baseFunction, customFn, fnType) {
 		const { middlewares, inputSchemas, outputSchema, meta, procedureName, functionConfig, isInternal } = this._def;
 		const convexArgs = resolveConvexArgsShape(this._getMergedInput());
+		const inputPlan = buildInputPlan(inputSchemas);
 		const customFunction = customFn(baseFunction, customCtx(async (_ctx) => withConvexSafeRunners(await functionConfig.createContext(_ctx))));
-		const returnsSchema = resolveConvexReturnsSchema(outputSchema);
-		const typedReturnsSchema = returnsSchema;
+		const typedReturnsSchema = resolveConvexReturnsSchema(outputSchema);
 		const typedArgs = convexArgs ?? {};
-		const shouldValidateOutputWithZod = !!outputSchema && returnsSchema !== outputSchema;
 		const resolvedProcedureName = procedureName ?? inferProcedureNameFromCallsite();
 		let fn;
 		fn = customFunction({
 			args: typedArgs,
-			...typedReturnsSchema ? { returns: typedReturnsSchema } : {},
+			...typedReturnsSchema ? {
+				returns: typedReturnsSchema,
+				skipZodReturnsValidation: true
+			} : {},
 			handler: async (ctx, rawInput) => {
 				const decodedInput = functionConfig.transformer.input.deserialize(rawInput);
-				const parsedInput = inputSchemas.length > 0 ? parseInput(inputSchemas, decodedInput) : decodedInput;
+				const parsedInput = inputSchemas.length > 0 ? parseInput(inputPlan, decodedInput) : decodedInput;
 				const getRawInput = async () => parsedInput;
 				try {
 					const result = await executeMiddlewares(middlewares, ctx, meta, resolveProcedureInfo(fnType, resolvedProcedureName, fn), parsedInput, getRawInput, async ({ ctx: resolvedCtx, input: resolvedInput }) => {
@@ -1898,7 +1951,7 @@ var ProcedureBuilder = class {
 							input: resolvedInput === parsedInput ? parsedInput : functionConfig.transformer.input.deserialize(resolvedInput ?? parsedInput)
 						});
 					});
-					const validatedOutput = shouldValidateOutputWithZod ? outputSchema.parse(result.output) : result.output;
+					const validatedOutput = outputSchema ? await outputSchema.parseAsync(result.output) : result.output;
 					return functionConfig.transformer.output.serialize(validatedOutput);
 				} catch (cause) {
 					const err = toCRPCError(cause);

package/dist/{caller-factory-DHywSoGZ.js → caller-factory-CWa0ELLD.js}

@@ -1,6 +1,6 @@
 import { n as defaultIsUnauthorized } from "./error-Bvo7YEhk.js";
 import { i as getFunctionType, n as getFuncRef, t as buildMetaIndex } from "./meta-utils-D9K4fICl.js";
-import { s as getTransformer } from "./transformer-C6pGVHqx.js";
+import { s as getTransformer } from "./transformer-yZuBWo8v.js";
 import { fetchAction, fetchMutation, fetchQuery } from "convex/nextjs";
 
 //#region src/server/caller.ts

package/dist/cli.mjs

@@ -2506,7 +2506,7 @@ function QueryProvider({ children }: { children: ReactNode }) {
 const FUNCTIONS_DIR_IMPORT_PLACEHOLDER$5 = "__KITCN_FUNCTIONS_DIR__";
 const PLUGIN_CONFIG_IMPORT_PLACEHOLDER$1 = "__KITCN_PLUGIN_CONFIG_IMPORT__";
 const PLUGIN_SCHEMA_IMPORT_PLACEHOLDER$1 = "__KITCN_PLUGIN_SCHEMA_IMPORT__";
-const PROJECT_CRPC_IMPORT_PLACEHOLDER$3 = "__KITCN_PROJECT_CRPC_IMPORT__";
+const PROJECT_CRPC_IMPORT_PLACEHOLDER$4 = "__KITCN_PROJECT_CRPC_IMPORT__";
 const PROJECT_SHARED_API_IMPORT_PLACEHOLDER = "__KITCN_PROJECT_SHARED_API_IMPORT__";
 const PROJECT_GET_ENV_IMPORT_PLACEHOLDER$2 = "__KITCN_PROJECT_GET_ENV_IMPORT__";
 
