limitwall 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kevin Rozario
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,135 @@
+# limitwall
+
+Rate limiting middleware for [Hono](https://hono.dev), backed by Redis. Supports four algorithms - fixed window, sliding window, token bucket, and leaky bucket (GCRA) behind one config-driven middleware, with atomic Lua-script checks so counts stay correct under real concurrent traffic.
+
+Works on regular Node servers (via `ioredis`) and edge/serverless runtimes like Cloudflare Workers (via Upstash's REST-based Redis client).
+
+## Features
+
+- **Four algorithms** - pick whichever fits your traffic shape, per rule
+- **Atomic by design** - every check runs as a single Lua script inside Redis, so concurrent requests can't race past the limit
+- **Edge-ready** - the Upstash store works anywhere `fetch` exists, no persistent connection required
+- **Privacy-conscious keys** - identifiers (IPs, user IDs, etc.) are hashed before ever touching Redis
+- **No silent defaults on failure** - you explicitly choose fail-open or fail-closed behavior when Redis is unreachable
+- **Standard headers** - both IETF `RateLimit-*` header drafts supported, plus `Retry-After`
+
+## Install
+
+```bash
+pnpm install limitwall hono
+
+# pick the store(s) you need:
+pnpm install ioredis          # for regular Node servers
+pnpm install @upstash/redis   # for edge/serverless runtimes
+```
+
+## Quick start - Node + Redis
+
+```ts
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import { Redis } from "ioredis";
+
+import { rateLimiter, RedisStore } from "limitwall";
+
+const app = new Hono();
+const store = new RedisStore({ client: new Redis() });
+
+app.use(
+  "/api/*",
+  rateLimiter({
+    algorithm: "tokenBucket",
+    ruleName: "api",
+    capacity: 10,
+    refillRate: 0.5,
+    identifier: c => c.req.header("x-forwarded-for") ?? "unknown",
+    store,
+    onError: "fail-open",
+  }),
+);
+
+serve(app);
+```
+
+## Quick start - Cloudflare Workers + Upstash
+
+```ts
+import { Redis } from "@upstash/redis/cloudflare";
+import { Hono } from "hono";
+
+import { rateLimiter, UpstashStore } from "limitwall";
+
+const app = new Hono<{
+  Bindings: { UPSTASH_URL: string; UPSTASH_TOKEN: string };
+}>();
+
+app.use("/api/*", async (c, next) => {
+  const store = new UpstashStore({
+    client: new Redis({ url: c.env.UPSTASH_URL, token: c.env.UPSTASH_TOKEN }),
+  });
+
+  return rateLimiter({
+    algorithm: "leakyBucket",
+    ruleName: "api",
+    capacity: 5,
+    rate: 2,
+    identifier: c => c.req.header("cf-connecting-ip") ?? "unknown",
+    store,
+    onError: "fail-closed",
+  })(c, next);
+});
+
+export default app;
+```
+
+## Algorithms
+
+| Algorithm       | Config fields            | Behavior                                                                              |
+| --------------- | ------------------------ | ------------------------------------------------------------------------------------- |
+| `fixedWindow`   | `limit`, `windowSeconds` | Simplest. Resets on the dot every window; allows a burst right at the boundary.       |
+| `slidingWindow` | `limit`, `windowSeconds` | Blends the current and previous window's counts, avoiding the boundary-burst problem. |
+| `tokenBucket`   | `capacity`, `refillRate` | Bucket refills continuously; allows saved-up bursts up to `capacity`.                 |
+| `leakyBucket`   | `capacity`, `rate`       | Implemented as GCRA. Smooths traffic into an even pace rather than allowing bursts.   |
+
+Every algorithm also accepts `ruleName` (required - namespaces its Redis keys) and `cost` (optional, defaults to `1`).
+
+## Config reference
+
+```ts
+rateLimiter({
+  algorithm: "tokenBucket" | "fixedWindow" | "slidingWindow" | "leakyBucket",
+  ruleName: string,
+  // ...algorithm-specific fields, see table above
+  cost?: number,
+
+  identifier: (c: Context) => string,   // required - what to rate limit by
+  store: RateLimitStore,                // RedisStore or UpstashStore
+  onError: "fail-open" | "fail-closed", // required - no silent default
+  headerStyle?: "draft-6" | "draft-7",  // defaults to "draft-6"
+  message?: (c: Context) => Response,   // overrides the default 429 body
+});
+```
+
+## Response headers
+
+On every request:
+
+- `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` (draft-6, default), or
+- `RateLimit: limit=..., remaining=..., reset=...` (draft-7, if configured)
+
+On a rejected leaky-bucket request, `Retry-After` is also set, telling the client exactly how long to wait.
+
+## Development
+
+```bash
+pnpm install
+pnpm run build      # tsup -> dist/
+pnpm run test       # vitest, spins up real Redis via Testcontainers
+pnpm run lint       # eslint (antfu config)
+```
+
+Tests use [Testcontainers](https://node.testcontainers.org/) to run against a real, disposable Redis instance - Docker must be running locally.
+
+## License
+
+MIT © Kevin Rozario

package/dist/index.cjs

@@ -0,0 +1,333 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  RedisStore: () => RedisStore,
+  UpstashStore: () => UpstashStore,
+  rateLimiter: () => rateLimiter
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/middleware.ts
+var import_factory = require("hono/factory");
+
+// src/key.ts
+async function buildKey(ruleName, algorithm, identifier) {
+  const hashed = await hashIdentifier(identifier);
+  return `ratelimit:${ruleName}:${algorithm}:${hashed}`;
+}
+async function hashIdentifier(identifier) {
+  const encoded = new TextEncoder().encode(identifier);
+  const digest = await crypto.subtle.digest("SHA-256", encoded);
+  return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/algorithms/fixed-window.ts
+var FIXED_WINDOW_SCRIPT = `
+local limit = tonumber(ARGV[1])
+local windowSeconds = tonumber(ARGV[2])
+
+local current = redis.call('INCR', KEYS[1])
+if current == 1 then
+  redis.call('EXPIRE', KEYS[1], windowSeconds)
+end
+
+local ttl = redis.call('TTL', KEYS[1])
+local allowed = current <= limit
+local remaining = math.max(0, limit - current)
+
+return { allowed and 1 or 0, remaining, ttl }
+`;
+async function checkFixedWindow(store, identifier, config) {
+  const key = await buildKey(config.ruleName, "fixedwindow", identifier);
+  const [allowed, remaining, ttl] = await store.eval(
+    FIXED_WINDOW_SCRIPT,
+    [key],
+    [config.limit, config.windowSeconds]
+  );
+  return {
+    allowed: allowed === 1,
+    remaining,
+    resetSeconds: ttl
+  };
+}
+
+// src/algorithms/leaky-bucket.ts
+var LEAKY_BUCKET_SCRIPT = `
+local capacity = tonumber(ARGV[1])
+local rate     = tonumber(ARGV[2])
+local cost     = tonumber(ARGV[3])
+
+local emissionInterval = 1 / rate
+local burstOffset = emissionInterval * capacity
+
+local time = redis.call('TIME')
+local now = tonumber(time[1]) + (tonumber(time[2]) / 1000000)
+
+local tat = tonumber(redis.call('GET', KEYS[1]))
+if tat == nil or tat < now then
+  tat = now
+end
+
+local newTat = tat + (emissionInterval * cost)
+local allowAt = newTat - burstOffset
+local allowed = allowAt <= now
+
+if allowed then
+  redis.call('SET', KEYS[1], newTat, 'EX', math.ceil(burstOffset + emissionInterval))
+  return { 1, "0" }
+else
+  -- Redis truncates Lua numbers to integers on return, silently dropping
+  -- the fractional part \u2014 return as a string to preserve sub-second precision.
+  return { 0, tostring(allowAt - now) }
+end
+`;
+async function checkLeakyBucket(store, identifier, config) {
+  const key = await buildKey(config.ruleName, "leakybucket", identifier);
+  const cost = config.cost ?? 1;
+  const [allowed, waitSecondsRaw] = await store.eval(
+    LEAKY_BUCKET_SCRIPT,
+    [key],
+    [config.capacity, config.rate, cost]
+  );
+  const waitSeconds = Number.parseFloat(waitSecondsRaw);
+  const isAllowed = allowed === 1;
+  return {
+    allowed: isAllowed,
+    resetSeconds: Math.ceil(waitSeconds),
+    retryAfterSeconds: isAllowed ? void 0 : Math.ceil(waitSeconds)
+  };
+}
+
+// src/algorithms/sliding-window.ts
+var SLIDING_WINDOW_SCRIPT = `
+local limit = tonumber(ARGV[1])
+local windowSeconds = tonumber(ARGV[2])
+
+local time = redis.call('TIME')
+local now = tonumber(time[1])
+
+local currentWindow = math.floor(now / windowSeconds)
+local previousWindow = currentWindow - 1
+
+local currentKey = KEYS[1] .. ':' .. currentWindow
+local previousKey = KEYS[1] .. ':' .. previousWindow
+
+local previousCount = tonumber(redis.call('GET', previousKey)) or 0
+local elapsedInWindow = now % windowSeconds
+local weight = (windowSeconds - elapsedInWindow) / windowSeconds
+
+local currentCount = redis.call('INCR', currentKey)
+if currentCount == 1 then
+  redis.call('EXPIRE', currentKey, windowSeconds * 2)
+end
+
+local estimatedTotal = (previousCount * weight) + currentCount
+local allowed = estimatedTotal <= limit
+
+if not allowed then
+  redis.call('DECR', currentKey)
+end
+
+local remaining = math.max(0, math.floor(limit - estimatedTotal))
+local resetSeconds = math.ceil(windowSeconds - elapsedInWindow)
+
+return { allowed and 1 or 0, remaining, resetSeconds }
+`;
+async function checkSlidingWindow(store, identifier, config) {
+  const key = await buildKey(config.ruleName, "slidingwindow", identifier);
+  const [allowed, remaining, resetSeconds] = await store.eval(SLIDING_WINDOW_SCRIPT, [key], [config.limit, config.windowSeconds]);
+  return {
+    allowed: allowed === 1,
+    remaining,
+    resetSeconds
+  };
+}
+
+// src/algorithms/token-bucket.ts
+var TOKEN_BUCKET_SCRIPT = `
+local capacity   = tonumber(ARGV[1])
+local refillRate = tonumber(ARGV[2])
+local cost       = tonumber(ARGV[3])
+
+local time = redis.call('TIME')
+local now = tonumber(time[1])
+
+local bucket = redis.call('HMGET', KEYS[1], 'tokens', 'lastRefill')
+local tokens = tonumber(bucket[1])
+local lastRefill = tonumber(bucket[2])
+
+if tokens == nil then
+  tokens = capacity
+  lastRefill = now
+end
+
+local elapsed = now - lastRefill
+tokens = math.min(capacity, tokens + (elapsed * refillRate))
+
+local allowed = tokens >= cost
+if allowed then
+  tokens = tokens - cost
+end
+
+redis.call('HMSET', KEYS[1], 'tokens', tokens, 'lastRefill', now)
+redis.call('EXPIRE', KEYS[1], math.ceil(capacity / refillRate))
+
+-- Redis truncates Lua numbers to integers on return, silently dropping
+-- the fractional part \u2014 return as a string to preserve partial-refill precision.