@@ -2536,7 +2536,7 @@ const INIT_HTTP_IMPORT_MARKER = "// __KITCN_HTTP_IMPORTS__";
 const INIT_HTTP_ROUTE_MARKER = "  // __KITCN_HTTP_ROUTES__";
 const INIT_HTTP_TEMPLATE = `import { createHttpRouter } from 'kitcn/server';
 import { Hono } from 'hono';
-import { router } from '${PROJECT_CRPC_IMPORT_PLACEHOLDER$3}';
+import { router } from '${PROJECT_CRPC_IMPORT_PLACEHOLDER$4}';
 ${INIT_HTTP_IMPORT_MARKER}
 
 const app = new Hono();
@@ -2849,7 +2849,7 @@ function resolveRelativeImportPath(filePath, targetFilePath) {
 	return relativePath.startsWith(".") ? relativePath : `./${relativePath}`;
 }
 function renderInitTemplateContent(params) {
-	return params.template.replaceAll(FUNCTIONS_DIR_IMPORT_PLACEHOLDER$5, resolveRelativeImportPath(params.filePath, params.functionsDir)).replaceAll(PROJECT_CRPC_IMPORT_PLACEHOLDER$3, resolveRelativeImportPath(params.filePath, params.crpcFilePath));
+	return params.template.replaceAll(FUNCTIONS_DIR_IMPORT_PLACEHOLDER$5, resolveRelativeImportPath(params.filePath, params.functionsDir)).replaceAll(PROJECT_CRPC_IMPORT_PLACEHOLDER$4, resolveRelativeImportPath(params.filePath, params.crpcFilePath));
 }
 
 //#endregion
@@ -3424,7 +3424,7 @@ const resolvePluginScaffoldFiles = (templates, roots, functionsDir, existingTemp
 	const lockfilePath = normalizeLockfileScaffoldPath(mappedLockfilePath) ?? normalizePath$2(relative(process.cwd(), join(rootDir, template.path)));
 	const filePath = resolve(process.cwd(), lockfilePath);
 	const getEnvImportPath = resolveProjectGetEnvImportPrefix(filePath, roots.envFilePath);
-	const content = template.content.replaceAll(FUNCTIONS_DIR_IMPORT_PLACEHOLDER$5, resolveFunctionsDirImportPrefix(filePath, functionsDir)).replaceAll(PROJECT_CRPC_IMPORT_PLACEHOLDER$3, resolveProjectCrpcImportPrefix(filePath, roots.crpcFilePath)).replaceAll(PROJECT_SHARED_API_IMPORT_PLACEHOLDER, resolveProjectSharedApiImportPrefix(filePath, roots.sharedApiFilePath)).replaceAll(PROJECT_GET_ENV_IMPORT_PLACEHOLDER$2, `import { getEnv } from '${getEnvImportPath}';`).replaceAll(PLUGIN_CONFIG_IMPORT_PLACEHOLDER$1, resolvePluginConfigImportPrefix(filePath, roots.libRootDir)).replaceAll(PLUGIN_SCHEMA_IMPORT_PLACEHOLDER$1, resolvePluginSchemaImportPrefix(filePath, roots.libRootDir));
+	const content = template.content.replaceAll(FUNCTIONS_DIR_IMPORT_PLACEHOLDER$5, resolveFunctionsDirImportPrefix(filePath, functionsDir)).replaceAll(PROJECT_CRPC_IMPORT_PLACEHOLDER$4, resolveProjectCrpcImportPrefix(filePath, roots.crpcFilePath)).replaceAll(PROJECT_SHARED_API_IMPORT_PLACEHOLDER, resolveProjectSharedApiImportPrefix(filePath, roots.sharedApiFilePath)).replaceAll(PROJECT_GET_ENV_IMPORT_PLACEHOLDER$2, `import { getEnv } from '${getEnvImportPath}';`).replaceAll(PLUGIN_CONFIG_IMPORT_PLACEHOLDER$1, resolvePluginConfigImportPrefix(filePath, roots.libRootDir)).replaceAll(PLUGIN_SCHEMA_IMPORT_PLACEHOLDER$1, resolvePluginSchemaImportPrefix(filePath, roots.libRootDir));
 	if (!(descriptor.key === "auth" && preset === "convex") && (template.target === "functions" || template.target === "lib") && content.includes("process.env")) throw new Error(`Scaffold template "${descriptor.key}/${template.id}" contains process.env. Use getEnv() instead.`);
 	return {
 		templateId: template.id,
@@ -6776,10 +6776,46 @@ const authRegistryItem = defineInternalRegistryItem({
 	}
 });
 
+//#endregion
+//#region src/cli/registry/items/ratelimit/ratelimit-functions.template.ts
+const PROJECT_CRPC_IMPORT_PLACEHOLDER$3 = "__KITCN_PROJECT_CRPC_IMPORT__";
+const RATELIMIT_FUNCTIONS_TEMPLATE = `import { cleanupRatelimitState } from "kitcn/ratelimit";
+import { z } from "zod";
+import { privateMutation } from "${PROJECT_CRPC_IMPORT_PLACEHOLDER$3}";
+
+const DEFAULT_BATCH_SIZE = 500;
+
+export const cleanup = privateMutation
+  .input(
+    z.object({
+      olderThanMs: z.number().positive(),
+      limit: z.number().int().min(1).max(1000).optional(),
+    })
+  )
+  .output(
+    z.object({
+      deleted: z.number(),
+      hasMore: z.boolean(),
+    })
+  )
+  .mutation(async ({ ctx, input }) =>
+    cleanupRatelimitState(ctx.db, {
+      before: Date.now() - input.olderThanMs,
+      limit: input.limit ?? DEFAULT_BATCH_SIZE,
+    })
+  );
+`;
+
 //#endregion
 //#region src/cli/registry/items/ratelimit/ratelimit-plugin.template.ts
 const FUNCTIONS_DIR_IMPORT_PLACEHOLDER$4 = "__KITCN_FUNCTIONS_DIR__";
-const RATELIMIT_PLUGIN_TEMPLATE = `import { MINUTE, Ratelimit, RatelimitPlugin } from "kitcn/ratelimit";
+const RATELIMIT_PLUGIN_TEMPLATE = `import {
+  type LimitRequest,
+  MINUTE,
+  Ratelimit,
+  RatelimitPlugin,
+  SECOND,
+} from "kitcn/ratelimit";
 import type { MutationCtx } from "${FUNCTIONS_DIR_IMPORT_PLACEHOLDER$4}/generated/server";
 
 const fixed = (rate: number) => Ratelimit.fixedWindow(rate, MINUTE);
@@ -6790,6 +6826,11 @@ export const ratelimitBuckets = {
     free: fixed(60),
     premium: fixed(200),
   },
+  interactive: {
+    public: Ratelimit.fixedWindow(3, 30 * SECOND),
+    free: Ratelimit.fixedWindow(3, 30 * SECOND),
+    premium: Ratelimit.fixedWindow(3, 30 * SECOND),
+  },
 } as const;
 
 type RatelimitTier = keyof (typeof ratelimitBuckets)["default"];
@@ -6829,14 +6870,38 @@ async function getRequestSignals(ctx: RatelimitCtx) {
   };
 }
 