+return { allowed and 1 or 0, tostring(tokens) }
+`;
+async function checkTokenBucket(store, identifier, config) {
+  const key = await buildKey(config.ruleName, "tokenbucket", identifier);
+  const cost = config.cost ?? 1;
+  const [allowed, tokensRemainingRaw] = await store.eval(
+    TOKEN_BUCKET_SCRIPT,
+    [key],
+    [config.capacity, config.refillRate, cost]
+  );
+  const tokensRemaining = Number.parseFloat(tokensRemainingRaw);
+  const resetSeconds = Math.ceil(
+    (config.capacity - tokensRemaining) / config.refillRate
+  );
+  return {
+    allowed: allowed === 1,
+    remaining: tokensRemaining,
+    resetSeconds: Math.max(0, resetSeconds)
+  };
+}
+
+// src/headers.ts
+function buildRateLimitHeaders(limit, result, style = "draft-6") {
+  const headers = style === "draft-7" ? {
+    RateLimit: `limit=${limit}, remaining=${result.remaining ?? 0}, reset=${result.resetSeconds}`
+  } : {
+    "RateLimit-Limit": String(limit),
+    "RateLimit-Remaining": String(result.remaining ?? 0),
+    "RateLimit-Reset": String(result.resetSeconds)
+  };
+  if (result.retryAfterSeconds !== void 0) {
+    headers["Retry-After"] = String(result.retryAfterSeconds);
+  }
+  return headers;
+}
+
+// src/middleware.ts
+function getLimitValue(config) {
+  switch (config.algorithm) {
+    case "tokenBucket":
+    case "leakyBucket":
+      return config.capacity;
+    case "fixedWindow":
+    case "slidingWindow":
+      return config.limit;
+  }
+}
+async function runCheck(config, identifier) {
+  switch (config.algorithm) {
+    case "tokenBucket":
+      return checkTokenBucket(config.store, identifier, config);
+    case "fixedWindow":
+      return checkFixedWindow(config.store, identifier, config);
+    case "slidingWindow":
+      return checkSlidingWindow(config.store, identifier, config);
+    case "leakyBucket":
+      return checkLeakyBucket(config.store, identifier, config);
+  }
+}
+function rateLimiter(config) {
+  return (0, import_factory.createMiddleware)(async (c, next) => {
+    const identifier = config.identifier(c);
+    let result;
+    try {
+      result = await runCheck(config, identifier);
+    } catch {
+      if (config.onError === "fail-open") {
+        await next();
+        return;
+      }
+      c.status(503);
+      return c.json({ error: "Rate limiter unavailable" });
+    }
+    const headers = buildRateLimitHeaders(
+      getLimitValue(config),
+      result,
+      config.headerStyle
+    );
+    for (const [key, value] of Object.entries(headers)) {
+      c.header(key, value);
+    }
+    if (!result.allowed) {
+      if (config.message)
+        return config.message(c);
+      c.status(429);
+      return c.json({ error: "Too many requests" });
+    }
+    await next();
+  });
+}
+
+// src/store/redis-store.ts
+var RedisStore = class {
+  client;
+  definedCommands = /* @__PURE__ */ new Set();
+  constructor(options) {
+    this.client = options.client;
+  }
+  async eval(script, keys, args) {
+    const commandName = `limitwall_${hashScript(script)}`;
+    if (!this.definedCommands.has(commandName)) {
+      this.client.defineCommand(commandName, {
+        numberOfKeys: keys.length,
+        lua: script
+      });
+      this.definedCommands.add(commandName);
+    }
+    const result = await this.client[commandName](...keys, ...args.map(String));
+    return result;
+  }
+};
+function hashScript(script) {
+  let hash = 0;
+  for (let i = 0; i < script.length; i++) {
+    hash = (hash << 5) - hash + script.charCodeAt(i);
+    hash |= 0;
+  }
+  return Math.abs(hash).toString(36);
+}
+
+// src/store/upstash-store.ts
+var UpstashStore = class {
+  client;
+  constructor(options) {
+    this.client = options.client;
+  }
+  async eval(script, keys, args) {
+    const result = await this.client.eval(script, keys, args);
+    return result;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RedisStore,
+  UpstashStore,
+  rateLimiter
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/middleware.ts","../src/key.ts","../src/algorithms/fixed-window.ts","../src/algorithms/leaky-bucket.ts","../src/algorithms/sliding-window.ts","../src/algorithms/token-bucket.ts","../src/headers.ts","../src/store/redis-store.ts","../src/store/upstash-store.ts"],"sourcesContent":["/**\n * limitwall - rate limiting middleware for Hono, backed by Redis.\n * Supports fixed window, sliding window, token bucket, and leaky\n * bucket (GCRA) algorithms behind one config-driven middleware.\n */\n\nexport type { HeaderStyle } from \"./headers\";\nexport { rateLimiter } from \"./middleware\";\n\nexport type { RateLimiterConfig } from \"./middleware\";\nexport { RedisStore } from \"./store/redis-store\";\nexport type { RateLimitStore } from \"./store/types\";\n\nexport { UpstashStore } from \"./store/upstash-store\";\n\nexport type {\n  FixedWindowConfig,\n  LeakyBucketConfig,\n  RateLimitAlgorithmConfig,\n  RateLimitResult,\n  SlidingWindowConfig,\n  TokenBucketConfig,\n} from \"./types\";\n","import type { Context } from \"hono\";\n\nimport { createMiddleware } from \"hono/factory\";\n\nimport type { RateLimitStore } from \"./store/types\";\nimport type { RateLimitAlgorithmConfig, RateLimitResult } from \"./types\";\n\nimport { checkFixedWindow } from \"./algorithms/fixed-window\";\nimport { checkLeakyBucket } from \"./algorithms/leaky-bucket\";\nimport { checkSlidingWindow } from \"./algorithms/sliding-window\";\nimport { checkTokenBucket } from \"./algorithms/token-bucket\";\nimport { buildRateLimitHeaders, type HeaderStyle } from \"./headers\";\n\n/** Full config for `rateLimiter()`: one algorithm's config, plus shared options. */\nexport type RateLimiterConfig = RateLimitAlgorithmConfig & {\n  /** Extracts the identifier to rate limit by (IP, user ID, API key, etc.). */\n  identifier: (c: Context) => string;\n  store: RateLimitStore;\n  /** Required, explicit behavior when the store is unreachable — no silent default. */\n  onError: \"fail-open\" | \"fail-closed\";\n  headerStyle?: HeaderStyle;\n  /** Overrides the default 429 JSON body. */\n  message?: (c: Context) => Response;\n};\n\n/** Resolves the configured limit/capacity, regardless of which algorithm is active. */\nfunction getLimitValue(config: RateLimiterConfig): number {\n  switch (config.algorithm) {\n    case \"tokenBucket\":\n    case \"leakyBucket\":\n      return config.capacity;\n    case \"fixedWindow\":\n    case \"slidingWindow\":\n      return config.limit;\n  }\n}\n\n/** Runs the configured algorithm's check function. */\nasync function runCheck(\n  config: RateLimiterConfig,\n  identifier: string,\n): Promise<RateLimitResult> {\n  switch (config.algorithm) {\n    case \"tokenBucket\":\n      return checkTokenBucket(config.store, identifier, config);\n    case \"fixedWindow\":\n      return checkFixedWindow(config.store, identifier, config);\n    case \"slidingWindow\":\n      return checkSlidingWindow(config.store, identifier, config);\n    case \"leakyBucket\":\n      return checkLeakyBucket(config.store, identifier, config);\n  }\n}\n\n/** Creates a Hono rate-limiting middleware for the given config. */\nexport function rateLimiter(config: RateLimiterConfig) {\n  return createMiddleware(async (c, next) => {\n    const identifier = config.identifier(c);\n\n    let result: RateLimitResult;\n    try {\n      result = await runCheck(config, identifier);\n    }\n    catch {\n      // Store unreachable - do exactly what was explicitly configured.\n      if (config.onError === \"fail-open\") {\n        await next();\n        return;\n      }\n      c.status(503);\n      return c.json({ error: \"Rate limiter unavailable\" });\n    }\n\n    const headers = buildRateLimitHeaders(\n      getLimitValue(config),\n      result,\n      config.headerStyle,\n    );\n    for (const [key, value] of Object.entries(headers)) {\n      c.header(key, value);\n    }\n\n    if (!result.allowed) {\n      if (config.message)\n        return config.message(c);\n      c.status(429);\n      return c.json({ error: \"Too many requests\" });\n    }\n\n    await next();\n  });\n}\n","/**\n * Builds the Redis key for a given rule + algorithm + identifier.\n * The identifier is always hashed before being stored, so raw IPs,\n * emails, or user IDs never sit in Redis in plain text.