+/**
+ * The identifier is the rate-limit partition key: everything that resolves to
+ * the same string shares one budget and one \`ratelimitState\` document.
+ *
+ * Unauthenticated traffic is keyed by request IP so one visitor cannot spend
+ * every other visitor's budget. Calls without request metadata all fall back
+ * to one key.
+ */
+function getRequestIdentifier(
+  user: RatelimitUser | null,
+  signals: LimitRequest | undefined
+) {
+  if (user) {
+    return user.id;
+  }
+
+  return signals?.ip ? \`ip:\${signals.ip}\` : "ip:unknown";
+}
+
 export const ratelimit = RatelimitPlugin.configure({
   buckets: ratelimitBuckets,
   getBucket: ({ meta }: { meta: RatelimitMeta }) => meta.ratelimit ?? "default",
   getUser: ({ ctx }: { ctx: RatelimitCtx }) => ctx.user ?? null,
-  getIdentifier: ({ user }: { user: RatelimitUser | null }) =>
-    user?.id ?? "anonymous",
   getTier: getUserTier,
   getSignals: ({ ctx }: { ctx: RatelimitCtx }) => getRequestSignals(ctx),
+  getIdentifier: ({
+    user,
+    signals,
+  }: {
+    user: RatelimitUser | null;
+    signals: LimitRequest | undefined;
+  }) => getRequestIdentifier(user, signals),
   prefix: ({ bucket, tier }) => \`ratelimit:\${bucket}:\${tier}\`,
   failureMode: "closed",
   enableProtection: true,
@@ -6869,6 +6934,7 @@ export const ratelimitStateTable = convexTable(
   (t) => [
     index("by_name_key_shard").on(t.name, t.key, t.shard),
     index("by_name_key").on(t.name, t.key),
+    index("by_ts").on(t.ts),
   ],
 );
 
@@ -6909,18 +6975,28 @@ export function ratelimitExtension() {
 
 //#endregion
 //#region src/cli/registry/items/ratelimit/ratelimit-item.ts
-const RATELIMIT_FILES = [createRegistryFile({
-	id: "ratelimit-schema",
-	path: "schema.ts",
-	target: "lib",
-	content: RATELIMIT_SCHEMA_TEMPLATE
-}), createRegistryFile({
-	id: "ratelimit-plugin",
-	path: "plugin.ts",
-	target: "lib",
-	content: RATELIMIT_PLUGIN_TEMPLATE,
-	requires: ["ratelimit-schema"]
-})];
+const RATELIMIT_FILES = [
+	createRegistryFile({
+		id: "ratelimit-schema",
+		path: "schema.ts",
+		target: "lib",
+		content: RATELIMIT_SCHEMA_TEMPLATE
+	}),
+	createRegistryFile({
+		id: "ratelimit-functions",
+		path: "ratelimit.ts",
+		target: "functions",
+		content: RATELIMIT_FUNCTIONS_TEMPLATE,
+		requires: ["ratelimit-schema"]
+	}),
+	createRegistryFile({
+		id: "ratelimit-plugin",
+		path: "plugin.ts",
+		target: "lib",
+		content: RATELIMIT_PLUGIN_TEMPLATE,
+		requires: ["ratelimit-schema"]
+	})
+];
 function buildRatelimitCrpcRegistrationPlanFile(params) {
 	const crpcPath = getCrpcFilePath(params.config);
 	const baselineCrpcSource = renderInitTemplateContent({
@@ -6966,7 +7042,7 @@ const ratelimitRegistryItem = defineInternalRegistryItem({
 		presets: [{
 			name: "server-first",
 			description: "Scaffold a reusable ratelimit plugin and auto-register schema extension.",
-			registryDependencies: ["ratelimit-schema", "ratelimit-plugin"]
+			registryDependencies: RATELIMIT_FILES.map((file) => file.meta.id)
 		}, {
 			name: "schema-only",
 			description: "Only register ratelimit extension in schema.",

package/dist/crpc/index.d.ts

@@ -1,5 +1,5 @@
-import { A as DataTransformer, F as decodeWire, I as defaultCRPCTransformer, L as encodeWire, M as WireCodec, N as createTaggedTransformer, O as CombinedDataTransformer, P as dateWireCodec, R as getTransformer, a as HttpProcedureCall, c as InferHttpInput, i as HttpErrorCode, j as DataTransformerOptions, k as DATE_CODEC_TAG, l as InferHttpOutput, n as HttpClientError, o as HttpRouteInfo, r as HttpClientFromRouter, s as HttpRouteMap, t as HttpClient, u as isHttpClientError, z as identityTransformer } from "../http-types-zsMHb_QN.js";
-import { A as HttpInputArgs, C as ReservedMutationOptions, D as VanillaMutation, E as VanillaAction, F as replaceUrlParam, M as RESERVED_KEYS, N as buildSearchParams, O as HttpClientOptions, P as executeHttpRequest, S as ReservedInfiniteQueryOptions, T as StaticQueryOptsParam, _ as IsPaginated, a as BaseInfiniteQueryOptsParam, b as PaginatedFnMeta, c as ConvexMutationKey, d as ConvexQueryMeta, f as EmptyObject, g as InfiniteQueryInput, h as FnMeta, i as BaseConvexQueryOptions, j as HttpProxyBaseOptions, k as HttpFormValue, l as ConvexQueryHookOptions, m as FUNC_REF_SYMBOL, n as BaseConvexActionOptions, o as ConvexActionKey, p as ExtractPaginatedItem, r as BaseConvexInfiniteQueryOptions, s as ConvexInfiniteQueryMeta, t as AuthType, u as ConvexQueryKey, v as Meta, w as ReservedQueryOptions, x as PaginationOpts, y as MutationVariables } from "../types-jNTcza_a.js";
+import { B as dateWireCodec, F as DATE_CODEC_TAG, G as identityTransformer, H as defaultCRPCTransformer, I as DataTransformer, L as DataTransformerOptions, P as CombinedDataTransformer, R as WireCodec, U as encodeWire, V as decodeWire, W as getTransformer, a as HttpErrorCode, c as HttpQueryKey, d as HttpRouteMap, f as InferHttpInput, g as isHttpClientError, h as buildHttpQueryPrefixKey, i as HttpClientFromRouter, l as HttpQueryPrefixKey, m as buildHttpQueryKey, n as HttpClient, o as HttpMutationKey, p as InferHttpOutput, r as HttpClientError, s as HttpProcedureCall, t as HTTP_DEFAULT_STALE_TIME, u as HttpRouteInfo, z as createTaggedTransformer } from "../http-types-DXOgaerG.js";
+import { A as HttpInputArgs, C as ReservedMutationOptions, D as VanillaMutation, E as VanillaAction, F as replaceUrlParam, M as RESERVED_KEYS, N as buildSearchParams, O as HttpClientOptions, P as executeHttpRequest, S as ReservedInfiniteQueryOptions, T as StaticQueryOptsParam, _ as IsPaginated, a as BaseInfiniteQueryOptsParam, b as PaginatedFnMeta, c as ConvexMutationKey, d as ConvexQueryMeta, f as EmptyObject, g as InfiniteQueryInput, h as FnMeta, i as BaseConvexQueryOptions, j as HttpProxyBaseOptions, k as HttpFormValue, l as ConvexQueryHookOptions, m as FUNC_REF_SYMBOL, n as BaseConvexActionOptions, o as ConvexActionKey, p as ExtractPaginatedItem, r as BaseConvexInfiniteQueryOptions, s as ConvexInfiniteQueryMeta, t as AuthType, u as ConvexQueryKey, v as Meta, w as ReservedQueryOptions, x as PaginationOpts, y as MutationVariables } from "../types-BHR7ZKKD.js";
 import { FunctionArgs, FunctionReference } from "convex/server";
 