\n *\n * Uses the Web Crypto API (`crypto.subtle`) instead of Node's\n * `node:crypto`, since Node's module doesn't exist on edge runtimes\n * like Cloudflare Workers - Web Crypto works identically everywhere.\n */\nexport async function buildKey(\n  ruleName: string,\n  algorithm: string,\n  identifier: string,\n): Promise<string> {\n  const hashed = await hashIdentifier(identifier);\n  return `ratelimit:${ruleName}:${algorithm}:${hashed}`;\n}\n\n/** SHA-256 hashes a string and returns it as lowercase hex. */\nasync function hashIdentifier(identifier: string): Promise<string> {\n  const encoded = new TextEncoder().encode(identifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", encoded);\n  return Array.from(new Uint8Array(digest))\n    .map(byte => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n","import type { RateLimitStore } from \"../store/types\";\nimport type { FixedWindowConfig, RateLimitResult } from \"../types\";\n\nimport { buildKey } from \"../key\";\n\n/**\n * Counts requests within a fixed time slot and resets when the slot's\n * TTL expires. Simplest algorithm; allows a burst right at the window\n * boundary - use sliding window if that's a problem for your use case.\n */\nconst FIXED_WINDOW_SCRIPT = `\nlocal limit = tonumber(ARGV[1])\nlocal windowSeconds = tonumber(ARGV[2])\n\nlocal current = redis.call('INCR', KEYS[1])\nif current == 1 then\n  redis.call('EXPIRE', KEYS[1], windowSeconds)\nend\n\nlocal ttl = redis.call('TTL', KEYS[1])\nlocal allowed = current <= limit\nlocal remaining = math.max(0, limit - current)\n\nreturn { allowed and 1 or 0, remaining, ttl }\n`;\n\n/** Runs a fixed window check for one identifier under one rule. */\nexport async function checkFixedWindow(\n  store: RateLimitStore,\n  identifier: string,\n  config: FixedWindowConfig,\n): Promise<RateLimitResult> {\n  const key = await buildKey(config.ruleName, \"fixedwindow\", identifier);\n\n  const [allowed, remaining, ttl] = await store.eval<[number, number, number]>(\n    FIXED_WINDOW_SCRIPT,\n    [key],\n    [config.limit, config.windowSeconds],\n  );\n\n  return {\n    allowed: allowed === 1,\n    remaining,\n    resetSeconds: ttl,\n  };\n}\n","import type { RateLimitStore } from \"../store/types\";\nimport type { LeakyBucketConfig, RateLimitResult } from \"../types\";\n\nimport { buildKey } from \"../key\";\n\n/**\n * Implements leaky bucket as GCRA (Generic Cell Rate Algorithm): tracks\n * one \"theoretical arrival time\" per identifier instead of a token\n * count, producing smooth, evenly-paced traffic rather than the bursty\n * traffic token bucket allows.\n */\nconst LEAKY_BUCKET_SCRIPT = `\nlocal capacity = tonumber(ARGV[1])\nlocal rate     = tonumber(ARGV[2])\nlocal cost     = tonumber(ARGV[3])\n\nlocal emissionInterval = 1 / rate\nlocal burstOffset = emissionInterval * capacity\n\nlocal time = redis.call('TIME')\nlocal now = tonumber(time[1]) + (tonumber(time[2]) / 1000000)\n\nlocal tat = tonumber(redis.call('GET', KEYS[1]))\nif tat == nil or tat < now then\n  tat = now\nend\n\nlocal newTat = tat + (emissionInterval * cost)\nlocal allowAt = newTat - burstOffset\nlocal allowed = allowAt <= now\n\nif allowed then\n  redis.call('SET', KEYS[1], newTat, 'EX', math.ceil(burstOffset + emissionInterval))\n  return { 1, \"0\" }\nelse\n  -- Redis truncates Lua numbers to integers on return, silently dropping\n  -- the fractional part — return as a string to preserve sub-second precision.\n  return { 0, tostring(allowAt - now) }\nend\n`;\n\n/** Runs a leaky bucket (GCRA) check for one identifier under one rule. */\nexport async function checkLeakyBucket(\n  store: RateLimitStore,\n  identifier: string,\n  config: LeakyBucketConfig,\n): Promise<RateLimitResult> {\n  const key = await buildKey(config.ruleName, \"leakybucket\", identifier);\n  const cost = config.cost ?? 1;\n\n  const [allowed, waitSecondsRaw] = await store.eval<[number, string]>(\n    LEAKY_BUCKET_SCRIPT,\n    [key],\n    [config.capacity, config.rate, cost],\n  );\n\n  const waitSeconds = Number.parseFloat(waitSecondsRaw);\n  const isAllowed = allowed === 1;\n\n  return {\n    allowed: isAllowed,\n    resetSeconds: Math.ceil(waitSeconds),\n    retryAfterSeconds: isAllowed ? undefined : Math.ceil(waitSeconds),\n  };\n}\n","import type { RateLimitStore } from \"../store/types\";\nimport type { RateLimitResult, SlidingWindowConfig } from \"../types\";\n\nimport { buildKey } from \"../key\";\n\n/**\n * Blends the current window's count with a weighted portion of the\n * previous window's count, so traffic can't double up right at a\n * fixed-window boundary.\n */\nconst SLIDING_WINDOW_SCRIPT = `\nlocal limit = tonumber(ARGV[1])\nlocal windowSeconds = tonumber(ARGV[2])\n\nlocal time = redis.call('TIME')\nlocal now = tonumber(time[1])\n\nlocal currentWindow = math.floor(now / windowSeconds)\nlocal previousWindow = currentWindow - 1\n\nlocal currentKey = KEYS[1] .. ':' .. currentWindow\nlocal previousKey = KEYS[1] .. ':' .. previousWindow\n\nlocal previousCount = tonumber(redis.call('GET', previousKey)) or 0\nlocal elapsedInWindow = now % windowSeconds\nlocal weight = (windowSeconds - elapsedInWindow) / windowSeconds\n\nlocal currentCount = redis.call('INCR', currentKey)\nif currentCount == 1 then\n  redis.call('EXPIRE', currentKey, windowSeconds * 2)\nend\n\nlocal estimatedTotal = (previousCount * weight) + currentCount\nlocal allowed = estimatedTotal <= limit\n\nif not allowed then\n  redis.call('DECR', currentKey)\nend\n\nlocal remaining = math.max(0, math.floor(limit - estimatedTotal))\nlocal resetSeconds = math.ceil(windowSeconds - elapsedInWindow)\n\nreturn { allowed and 1 or 0, remaining, resetSeconds }\n`;\n\n/** Runs a sliding window check for one identifier under one rule. */\nexport async function checkSlidingWindow(\n  store: RateLimitStore,\n  identifier: string,\n  config: SlidingWindowConfig,\n): Promise<RateLimitResult> {\n  const key = await buildKey(config.ruleName, \"slidingwindow\", identifier);\n\n  const [allowed, remaining, resetSeconds] = await store.eval<\n    [number, number, number]\n  >(SLIDING_WINDOW_SCRIPT, [key], [config.limit, config.windowSeconds]);\n\n  return {\n    allowed: allowed === 1,\n    remaining,\n    resetSeconds,\n  };\n}\n","import type { RateLimitStore } from \"../store/types\";\nimport type { RateLimitResult, TokenBucketConfig } from \"../types\";\n\nimport { buildKey } from \"../key\";\n\n/**\n * Lazily refills a bucket of tokens based on elapsed time, entirely\n * inside one atomic Redis operation. See the module README for the\n * plain-language walkthrough of the algorithm.\n */\nconst TOKEN_BUCKET_SCRIPT = `\nlocal capacity   = tonumber(ARGV[1])\nlocal refillRate = tonumber(ARGV[2])\nlocal cost       = tonumber(ARGV[3])\n\nlocal time = redis.call('TIME')\nlocal now = tonumber(time[1])\n\nlocal bucket = redis.call('HMGET', KEYS[1], 'tokens', 'lastRefill')\nlocal tokens = tonumber(bucket[1])\nlocal lastRefill = tonumber(bucket[2])\n\nif tokens == nil then\n  tokens = capacity\n  lastRefill = now\nend\n\nlocal elapsed = now - lastRefill\ntokens = math.min(capacity, tokens + (elapsed * refillRate))\n\nlocal allowed = tokens >= cost\nif allowed then\n  tokens = tokens - cost\nend\n\nredis.call('HMSET', KEYS[1], 'tokens', tokens, 'lastRefill', now)\nredis.call('EXPIRE', KEYS[1], math.ceil(capacity / refillRate))\n\n-- Redis truncates Lua numbers to integers on return, silently dropping\n-- the fractional part — return as a string to preserve partial-refill precision.\nreturn { allowed and 1 or 0, tostring(tokens) }\n`;\n\n/** Runs a token bucket check for one identifier under one rule. */\nexport async function checkTokenBucket(\n  store: RateLimitStore,\n  identifier: string,\n  config: TokenBucketConfig,\n): Promise<RateLimitResult> {\n  const key = await buildKey(config.ruleName, \"tokenbucket\", identifier);\n  const cost = config.cost ?? 1;\n\n  const [allowed, tokensRemainingRaw] = await store.eval<[number, string]>(\n    TOKEN_BUCKET_SCRIPT,\n    [key],\n    [config.capacity, config.refillRate, cost],\n  );\n\n  const tokensRemaining = Number.parseFloat(tokensRemainingRaw);\n\n  const resetSeconds = Math.ceil(\n    (config.capacity - tokensRemaining) / config.refillRate,\n  );\n\n  return {\n    allowed: allowed === 1,\n    remaining: tokensRemaining,\n    resetSeconds: Math.max(0, resetSeconds),\n  };\n}\n","import type { RateLimitResult } from \"./types\";\n\nexport type HeaderStyle = \"draft-6\" | \"draft-7\";\n\n/**\n * Builds response headers for a rate limit result, following one of the\n * two IETF RateLimit header drafts, plus the standard HTTP `Retry-After`\n * header when the result carries a `retryAfterSeconds` (leaky bucket).\n *\n * draft-6 uses three separate `RateLimit-*` headers.\n * draft-7 combines them into a single `RateLimit` header.\n */\nexport function buildRateLimitHeaders(\n  limit: number,\n  result: RateLimitResult,\n  style: HeaderStyle = \"draft-6\",\n): Record<string, string> {\n  const headers: Record<string, string>\n    = style === \"draft-7\"\n      ? {\n          RateLimit: `limit=${limit}, remaining=${\n            result.remaining ?? 0\n          }, reset=${result.resetSeconds}`,\n        }\n      : {\n          \"RateLimit-Limit\": String(limit),\n          \"RateLimit-Remaining\": String(result.remaining ?? 0),\n          \"RateLimit-Reset\": String(result.resetSeconds),\n        };\n\n  if (result.retryAfterSeconds !== undefined) {\n    headers[\"Retry-After\"] = String(result.retryAfterSeconds);\n  }\n\n  return headers;\n}\n","import type { Redis } from \"ioredis\";\n\nimport type { RateLimitStore } from \"./types\";\n\n/**\n * Store backend for regular Node.js servers, backed by a persistent\n * connection via `ioredis`. Not for edge runtimes — use UpstashStore\n * there instead, since ioredis depends on Node's networking APIs.\n *\n * Registers each unique script once via `defineCommand`, so ioredis\n * automatically uses the cached `EVALSHA` form after the first call\n * instead of resending the full script text every request.\n */\nexport class RedisStore implements RateLimitStore {\n  private readonly client: Redis;\n  private readonly definedCommands = new Set<string>();\n\n  constructor(options: { client: Redis }) {\n    this.client = options.client;\n  }\n\n  async eval<T>(\n    script: string,\n    keys: string[],\n    args: (string | number)[],\n  ): Promise<T> {\n    const commandName = `limitwall_${hashScript(script)}`;\n\n    if (!this.definedCommands.has(commandName)) {\n      this.client.defineCommand(commandName, {\n        numberOfKeys: keys.length,\n        lua: script,\n      });\n      this.definedCommands.add(commandName);\n    }\n\n    // @ts-expect-error - commandName is registered dynamically above\n    const result = await this.client[commandName](...keys, ...args.map(String));\n    return result as T;\n  }\n}\n\n/** Cheap, stable identifier for a script's text - not cryptographic, just needs to be unique per script. */\nfunction hashScript(script: string): string {\n  let hash = 0;\n  for (let i = 0; i < script.length; i++) {\n    hash = (hash << 5) - hash + script.charCodeAt(i);\n    hash |= 0;\n  }\n  return Math.abs(hash).toString(36);\n}\n","import type { Redis } from \"@upstash/redis\";\n\nimport type { RateLimitStore } from \"./types\";\n\n/**\n * Store backend for edge/serverless runtimes (Cloudflare Workers, Deno,\n * Vercel Edge) via Upstash's REST API, which needs no persistent\n * connection. Use RedisStore instead on regular Node servers.\n *\n * Note: unlike ioredis, the Upstash SDK has no built-in script-caching\n * mechanism equivalent to `defineCommand` — every call sends the full\n * script text over HTTP. This is an accepted tradeoff for edge runtimes,\n * not a bug: REST-over-HTTP has per-call overhead regardless.\n */\nexport class UpstashStore implements RateLimitStore {\n  private readonly client: Redis;\n\n  constructor(options: { client: Redis }) {\n    this.client = options.client;\n  }\n\n  async eval<T>(\n    script: string,\n    keys: string[],\n    args: (string | number)[],\n  ): Promise<T> {\n    const result = await this.client.eval(script, keys, args);\n    return result as T;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEA,qBAAiC;;;ACOjC,eAAsB,SACpB,UACA,WACA,YACiB;AACjB,QAAM,SAAS,MAAM,eAAe,UAAU;AAC9C,SAAO,aAAa,QAAQ,IAAI,SAAS,IAAI,MAAM;AACrD;AAGA,eAAe,eAAe,YAAqC;AACjE,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,UAAU;AACnD,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AAC5D,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC9C,KAAK,EAAE;AACZ;;;ACfA,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiB5B,eAAsB,iBACpB,OACA,YACA,QAC0B;AAC1B,QAAM,MAAM,MAAM,SAAS,OAAO,UAAU,eAAe,UAAU;AAErE,QAAM,CAAC,SAAS,WAAW,GAAG,IAAI,MAAM,MAAM;AAAA,IAC5C;AAAA,IACA,CAAC,GAAG;AAAA,IACJ,CAAC,OAAO,OAAO,OAAO,aAAa;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,SAAS,YAAY;AAAA,IACrB;AAAA,IACA,cAAc;AAAA,EAChB;AACF;;;AClCA,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+B5B,eAAsB,iBACpB,OACA,YACA,QAC0B;AAC1B,QAAM,MAAM,MAAM,SAAS,OAAO,UAAU,eAAe,UAAU;AACrE,QAAM,OAAO,OAAO,QAAQ;AAE5B,QAAM,CAAC,SAAS,cAAc,IAAI,MAAM,MAAM;AAAA,IAC5C;AAAA,IACA,CAAC,GAAG;AAAA,IACJ,CAAC,OAAO,UAAU,OAAO,MAAM,IAAI;AAAA,EACrC;AAEA,QAAM,cAAc,OAAO,WAAW,cAAc;AACpD,QAAM,YAAY,YAAY;AAE9B,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAc,KAAK,KAAK,WAAW;AAAA,IACnC,mBAAmB,YAAY,SAAY,KAAK,KAAK,WAAW;AAAA,EAClE;AACF;;;ACtDA,IAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoC9B,eAAsB,mBACpB,OACA,YACA,QAC0B;AAC1B,QAAM,MAAM,MAAM,SAAS,OAAO,UAAU,iBAAiB,UAAU;AAEvE,QAAM,CAAC,SAAS,WAAW,YAAY,IAAI,MAAM,MAAM,KAErD,uBAAuB,CAAC,GAAG,GAAG,CAAC,OAAO,OAAO,OAAO,aAAa,CAAC;AAEpE,SAAO;AAAA,IACL,SAAS,YAAY;AAAA,IACrB;AAAA,IACA;AAAA,EACF;AACF;;;ACpDA,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkC5B,eAAsB,iBACpB,OACA,YACA,QAC0B;AAC1B,QAAM,MAAM,MAAM,SAAS,OAAO,UAAU,eAAe,UAAU;AACrE,QAAM,OAAO,OAAO,QAAQ;AAE5B,QAAM,CAAC,SAAS,kBAAkB,IAAI,MAAM,MAAM;AAAA,IAChD;AAAA,IACA,CAAC,GAAG;AAAA,IACJ,CAAC,OAAO,UAAU,OAAO,YAAY,IAAI;AAAA,EAC3C;AAEA,QAAM,kBAAkB,OAAO,WAAW,kBAAkB;AAE5D,QAAM,eAAe,KAAK;AAAA,KACvB,OAAO,WAAW,mBAAmB,OAAO;AAAA,EAC/C;AAEA,SAAO;AAAA,IACL,SAAS,YAAY;AAAA,IACrB,WAAW;AAAA,IACX,cAAc,KAAK,IAAI,GAAG,YAAY;AAAA,EACxC;AACF;;;ACzDO,SAAS,sBACd,OACA,QACA,QAAqB,WACG;AACxB,QAAM,UACF,UAAU,YACR;AAAA,IACE,WAAW,SAAS,KAAK,eACvB,OAAO,aAAa,CACtB,WAAW,OAAO,YAAY;AAAA,EAChC,IACA;AAAA,IACE,mBAAmB,OAAO,KAAK;AAAA,IAC/B,uBAAuB,OAAO,OAAO,aAAa,CAAC;AAAA,IACnD,mBAAmB,OAAO,OAAO,YAAY;AAAA,EAC/C;AAEN,MAAI,OAAO,sBAAsB,QAAW;AAC1C,YAAQ,aAAa,IAAI,OAAO,OAAO,iBAAiB;AAAA,EAC1D;AAEA,SAAO;AACT;;;ANTA,SAAS,cAAc,QAAmC;AACxD,UAAQ,OAAO,WAAW;AAAA,IACxB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO;AAAA,EAClB;AACF;AAGA,eAAe,SACb,QACA,YAC0B;AAC1B,UAAQ,OAAO,WAAW;AAAA,IACxB,KAAK;AACH,aAAO,iBAAiB,OAAO,OAAO,YAAY,MAAM;AAAA,IAC1D,KAAK;AACH,aAAO,iBAAiB,OAAO,OAAO,YAAY,MAAM;AAAA,IAC1D,KAAK;AACH,aAAO,mBAAmB,OAAO,OAAO,YAAY,MAAM;AAAA,IAC5D,KAAK;AACH,aAAO,iBAAiB,OAAO,OAAO,YAAY,MAAM;AAAA,EAC5D;AACF;AAGO,SAAS,YAAY,QAA2B;AACrD,aAAO,iCAAiB,OAAO,GAAG,SAAS;AACzC,UAAM,aAAa,OAAO,WAAW,CAAC;AAEtC,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,QAAQ,UAAU;AAAA,IAC5C,QACM;AAEJ,UAAI,OAAO,YAAY,aAAa;AAClC,cAAM,KAAK;AACX;AAAA,MACF;AACA,QAAE,OAAO,GAAG;AACZ,aAAO,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAC;AAAA,IACrD;AAEA,UAAM,UAAU;AAAA,MACd,cAAc,MAAM;AAAA,MACpB;AAAA,MACA,OAAO;AAAA,IACT;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAE,OAAO,KAAK,KAAK;AAAA,IACrB;AAEA,QAAI,CAAC,OAAO,SAAS;AACnB,UAAI,OAAO;AACT,eAAO,OAAO,QAAQ,CAAC;AACzB,QAAE,OAAO,GAAG;AACZ,aAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,IAC9C;AAEA,UAAM,KAAK;AAAA,EACb,CAAC;AACH;;;AO9EO,IAAM,aAAN,MAA2C;AAAA,EAC/B;AAAA,EACA,kBAAkB,oBAAI,IAAY;AAAA,EAEnD,YAAY,SAA4B;AACtC,SAAK,SAAS,QAAQ;AAAA,EACxB;AAAA,EAEA,MAAM,KACJ,QACA,MACA,MACY;AACZ,UAAM,cAAc,aAAa,WAAW,MAAM,CAAC;AAEnD,QAAI,CAAC,KAAK,gBAAgB,IAAI,WAAW,GAAG;AAC1C,WAAK,OAAO,cAAc,aAAa;AAAA,QACrC,cAAc,KAAK;AAAA,QACnB,KAAK;AAAA,MACP,CAAC;AACD,WAAK,gBAAgB,IAAI,WAAW;AAAA,IACtC;AAGA,UAAM,SAAS,MAAM,KAAK,OAAO,WAAW,EAAE,GAAG,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC;AAC1E,WAAO;AAAA,EACT;AACF;AAGA,SAAS,WAAW,QAAwB;AAC1C,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAQ,QAAQ,KAAK,OAAO,OAAO,WAAW,CAAC;AAC/C,YAAQ;AAAA,EACV;AACA,SAAO,KAAK,IAAI,IAAI,EAAE,SAAS,EAAE;AACnC;;;ACpCO,IAAM,eAAN,MAA6C;AAAA,EACjC;AAAA,EAEjB,YAAY,SAA4B;AACtC,SAAK,SAAS,QAAQ;AAAA,EACxB;AAAA,EAEA,MAAM,KACJ,QACA,MACA,MACY;AACZ,UAAM,SAAS,MAAM,KAAK,OAAO,KAAK,QAAQ,MAAM,IAAI;AACxD,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,137 @@
+import * as hono from 'hono';
+import { Context } from 'hono';
+import { Redis } from 'ioredis';
+import { Redis as Redis$1 } from '@upstash/redis';
+
+/**
+ * Result of a single rate limit check, normalized across all algorithms.