 //#region src/crpc/auth-error.d.ts
@@ -102,4 +102,4 @@ declare function convexAction<T extends FunctionReference<'action'>>(funcRef: T,
  */
 declare function convexInfiniteQueryOptions<T extends FunctionReference<'query'>>(funcRef: T, args: Record<string, unknown> | 'skip', opts?: BaseInfiniteQueryOptsParam<T> & Record<string, unknown>, meta?: Meta): BaseConvexInfiniteQueryOptions<T> & Record<string, unknown>;
 //#endregion
-export { AuthMutationError, AuthType, BaseConvexActionOptions, BaseConvexInfiniteQueryOptions, BaseConvexQueryOptions, BaseInfiniteQueryOptsParam, CRPCClientError, CombinedDataTransformer, ConvexActionKey, ConvexInfiniteQueryMeta, ConvexMutationKey, ConvexQueryHookOptions, ConvexQueryKey, ConvexQueryMeta, DATE_CODEC_TAG, DataTransformer, DataTransformerOptions, EmptyObject, ExtractPaginatedItem, FUNC_REF_SYMBOL, FnMeta, HttpClient, HttpClientError, HttpClientFromRouter, HttpClientOptions, HttpErrorCode, HttpFormValue, HttpInputArgs, HttpProcedureCall, HttpProxyBaseOptions, HttpRouteInfo, HttpRouteMap, InferHttpInput, InferHttpOutput, InfiniteQueryInput, IsPaginated, Meta, MutationVariables, PaginatedFnMeta, PaginationOpts, RESERVED_KEYS, ReservedInfiniteQueryOptions, ReservedMutationOptions, ReservedQueryOptions, StaticQueryOptsParam, VanillaAction, VanillaMutation, WireCodec, buildSearchParams, convexAction, convexInfiniteQueryOptions, convexQuery, createTaggedTransformer, dateWireCodec, decodeWire, defaultCRPCTransformer, defaultIsUnauthorized, encodeWire, executeHttpRequest, getTransformer, identityTransformer, isAuthMutationError, isCRPCClientError, isCRPCError, isCRPCErrorCode, isHttpClientError, replaceUrlParam };
+export { AuthMutationError, AuthType, BaseConvexActionOptions, BaseConvexInfiniteQueryOptions, BaseConvexQueryOptions, BaseInfiniteQueryOptsParam, CRPCClientError, CombinedDataTransformer, ConvexActionKey, ConvexInfiniteQueryMeta, ConvexMutationKey, ConvexQueryHookOptions, ConvexQueryKey, ConvexQueryMeta, DATE_CODEC_TAG, DataTransformer, DataTransformerOptions, EmptyObject, ExtractPaginatedItem, FUNC_REF_SYMBOL, FnMeta, HTTP_DEFAULT_STALE_TIME, HttpClient, HttpClientError, HttpClientFromRouter, HttpClientOptions, HttpErrorCode, HttpFormValue, HttpInputArgs, HttpMutationKey, HttpProcedureCall, HttpProxyBaseOptions, HttpQueryKey, HttpQueryPrefixKey, HttpRouteInfo, HttpRouteMap, InferHttpInput, InferHttpOutput, InfiniteQueryInput, IsPaginated, Meta, MutationVariables, PaginatedFnMeta, PaginationOpts, RESERVED_KEYS, ReservedInfiniteQueryOptions, ReservedMutationOptions, ReservedQueryOptions, StaticQueryOptsParam, VanillaAction, VanillaMutation, WireCodec, buildHttpQueryKey, buildHttpQueryPrefixKey, buildSearchParams, convexAction, convexInfiniteQueryOptions, convexQuery, createTaggedTransformer, dateWireCodec, decodeWire, defaultCRPCTransformer, defaultIsUnauthorized, encodeWire, executeHttpRequest, getTransformer, identityTransformer, isAuthMutationError, isCRPCClientError, isCRPCError, isCRPCErrorCode, isHttpClientError, replaceUrlParam };

package/dist/crpc/index.js

@@ -1,6 +1,6 @@
 import { a as isCRPCErrorCode, i as isCRPCError, n as defaultIsUnauthorized, r as isCRPCClientError, t as CRPCClientError } from "../error-Bvo7YEhk.js";
-import { a as defaultCRPCTransformer, c as identityTransformer, i as decodeWire, n as createTaggedTransformer, o as encodeWire, r as dateWireCodec, s as getTransformer, t as DATE_CODEC_TAG } from "../transformer-C6pGVHqx.js";
-import { a as buildSearchParams, c as HttpClientError, i as RESERVED_KEYS, l as isHttpClientError, n as convexInfiniteQueryOptions, o as executeHttpRequest, r as convexQuery, s as replaceUrlParam, t as convexAction } from "../query-options-C_eBSIXG.js";
+import { a as defaultCRPCTransformer, c as identityTransformer, i as decodeWire, n as createTaggedTransformer, o as encodeWire, r as dateWireCodec, s as getTransformer, t as DATE_CODEC_TAG } from "../transformer-yZuBWo8v.js";
+import { a as buildSearchParams, c as HTTP_DEFAULT_STALE_TIME, d as buildHttpQueryPrefixKey, f as isHttpClientError, i as RESERVED_KEYS, l as HttpClientError, n as convexInfiniteQueryOptions, o as executeHttpRequest, r as convexQuery, s as replaceUrlParam, t as convexAction, u as buildHttpQueryKey } from "../query-options-CzRV4G4N.js";
 