+ *
+ * `remaining` and `resetSeconds` are the standard pair used for the
+ * RateLimit-* headers. `retryAfterSeconds` is only set by pacing-based
+ * algorithms (leaky bucket) on rejection, since GCRA answers "how long
+ * until you can try again" rather than "how many are left" - and maps
+ * directly onto the standard HTTP `Retry-After` header.
+ */
+interface RateLimitResult {
+    /** Whether this request is allowed to proceed. */
+    allowed: boolean;
+    /** Count remaining. Set by fixed window, sliding window, token bucket. */
+    remaining?: number;
+    /** Seconds until this key's limit meaningfully resets or refills. */
+    resetSeconds: number;
+    /** Seconds to wait before retrying. Only set by leaky bucket (GCRA) on rejection. */
+    retryAfterSeconds?: number;
+}
+/** Fields every algorithm's config shares. */
+interface BaseAlgorithmConfig {
+    /** Unique name for this rule; namespaces its Redis keys from other rules. */
+    ruleName: string;
+    /** Cost of a single request, in whatever unit the algorithm counts. Defaults to 1. */
+    cost?: number;
+}
+interface TokenBucketConfig extends BaseAlgorithmConfig {
+    algorithm: "tokenBucket";
+    /** Maximum tokens the bucket can hold (max burst size). */
+    capacity: number;
+    /** Tokens added back to the bucket per second. */
+    refillRate: number;
+}
+interface FixedWindowConfig extends BaseAlgorithmConfig {
+    algorithm: "fixedWindow";
+    /** Max requests allowed per window. */
+    limit: number;
+    /** Length of the window, in seconds. */
+    windowSeconds: number;
+}
+interface SlidingWindowConfig extends BaseAlgorithmConfig {
+    algorithm: "slidingWindow";
+    /** Max requests allowed per window. */
+    limit: number;
+    /** Length of the window, in seconds. */
+    windowSeconds: number;
+}
+interface LeakyBucketConfig extends BaseAlgorithmConfig {
+    algorithm: "leakyBucket";
+    /** Max burst size allowed above the steady rate. */
+    capacity: number;
+    /** Sustained requests allowed per second. */
+    rate: number;
+}
+/**
+ * Discriminated union of every algorithm's config, tagged by `algorithm`.
+ * Picking `algorithm: "tokenBucket"` requires `capacity` + `refillRate`;
+ * TypeScript rejects the wrong field set for whichever algorithm is chosen.
+ */
+type RateLimitAlgorithmConfig = TokenBucketConfig | FixedWindowConfig | SlidingWindowConfig | LeakyBucketConfig;
+
+type HeaderStyle = "draft-6" | "draft-7";
+
+/**
+ * The minimal contract every storage backend must satisfy.
+ *
+ * Deliberately thin: each algorithm owns its own atomic Lua script, so
+ * a store's only job is "run this script for me, atomically." This is
+ * what lets RedisStore (persistent connection) and UpstashStore (REST
+ * over HTTP) work behind the exact same interface.
+ */
+interface RateLimitStore {
+    /**
+     * Runs a Lua script atomically and returns its result.
+     * @param script The raw Lua script text.
+     * @param keys   Redis KEYS[] — the keys the script will touch.
+     * @param args   Redis ARGV[] — plain values the script needs.
+     */
+    eval: <T>(script: string, keys: string[], args: (string | number)[]) => Promise<T>;
+}
+
+/** Full config for `rateLimiter()`: one algorithm's config, plus shared options. */
+type RateLimiterConfig = RateLimitAlgorithmConfig & {
+    /** Extracts the identifier to rate limit by (IP, user ID, API key, etc.). */
+    identifier: (c: Context) => string;
+    store: RateLimitStore;
+    /** Required, explicit behavior when the store is unreachable — no silent default. */
+    onError: "fail-open" | "fail-closed";
+    headerStyle?: HeaderStyle;
+    /** Overrides the default 429 JSON body. */
+    message?: (c: Context) => Response;
+};
+/** Creates a Hono rate-limiting middleware for the given config. */
+declare function rateLimiter(config: RateLimiterConfig): hono.MiddlewareHandler<any, string, {}, Response>;
+
+/**
+ * Store backend for regular Node.js servers, backed by a persistent
+ * connection via `ioredis`. Not for edge runtimes — use UpstashStore
+ * there instead, since ioredis depends on Node's networking APIs.
+ *
+ * Registers each unique script once via `defineCommand`, so ioredis
+ * automatically uses the cached `EVALSHA` form after the first call
+ * instead of resending the full script text every request.
+ */
+declare class RedisStore implements RateLimitStore {
+    private readonly client;
+    private readonly definedCommands;
+    constructor(options: {
+        client: Redis;
+    });
+    eval<T>(script: string, keys: string[], args: (string | number)[]): Promise<T>;
+}
+
+/**
+ * Store backend for edge/serverless runtimes (Cloudflare Workers, Deno,
+ * Vercel Edge) via Upstash's REST API, which needs no persistent
+ * connection. Use RedisStore instead on regular Node servers.
+ *
+ * Note: unlike ioredis, the Upstash SDK has no built-in script-caching
+ * mechanism equivalent to `defineCommand` — every call sends the full
+ * script text over HTTP. This is an accepted tradeoff for edge runtimes,
+ * not a bug: REST-over-HTTP has per-call overhead regardless.
+ */
+declare class UpstashStore implements RateLimitStore {
+    private readonly client;
+    constructor(options: {
+        client: Redis$1;
+    });
+    eval<T>(script: string, keys: string[], args: (string | number)[]): Promise<T>;
+}
+
+export { type FixedWindowConfig, type HeaderStyle, type LeakyBucketConfig, type RateLimitAlgorithmConfig, type RateLimitResult, type RateLimitStore, type RateLimiterConfig, RedisStore, type SlidingWindowConfig, type TokenBucketConfig, UpstashStore, rateLimiter };

package/dist/index.d.ts

@@ -0,0 +1,137 @@
+import * as hono from 'hono';
+import { Context } from 'hono';
+import { Redis } from 'ioredis';
+import { Redis as Redis$1 } from '@upstash/redis';
+
+/**
+ * Result of a single rate limit check, normalized across all algorithms.
+ *
+ * `remaining` and `resetSeconds` are the standard pair used for the
+ * RateLimit-* headers. `retryAfterSeconds` is only set by pacing-based
+ * algorithms (leaky bucket) on rejection, since GCRA answers "how long
+ * until you can try again" rather than "how many are left" - and maps
+ * directly onto the standard HTTP `Retry-After` header.
+ */
+interface RateLimitResult {
+    /** Whether this request is allowed to proceed. */
+    allowed: boolean;
+    /** Count remaining. Set by fixed window, sliding window, token bucket. */
+    remaining?: number;
+    /** Seconds until this key's limit meaningfully resets or refills. */
+    resetSeconds: number;
+    /** Seconds to wait before retrying. Only set by leaky bucket (GCRA) on rejection. */
+    retryAfterSeconds?: number;
+}
+/** Fields every algorithm's config shares. */
+interface BaseAlgorithmConfig {
+    /** Unique name for this rule; namespaces its Redis keys from other rules. */
+    ruleName: string;
+    /** Cost of a single request, in whatever unit the algorithm counts. Defaults to 1. */
+    cost?: number;
+}
+interface TokenBucketConfig extends BaseAlgorithmConfig {
+    algorithm: "tokenBucket";
+    /** Maximum tokens the bucket can hold (max burst size). */
+    capacity: number;
+    /** Tokens added back to the bucket per second. */
+    refillRate: number;
+}
+interface FixedWindowConfig extends BaseAlgorithmConfig {
+    algorithm: "fixedWindow";
+    /** Max requests allowed per window. */
+    limit: number;
+    /** Length of the window, in seconds. */
+    windowSeconds: number;
+}
+interface SlidingWindowConfig extends BaseAlgorithmConfig {
+    algorithm: "slidingWindow";
+    /** Max requests allowed per window. */
+    limit: number;
+    /** Length of the window, in seconds. */
+    windowSeconds: number;
+}
+interface LeakyBucketConfig extends BaseAlgorithmConfig {
+    algorithm: "leakyBucket";
+    /** Max burst size allowed above the steady rate. */
+    capacity: number;
+    /** Sustained requests allowed per second. */
+    rate: number;
+}
+/**
+ * Discriminated union of every algorithm's config, tagged by `algorithm`.
+ * Picking `algorithm: "tokenBucket"` requires `capacity` + `refillRate`;
+ * TypeScript rejects the wrong field set for whichever algorithm is chosen.
+ */
+type RateLimitAlgorithmConfig = TokenBucketConfig | FixedWindowConfig | SlidingWindowConfig | LeakyBucketConfig;
+
+type HeaderStyle = "draft-6" | "draft-7";
+
+/**
+ * The minimal contract every storage backend must satisfy.
+ *
+ * Deliberately thin: each algorithm owns its own atomic Lua script, so
+ * a store's only job is "run this script for me, atomically." This is
+ * what lets RedisStore (persistent connection) and UpstashStore (REST
+ * over HTTP) work behind the exact same interface.
+ */
+interface RateLimitStore {
+    /**
+     * Runs a Lua script atomically and returns its result.
+     * @param script The raw Lua script text.
+     * @param keys   Redis KEYS[] — the keys the script will touch.
+     * @param args   Redis ARGV[] — plain values the script needs.