 //#region src/crpc/auth-error.ts
 /**
@@ -40,4 +40,4 @@ function isAuthMutationError(error) {
 const FUNC_REF_SYMBOL = Symbol.for("convex.funcRef");
 
 //#endregion
-export { AuthMutationError, CRPCClientError, DATE_CODEC_TAG, FUNC_REF_SYMBOL, HttpClientError, RESERVED_KEYS, buildSearchParams, convexAction, convexInfiniteQueryOptions, convexQuery, createTaggedTransformer, dateWireCodec, decodeWire, defaultCRPCTransformer, defaultIsUnauthorized, encodeWire, executeHttpRequest, getTransformer, identityTransformer, isAuthMutationError, isCRPCClientError, isCRPCError, isCRPCErrorCode, isHttpClientError, replaceUrlParam };
+export { AuthMutationError, CRPCClientError, DATE_CODEC_TAG, FUNC_REF_SYMBOL, HTTP_DEFAULT_STALE_TIME, HttpClientError, RESERVED_KEYS, buildHttpQueryKey, buildHttpQueryPrefixKey, buildSearchParams, convexAction, convexInfiniteQueryOptions, convexQuery, createTaggedTransformer, dateWireCodec, decodeWire, defaultCRPCTransformer, defaultIsUnauthorized, encodeWire, executeHttpRequest, getTransformer, identityTransformer, isAuthMutationError, isCRPCClientError, isCRPCError, isCRPCErrorCode, isHttpClientError, replaceUrlParam };

package/dist/{http-types-zsMHb_QN.d.ts → http-types-DXOgaerG.d.ts}

@@ -30,6 +30,18 @@ interface WireCodec {
   decode(value: unknown): unknown;
   encode(value: unknown): unknown;
   isType(value: unknown): boolean;
+  /**
+   * Declares that `isType` only ever claims a value where
+   * `typeof value === 'object' && value !== null` - never a primitive, a
+   * function, `null` or `undefined`.
+   *
+   * Lets `serialize` skip codec dispatch on primitives, which are the majority
+   * of visited nodes. It is opt-in because an arbitrary predicate cannot be
+   * classified by sampling values: a codec that claims, say, one specific
+   * number would be misread as object-only and silently lose its encoding.
+   * Codecs that leave it unset keep full dispatch.
+   */
+  readonly objectsOnly?: boolean;
   readonly tag: `$${string}`;
 }
 /**
@@ -51,6 +63,9 @@ declare const defaultCRPCTransformer: DataTransformer;
 /**
  * Normalize transformer config to split input/output shape.
  * User transformers are additive and always composed with default Date handling.
+ *
+ * Idempotent: passing a transformer this function already resolved returns it
+ * unchanged.
  */
 declare const getTransformer: (transformer?: DataTransformerOptions) => CombinedDataTransformer;
 /**
@@ -246,6 +261,36 @@ type HttpRouteInfo = {
 };
 /** Route map type - from codegen */
 type HttpRouteMap = Record<string, HttpRouteInfo>;
+/** Exact cache key for one route + args, as stored in the QueryClient */
+type HttpQueryKey = readonly ['httpQuery', string, unknown];
+/** Route-wide prefix key that matches every args variant of one route */
+type HttpQueryPrefixKey = readonly ['httpQuery', string];
+/** Mutation key for HTTP endpoints */
+type HttpMutationKey = readonly ['httpMutation', string];
+/**
+ * Build the exact cache key for an HTTP route.
+ *
+ * Missing args normalize to `{}` so the RSC prefetch, the browser observer, and
+ * a hand-written `getQueryData` call all hash to the same key. Every producer
+ * of an `httpQuery` cache key goes through here.
+ */
+declare function buildHttpQueryKey(routeKey: string, args?: unknown): HttpQueryKey;
+/**
+ * Build the route-wide prefix key.
+ *
+ * Filters match on prefix, so this matches every args variant of the route.
+ * Not a cache key: nothing is ever stored under it.
+ */
+declare function buildHttpQueryPrefixKey(routeKey: string): HttpQueryPrefixKey;
+/**
+ * Freshness window for `crpc.http.*` routes, in milliseconds.
+ *
+ * HTTP routes are a pull model with no push channel, so hydrated data needs a
+ * real freshness window or the browser refetches it on mount. The RSC
+ * QueryClient reads the same constant, so the server dedupe window and the
+ * client freshness window cannot drift apart.
+ */
+declare const HTTP_DEFAULT_STALE_TIME = 30000;
 /** Infer schema type or return empty object if UnsetMarker */
 type InferSchemaOrEmpty<T> = T extends UnsetMarker ? object : T extends z.ZodTypeAny ? z.infer<T> : object;
 /**
@@ -290,4 +335,4 @@ declare class HttpClientError extends Error {
 /** Type guard for HttpClientError */
 declare const isHttpClientError: (error: unknown) => error is HttpClientError;
 //#endregion
-export { DataTransformer as A, HttpProcedure as C, ProcedureMeta as D, InferHttpInput$1 as E, decodeWire as F, defaultCRPCTransformer as I, encodeWire as L, WireCodec as M, createTaggedTransformer as N, CombinedDataTransformer as O, dateWireCodec as P, getTransformer as R, HttpMethod as S, HttpRouteDefinition as T, extractRouteMap as _, HttpProcedureCall as a, HttpActionHandler as b, InferHttpInput as c, CRPCHttpRouter as d, HttpRouterDef as f, createHttpRouterFactory as g, createHttpRouter as h, HttpErrorCode as i, DataTransformerOptions as j, DATE_CODEC_TAG as k, InferHttpOutput as l, HttpRouterWithHono as m, HttpClientError as n, HttpRouteInfo as o, HttpRouterRecord as p, HttpClientFromRouter as r, HttpRouteMap as s, HttpClient as t, isHttpClientError as u, CRPCHonoHandler as v, HttpProcedureBuilderDef as w, HttpHandlerOpts as x, HttpActionConstructor as y, identityTransformer as z };
+export { HttpProcedureBuilderDef as A, dateWireCodec as B, extractRouteMap as C, HttpHandlerOpts as D, HttpActionHandler as E, DATE_CODEC_TAG as F, identityTransformer as G, defaultCRPCTransformer as H, DataTransformer as I, DataTransformerOptions as L, InferHttpInput$1 as M, ProcedureMeta as N, HttpMethod as O, CombinedDataTransformer as P, WireCodec as R, createHttpRouterFactory as S, HttpActionConstructor as T, encodeWire as U, decodeWire as V, getTransformer as W, CRPCHttpRouter as _, HttpErrorCode as a, HttpRouterWithHono as b, HttpQueryKey as c, HttpRouteMap as d, InferHttpInput as f, isHttpClientError as g, buildHttpQueryPrefixKey as h, HttpClientFromRouter as i, HttpRouteDefinition as j, HttpProcedure as k, HttpQueryPrefixKey as l, buildHttpQueryKey as m, HttpClient as n, HttpMutationKey as o, InferHttpOutput as p, HttpClientError as r, HttpProcedureCall as s, HTTP_DEFAULT_STALE_TIME as t, HttpRouteInfo as u, HttpRouterDef as v, CRPCHonoHandler as w, createHttpRouter as x, HttpRouterRecord as y, createTaggedTransformer as z };

package/dist/{middleware-qzHEHaDy.js → middleware-DUd1Sj39.js}

@@ -1,4 +1,4 @@
-import { a as createMiddlewareFactory } from "./builder-Dwy6D2QA.js";
+import { a as createMiddlewareFactory } from "./builder-CsxVc5xC.js";
 
 //#region src/plugins/middleware.ts
 const PLUGIN_CONFIG_RESOLVERS = Symbol.for("kitcn:PluginConfigResolvers");