+     */
+    eval: <T>(script: string, keys: string[], args: (string | number)[]) => Promise<T>;
+}
+
+/** Full config for `rateLimiter()`: one algorithm's config, plus shared options. */
+type RateLimiterConfig = RateLimitAlgorithmConfig & {
+    /** Extracts the identifier to rate limit by (IP, user ID, API key, etc.). */
+    identifier: (c: Context) => string;
+    store: RateLimitStore;
+    /** Required, explicit behavior when the store is unreachable — no silent default. */
+    onError: "fail-open" | "fail-closed";
+    headerStyle?: HeaderStyle;
+    /** Overrides the default 429 JSON body. */
+    message?: (c: Context) => Response;
+};
+/** Creates a Hono rate-limiting middleware for the given config. */
+declare function rateLimiter(config: RateLimiterConfig): hono.MiddlewareHandler<any, string, {}, Response>;
+
+/**
+ * Store backend for regular Node.js servers, backed by a persistent
+ * connection via `ioredis`. Not for edge runtimes — use UpstashStore
+ * there instead, since ioredis depends on Node's networking APIs.
+ *
+ * Registers each unique script once via `defineCommand`, so ioredis
+ * automatically uses the cached `EVALSHA` form after the first call
+ * instead of resending the full script text every request.
+ */
+declare class RedisStore implements RateLimitStore {
+    private readonly client;
+    private readonly definedCommands;
+    constructor(options: {
+        client: Redis;
+    });
+    eval<T>(script: string, keys: string[], args: (string | number)[]): Promise<T>;
+}
+
+/**
+ * Store backend for edge/serverless runtimes (Cloudflare Workers, Deno,
+ * Vercel Edge) via Upstash's REST API, which needs no persistent
+ * connection. Use RedisStore instead on regular Node servers.
+ *
+ * Note: unlike ioredis, the Upstash SDK has no built-in script-caching
+ * mechanism equivalent to `defineCommand` — every call sends the full
+ * script text over HTTP. This is an accepted tradeoff for edge runtimes,
+ * not a bug: REST-over-HTTP has per-call overhead regardless.
+ */
+declare class UpstashStore implements RateLimitStore {
+    private readonly client;
+    constructor(options: {
+        client: Redis$1;
+    });
+    eval<T>(script: string, keys: string[], args: (string | number)[]): Promise<T>;
+}
+
+export { type FixedWindowConfig, type HeaderStyle, type LeakyBucketConfig, type RateLimitAlgorithmConfig, type RateLimitResult, type RateLimitStore, type RateLimiterConfig, RedisStore, type SlidingWindowConfig, type TokenBucketConfig, UpstashStore, rateLimiter };

package/dist/index.js

@@ -0,0 +1,304 @@
+// src/middleware.ts
+import { createMiddleware } from "hono/factory";
+
+// src/key.ts
+async function buildKey(ruleName, algorithm, identifier) {
+  const hashed = await hashIdentifier(identifier);
+  return `ratelimit:${ruleName}:${algorithm}:${hashed}`;
+}
+async function hashIdentifier(identifier) {
+  const encoded = new TextEncoder().encode(identifier);
+  const digest = await crypto.subtle.digest("SHA-256", encoded);
+  return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/algorithms/fixed-window.ts
+var FIXED_WINDOW_SCRIPT = `
+local limit = tonumber(ARGV[1])
+local windowSeconds = tonumber(ARGV[2])
+
+local current = redis.call('INCR', KEYS[1])
+if current == 1 then
+  redis.call('EXPIRE', KEYS[1], windowSeconds)
+end
+
+local ttl = redis.call('TTL', KEYS[1])
+local allowed = current <= limit
+local remaining = math.max(0, limit - current)
+
+return { allowed and 1 or 0, remaining, ttl }
+`;
+async function checkFixedWindow(store, identifier, config) {
+  const key = await buildKey(config.ruleName, "fixedwindow", identifier);
+  const [allowed, remaining, ttl] = await store.eval(
+    FIXED_WINDOW_SCRIPT,
+    [key],
+    [config.limit, config.windowSeconds]
+  );
+  return {
+    allowed: allowed === 1,
+    remaining,
+    resetSeconds: ttl
+  };
+}
+
+// src/algorithms/leaky-bucket.ts
+var LEAKY_BUCKET_SCRIPT = `
+local capacity = tonumber(ARGV[1])
+local rate     = tonumber(ARGV[2])
+local cost     = tonumber(ARGV[3])
+
+local emissionInterval = 1 / rate
+local burstOffset = emissionInterval * capacity
+
+local time = redis.call('TIME')
+local now = tonumber(time[1]) + (tonumber(time[2]) / 1000000)
+
+local tat = tonumber(redis.call('GET', KEYS[1]))
+if tat == nil or tat < now then
+  tat = now
+end
+
+local newTat = tat + (emissionInterval * cost)
+local allowAt = newTat - burstOffset
+local allowed = allowAt <= now
+
+if allowed then
+  redis.call('SET', KEYS[1], newTat, 'EX', math.ceil(burstOffset + emissionInterval))
+  return { 1, "0" }
+else
+  -- Redis truncates Lua numbers to integers on return, silently dropping
+  -- the fractional part \u2014 return as a string to preserve sub-second precision.
+  return { 0, tostring(allowAt - now) }
+end
+`;
+async function checkLeakyBucket(store, identifier, config) {
+  const key = await buildKey(config.ruleName, "leakybucket", identifier);
+  const cost = config.cost ?? 1;
+  const [allowed, waitSecondsRaw] = await store.eval(
+    LEAKY_BUCKET_SCRIPT,
+    [key],
+    [config.capacity, config.rate, cost]
+  );
+  const waitSeconds = Number.parseFloat(waitSecondsRaw);
+  const isAllowed = allowed === 1;
+  return {
+    allowed: isAllowed,
+    resetSeconds: Math.ceil(waitSeconds),
+    retryAfterSeconds: isAllowed ? void 0 : Math.ceil(waitSeconds)
+  };
+}
+
+// src/algorithms/sliding-window.ts
+var SLIDING_WINDOW_SCRIPT = `
+local limit = tonumber(ARGV[1])
+local windowSeconds = tonumber(ARGV[2])
+
+local time = redis.call('TIME')
+local now = tonumber(time[1])
+
+local currentWindow = math.floor(now / windowSeconds)
+local previousWindow = currentWindow - 1
+
+local currentKey = KEYS[1] .. ':' .. currentWindow
+local previousKey = KEYS[1] .. ':' .. previousWindow
+
+local previousCount = tonumber(redis.call('GET', previousKey)) or 0
+local elapsedInWindow = now % windowSeconds
+local weight = (windowSeconds - elapsedInWindow) / windowSeconds
+
+local currentCount = redis.call('INCR', currentKey)
+if currentCount == 1 then
+  redis.call('EXPIRE', currentKey, windowSeconds * 2)
+end
+
+local estimatedTotal = (previousCount * weight) + currentCount
+local allowed = estimatedTotal <= limit
+
+if not allowed then
+  redis.call('DECR', currentKey)
+end
+
+local remaining = math.max(0, math.floor(limit - estimatedTotal))
+local resetSeconds = math.ceil(windowSeconds - elapsedInWindow)
+
+return { allowed and 1 or 0, remaining, resetSeconds }
+`;
+async function checkSlidingWindow(store, identifier, config) {
+  const key = await buildKey(config.ruleName, "slidingwindow", identifier);
+  const [allowed, remaining, resetSeconds] = await store.eval(SLIDING_WINDOW_SCRIPT, [key], [config.limit, config.windowSeconds]);
+  return {
+    allowed: allowed === 1,
+    remaining,
+    resetSeconds
+  };
+}
+
+// src/algorithms/token-bucket.ts
+var TOKEN_BUCKET_SCRIPT = `
+local capacity   = tonumber(ARGV[1])
+local refillRate = tonumber(ARGV[2])
+local cost       = tonumber(ARGV[3])
+
+local time = redis.call('TIME')
+local now = tonumber(time[1])
+
+local bucket = redis.call('HMGET', KEYS[1], 'tokens', 'lastRefill')
+local tokens = tonumber(bucket[1])
+local lastRefill = tonumber(bucket[2])
+
+if tokens == nil then
+  tokens = capacity
+  lastRefill = now
+end
+
+local elapsed = now - lastRefill
+tokens = math.min(capacity, tokens + (elapsed * refillRate))
+
+local allowed = tokens >= cost
+if allowed then
+  tokens = tokens - cost
+end
+
+redis.call('HMSET', KEYS[1], 'tokens', tokens, 'lastRefill', now)
+redis.call('EXPIRE', KEYS[1], math.ceil(capacity / refillRate))
+
+-- Redis truncates Lua numbers to integers on return, silently dropping
+-- the fractional part \u2014 return as a string to preserve partial-refill precision.
+return { allowed and 1 or 0, tostring(tokens) }
+`;
+async function checkTokenBucket(store, identifier, config) {
+  const key = await buildKey(config.ruleName, "tokenbucket", identifier);
+  const cost = config.cost ?? 1;
+  const [allowed, tokensRemainingRaw] = await store.eval(
+    TOKEN_BUCKET_SCRIPT,
+    [key],
+    [config.capacity, config.refillRate, cost]
+  );
+  const tokensRemaining = Number.parseFloat(tokensRemainingRaw);
+  const resetSeconds = Math.ceil(
+    (config.capacity - tokensRemaining) / config.refillRate
+  );
+  return {
+    allowed: allowed === 1,
+    remaining: tokensRemaining,
+    resetSeconds: Math.max(0, resetSeconds)
+  };
+}
+
+// src/headers.ts
+function buildRateLimitHeaders(limit, result, style = "draft-6") {
+  const headers = style === "draft-7" ? {
+    RateLimit: `limit=${limit}, remaining=${result.remaining ?? 0}, reset=${result.resetSeconds}`
+  } : {
+    "RateLimit-Limit": String(limit),
+    "RateLimit-Remaining": String(result.remaining ?? 0),
+    "RateLimit-Reset": String(result.resetSeconds)
+  };
+  if (result.retryAfterSeconds !== void 0) {
+    headers["Retry-After"] = String(result.retryAfterSeconds);
+  }
+  return headers;
+}
+
+// src/middleware.ts
+function getLimitValue(config) {
+  switch (config.algorithm) {
+    case "tokenBucket":
+    case "leakyBucket":
+      return config.capacity;
+    case "fixedWindow":
+    case "slidingWindow":
+      return config.limit;
+  }
+}
+async function runCheck(config, identifier) {
+  switch (config.algorithm) {
+    case "tokenBucket":
+      return checkTokenBucket(config.store, identifier, config);
+    case "fixedWindow":
+      return checkFixedWindow(config.store, identifier, config);
+    case "slidingWindow":
+      return checkSlidingWindow(config.store, identifier, config);
+    case "leakyBucket":
+      return checkLeakyBucket(config.store, identifier, config);
+  }
+}
+function rateLimiter(config) {
+  return createMiddleware(async (c, next) => {
+    const identifier = config.identifier(c);
+    let result;
+    try {
+      result = await runCheck(config, identifier);
+    } catch {
+      if (config.onError === "fail-open") {
+        await next();
+        return;
+      }
+      c.status(503);
+      return c.json({ error: "Rate limiter unavailable" });
+    }
+    const headers = buildRateLimitHeaders(
+      getLimitValue(config),
+      result,
+      config.headerStyle
+    );
+    for (const [key, value] of Object.entries(headers)) {
+      c.header(key, value);
+    }
+    if (!result.allowed) {
+      if (config.message)
+        return config.message(c);
+      c.status(429);
+      return c.json({ error: "Too many requests" });
+    }
+    await next();
+  });
+}
+
+// src/store/redis-store.ts
+var RedisStore = class {
+  client;
+  definedCommands = /* @__PURE__ */ new Set();
+  constructor(options) {
+    this.client = options.client;
+  }
+  async eval(script, keys, args) {
+    const commandName = `limitwall_${hashScript(script)}`;
+    if (!this.definedCommands.has(commandName)) {
+      this.client.defineCommand(commandName, {
+        numberOfKeys: keys.length,
+        lua: script
+      });
+      this.definedCommands.add(commandName);
+    }
+    const result = await this.client[commandName](...keys, ...args.map(String));
+    return result;
+  }
+};
+function hashScript(script) {
+  let hash = 0;
+  for (let i = 0; i < script.length; i++) {
+    hash = (hash << 5) - hash + script.charCodeAt(i);
+    hash |= 0;
+  }
+  return Math.abs(hash).toString(36);
+}
+
+// src/store/upstash-store.ts
+var UpstashStore = class {
+  client;
+  constructor(options) {
+    this.client = options.client;
+  }
+  async eval(script, keys, args) {
+    const result = await this.client.eval(script, keys, args);
+    return result;
+  }
+};
+export {
+  RedisStore,
+  UpstashStore,
+  rateLimiter
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware.ts","../src/key.ts","../src/algorithms/fixed-window.ts","../src/algorithms/leaky-bucket.ts","../src/algorithms/sliding-window.ts","../src/algorithms/token-bucket.ts","../src/headers.ts","../src/store/redis-store.ts","../src/store/upstash-store.ts"],"sourcesContent":["import type { Context } from \"hono\";\n\nimport { createMiddleware } from \"hono/factory\";\n\nimport type { RateLimitStore } from \"./store/types\";\nimport type { RateLimitAlgorithmConfig, RateLimitResult } from \"./types\";\n\nimport { checkFixedWindow } from \"./algorithms/fixed-window\";\nimport { checkLeakyBucket } from \"./algorithms/leaky-bucket\";\nimport { checkSlidingWindow } from \"./algorithms/sliding-window\";\nimport { checkTokenBucket } from \"./algorithms/token-bucket\";\nimport { buildRateLimitHeaders, type HeaderStyle } from \"./headers\";\n\n/** Full config for `rateLimiter()`: one algorithm's config, plus shared options. */\nexport type RateLimiterConfig = RateLimitAlgorithmConfig & {\n  /** Extracts the identifier to rate limit by (IP, user ID, API key, etc.). */\n  identifier: (c: Context) => string;\n  store: RateLimitStore;\n  /** Required, explicit behavior when the store is unreachable — no silent default. */\n  onError: \"fail-open\" | \"fail-closed\";\n  headerStyle?: HeaderStyle;\n  /** Overrides the default 429 JSON body. */\n  message?: (c: Context) => Response;\n};\n\n/** Resolves the configured limit/capacity, regardless of which algorithm is active. */\nfunction getLimitValue(config: RateLimiterConfig): number {\n  switch (config.algorithm) {\n    case \"tokenBucket\":\n    case \"leakyBucket\":\n      return config.capacity;\n    case \"fixedWindow\":\n    case \"slidingWindow\":\n      return config.limit;\n  }\n}\n\n/** Runs the configured algorithm's check function. */\nasync function runCheck(\n  config: RateLimiterConfig,\n  identifier: string,\n): Promise<RateLimitResult> {\n  switch (config.algorithm) {\n    case \"tokenBucket\":\n      return checkTokenBucket(config.store, identifier, config);\n    case \"fixedWindow\":\n      return checkFixedWindow(config.store, identifier, config);\n    case \"slidingWindow\":\n      return checkSlidingWindow(config.store, identifier, config);\n    case \"leakyBucket\":\n      return checkLeakyBucket(config.store, identifier, config);\n  }\n}\n\n/** Creates a Hono rate-limiting middleware for the given config. */\nexport function rateLimiter(config: RateLimiterConfig) {\n  return createMiddleware(async (c, next) => {\n    const identifier = config.identifier(c);\n\n    let result: RateLimitResult;\n    try {\n      result = await runCheck(config, identifier);\n    }\n    catch {\n      // Store unreachable - do exactly what was explicitly configured.\n      if (config.onError === \"fail-open\") {\n        await next();\n        return;\n      }\n      c.status(503);\n      return c.json({ error: \"Rate limiter unavailable\" });\n    }\n\n    const headers = buildRateLimitHeaders(\n      getLimitValue(config),\n      result,\n      config.headerStyle,\n    );\n    for (const [key, value] of Object.entries(headers)) {\n      c.header(key, value);\n    }\n\n    if (!result.allowed) {\n      if (config.message)\n        return config.message(c);\n      c.status(429);\n      return c.json({ error: \"Too many requests\" });\n    }\n\n    await next();\n  });\n}\n","/**\n * Builds the Redis key for a given rule + algorithm + identifier.\n * The identifier is always hashed before being stored, so raw IPs,\n * emails, or user IDs never sit in Redis in plain text.\n *\n * Uses the Web Crypto API (`crypto.subtle`) instead of Node's\n * `node:crypto`, since Node's module doesn't exist on edge runtimes\n * like Cloudflare Workers - Web Crypto works identically everywhere.\n */\nexport async function buildKey(\n  ruleName: string,\n  algorithm: string,\n  identifier: string,\n): Promise<string> {\n  const hashed = await hashIdentifier(identifier);\n  return `ratelimit:${ruleName}:${algorithm}:${hashed}`;\n}\n\n/** SHA-256 hashes a string and returns it as lowercase hex. */\nasync function hashIdentifier(identifier: string): Promise<string> {\n  const encoded = new TextEncoder().encode(identifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", encoded);\n  return Array.from(new Uint8Array(digest))\n    .map(byte => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n","import type { RateLimitStore } from \"../store/types\";\nimport type { FixedWindowConfig, RateLimitResult } from \"../types\";\n\nimport { buildKey } from \"../key\";\n\n/**\n * Counts requests within a fixed time slot and resets when the slot's\n * TTL expires. Simplest algorithm; allows a burst right at the window\n * boundary - use sliding window if that's a problem for your use case.\n */\nconst FIXED_WINDOW_SCRIPT = `\nlocal limit = tonumber(ARGV[1])\nlocal windowSeconds = tonumber(ARGV[2])\n\nlocal current = redis.call('INCR', KEYS[1])\nif current == 1 then\n  redis.call('EXPIRE', KEYS[1], windowSeconds)\nend\n\nlocal ttl = redis.call('TTL', KEYS[1])\nlocal allowed = current <= limit\nlocal remaining = math.max(0, limit - current)\n\nreturn { allowed and 1 or 0, remaining, ttl }\n`;\n\n/** Runs a fixed window check for one identifier under one rule. */\nexport async function checkFixedWindow(\n  store: RateLimitStore,\n  identifier: string,\n  config: FixedWindowConfig,\n): Promise<RateLimitResult> {\n  const key = await buildKey(config.ruleName, \"fixedwindow\", identifier);\n\n  const [allowed, remaining, ttl] = await store.eval<[number, number, number]>(\n    FIXED_WINDOW_SCRIPT,\n    [key],\n    [config.limit, config.windowSeconds],\n  );\n\n  return {\n    allowed: allowed === 1,\n    remaining,\n    resetSeconds: ttl,\n  };\n}\n","import type { RateLimitStore } from \"../store/types\";\nimport type { LeakyBucketConfig, RateLimitResult } from \"../types\";\n\nimport { buildKey } from \"../key\";\n\n/**\n * Implements leaky bucket as GCRA (Generic Cell Rate Algorithm): tracks\n * one \"theoretical arrival time\" per identifier instead of a token\n * count, producing smooth, evenly-paced traffic rather than the bursty\n * traffic token bucket allows.\n */\nconst LEAKY_BUCKET_SCRIPT = `\nlocal capacity = tonumber(ARGV[1])\nlocal rate     = tonumber(ARGV[2])\nlocal cost     = tonumber(ARGV[3])\n\nlocal emissionInterval = 1 / rate\nlocal burstOffset = emissionInterval * capacity\n\nlocal time = redis.call('TIME')\nlocal now = tonumber(time[1]) + (tonumber(time[2]) / 1000000)\n\nlocal tat = tonumber(redis.call('GET', KEYS[1]))\nif tat == nil or tat < now then\n  tat = now\nend\n\nlocal newTat = tat + (emissionInterval * cost)\nlocal allowAt = newTat - burstOffset\nlocal allowed = allowAt <= now\n\nif allowed then\n  redis.call('SET', KEYS[1], newTat, 'EX', math.ceil(burstOffset + emissionInterval))\n  return { 1, \"0\" }\nelse\n  -- Redis truncates Lua numbers to integers on return, silently dropping\n  -- the fractional part — return as a string to preserve sub-second precision.\n  return { 0, tostring(allowAt - now) }\nend\n`;\n\n/** Runs a leaky bucket (GCRA) check for one identifier under one rule. */\nexport async function checkLeakyBucket(\n  store: RateLimitStore,\n  identifier: string,\n  config: LeakyBucketConfig,\n): Promise<RateLimitResult> {\n  const key = await buildKey(config.ruleName, \"leakybucket\", identifier);\n  const cost = config.cost ?? 1;\n\n  const [allowed, waitSecondsRaw] = await store.eval<[number, string]>(\n    LEAKY_BUCKET_SCRIPT,\n    [key],\n    [config.capacity, config.rate, cost],\n  );\n\n  const waitSeconds = Number.parseFloat(waitSecondsRaw);\n  const isAllowed = allowed === 1;\n\n  return {\n    allowed: isAllowed,\n    resetSeconds: Math.ceil(waitSeconds),\n    retryAfterSeconds: isAllowed ? undefined : Math.ceil(waitSeconds),\n  };\n}\n","import type { RateLimitStore } from \"../store/types\";\nimport type { RateLimitResult, SlidingWindowConfig } from \"../types\";\n\nimport { buildKey } from \"../key\";\n\n/**\n * Blends the current window's count with a weighted portion of the\n * previous window's count, so traffic can't double up right at a\n * fixed-window boundary.\n */\nconst SLIDING_WINDOW_SCRIPT = `\nlocal limit = tonumber(ARGV[1])\nlocal windowSeconds = tonumber(ARGV[2])\n\nlocal time = redis.call('TIME')\nlocal now = tonumber(time[1])\n\nlocal currentWindow = math.floor(now / windowSeconds)\nlocal previousWindow = currentWindow - 1\n\nlocal currentKey = KEYS[1] .. ':' .. currentWindow\nlocal previousKey = KEYS[1] .. ':' .. previousWindow\n\nlocal previousCount = tonumber(redis.call('GET', previousKey)) or 0\nlocal elapsedInWindow = now % windowSeconds\nlocal weight = (windowSeconds - elapsedInWindow) / windowSeconds\n\nlocal currentCount = redis.call('INCR', currentKey)\nif currentCount == 1 then\n  redis.call('EXPIRE', currentKey, windowSeconds * 2)\nend\n\nlocal estimatedTotal = (previousCount * weight) + currentCount\nlocal allowed = estimatedTotal <= limit\n\nif not allowed then\n  redis.call('DECR', currentKey)\nend\n\nlocal remaining = math.max(0, math.floor(limit - estimatedTotal))\nlocal resetSeconds = math.ceil(windowSeconds - elapsedInWindow)\n\nreturn { allowed and 1 or 0, remaining, resetSeconds }\n`;\n\n/** Runs a sliding window check for one identifier under one rule. */\nexport async function checkSlidingWindow(\n  store: RateLimitStore,\n  identifier: string,\n  config: SlidingWindowConfig,\n): Promise<RateLimitResult> {\n  const key = await buildKey(config.ruleName, \"slidingwindow\", identifier);\n\n  const [allowed, remaining, resetSeconds] = await store.eval<\n    [number, number, number]\n  >(SLIDING_WINDOW_SCRIPT, [key], [config.limit, config.windowSeconds]);\n\n  return {\n    allowed: allowed === 1,\n    remaining,\n    resetSeconds,\n  };\n}\n","import type { RateLimitStore } from \"../store/types\";\nimport type { RateLimitResult, TokenBucketConfig } from \"../types\";\n\nimport { buildKey } from \"../key\";\n\n/**\n * Lazily refills a bucket of tokens based on elapsed time, entirely\n * inside one atomic Redis operation. See the module README for the\n * plain-language walkthrough of the algorithm.\n */\nconst TOKEN_BUCKET_SCRIPT = `\nlocal capacity   = tonumber(ARGV[1])\nlocal refillRate = tonumber(ARGV[2])\nlocal cost       = tonumber(ARGV[3])\n\nlocal time = redis.call('TIME')\nlocal now = tonumber(time[1])\n\nlocal bucket = redis.call('HMGET', KEYS[1], 'tokens', 'lastRefill')\nlocal tokens = tonumber(bucket[1])\nlocal lastRefill = tonumber(bucket[2])\n\nif tokens == nil then\n  tokens = capacity\n  lastRefill = now\nend\n\nlocal elapsed = now - lastRefill\ntokens = math.min(capacity, tokens + (elapsed * refillRate))\n\nlocal allowed = tokens >= cost\nif allowed then\n  tokens = tokens - cost\nend\n\nredis.call('HMSET', KEYS[1], 'tokens', tokens, 'lastRefill', now)\nredis.call('EXPIRE', KEYS[1], math.ceil(capacity / refillRate))\n\n-- Redis truncates Lua numbers to integers on return, silently dropping\n-- the fractional part — return as a string to preserve partial-refill precision.\nreturn { allowed and 1 or 0, tostring(tokens) }\n`;\n\n/** Runs a token bucket check for one identifier under one rule. */\nexport async function checkTokenBucket(\n  store: RateLimitStore,\n  identifier: string,\n  config: TokenBucketConfig,\n): Promise<RateLimitResult> {\n  const key = await buildKey(config.ruleName, \"tokenbucket\", identifier);\n  const cost = config.cost ?? 1;\n\n  const [allowed, tokensRemainingRaw] = await store.eval<[number, string]>(\n    TOKEN_BUCKET_SCRIPT,\n    [key],\n    [config.capacity, config.refillRate, cost],\n  );\n\n  const tokensRemaining = Number.parseFloat(tokensRemainingRaw);\n\n  const resetSeconds = Math.ceil(\n    (config.capacity - tokensRemaining) / config.refillRate,\n  );\n\n  return {\n    allowed: allowed === 1,\n    remaining: tokensRemaining,\n    resetSeconds: Math.max(0, resetSeconds),\n  };\n}\n","import type { RateLimitResult } from \"./types\";\n\nexport type HeaderStyle = \"draft-6\" | \"draft-7\";\n\n/**\n * Builds response headers for a rate limit result, following one of the\n * two IETF RateLimit header drafts, plus the standard HTTP `Retry-After`\n * header when the result carries a `retryAfterSeconds` (leaky bucket).\n *\n * draft-6 uses three separate `RateLimit-*` headers.\n * draft-7 combines them into a single `RateLimit` header.\n */\nexport function buildRateLimitHeaders(\n  limit: number,\n  result: RateLimitResult,\n  style: HeaderStyle = \"draft-6\",\n): Record<string, string> {\n  const headers: Record<string, string>\n    = style === \"draft-7\"\n      ? {\n          RateLimit: `limit=${limit}, remaining=${\n            result.remaining ?? 0\n          }, reset=${result.resetSeconds}`,\n        }\n      : {\n          \"RateLimit-Limit\": String(limit),\n          \"RateLimit-Remaining\": String(result.remaining ?? 0),\n          \"RateLimit-Reset\": String(result.resetSeconds),\n        };\n\n  if (result.retryAfterSeconds !== undefined) {\n    headers[\"Retry-After\"] = String(result.retryAfterSeconds);\n  }\n\n  return headers;\n}\n","import type { Redis } from \"ioredis\";\n\nimport type { RateLimitStore } from \"./types\";\n\n/**\n * Store backend for regular Node.js servers, backed by a persistent\n * connection via `ioredis`. Not for edge runtimes — use UpstashStore\n * there instead, since ioredis depends on Node's networking APIs.\n *\n * Registers each unique script once via `defineCommand`, so ioredis\n * automatically uses the cached `EVALSHA` form after the first call\n * instead of resending the full script text every request.\n */\nexport class RedisStore implements RateLimitStore {\n  private readonly client: Redis;\n  private readonly definedCommands = new Set<string>();\n\n  constructor(options: { client: Redis }) {\n    this.client = options.client;\n  }\n\n  async eval<T>(\n    script: string,\n    keys: string[],\n    args: (string | number)[],\n  ): Promise<T> {\n    const commandName = `limitwall_${hashScript(script)}`;\n\n    if (!this.definedCommands.has(commandName)) {\n      this.client.defineCommand(commandName, {\n        numberOfKeys: keys.length,\n        lua: script,\n      });\n      this.definedCommands.add(commandName);\n    }\n\n    // @ts-expect-error - commandName is registered dynamically above\n    const result = await this.client[commandName](...keys, ...args.map(String));\n    return result as T;\n  }\n}\n\n/** Cheap, stable identifier for a script's text - not cryptographic, just needs to be unique per script. */\nfunction hashScript(script: string): string {\n  let hash = 0;\n  for (let i = 0; i < script.length; i++) {\n    hash = (hash << 5) - hash + script.charCodeAt(i);\n    hash |= 0;\n  }\n  return Math.abs(hash).toString(36);\n}\n","import type { Redis } from \"@upstash/redis\";\n\nimport type { RateLimitStore } from \"./types\";\n\n/**\n * Store backend for edge/serverless runtimes (Cloudflare Workers, Deno,\n * Vercel Edge) via Upstash's REST API, which needs no persistent\n * connection. Use RedisStore instead on regular Node servers.\n *\n * Note: unlike ioredis, the Upstash SDK has no built-in script-caching\n * mechanism equivalent to `defineCommand` — every call sends the full\n * script text over HTTP. This is an accepted tradeoff for edge runtimes,\n * not a bug: REST-over-HTTP has per-call overhead regardless.\n */\nexport class UpstashStore implements RateLimitStore {\n  private readonly client: Redis;\n\n  constructor(options: { client: Redis }) {\n    this.client = options.client;\n  }\n\n  async eval<T>(\n    script: string,\n    keys: string[],\n    args: (string | number)[],\n  ): Promise<T> {\n    const result = await this.client.eval(script, keys, args);\n    return result as T;\n  }\n}\n"],"mappings":";AAEA,SAAS,wBAAwB;;;ACOjC,eAAsB,SACpB,UACA,WACA,YACiB;AACjB,QAAM,SAAS,MAAM,eAAe,UAAU;AAC9C,SAAO,aAAa,QAAQ,IAAI,SAAS,IAAI,MAAM;AACrD;AAGA,eAAe,eAAe,YAAqC;AACjE,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,UAAU;AACnD,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AAC5D,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC9C,KAAK,EAAE;AACZ;;;ACfA,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiB5B,eAAsB,iBACpB,OACA,YACA,QAC0B;AAC1B,QAAM,MAAM,MAAM,SAAS,OAAO,UAAU,eAAe,UAAU;AAErE,QAAM,CAAC,SAAS,WAAW,GAAG,IAAI,MAAM,MAAM;AAAA,IAC5C;AAAA,IACA,CAAC,GAAG;AAAA,IACJ,CAAC,OAAO,OAAO,OAAO,aAAa;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,SAAS,YAAY;AAAA,IACrB;AAAA,IACA,cAAc;AAAA,EAChB;AACF;;;AClCA,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+B5B,eAAsB,iBACpB,OACA,YACA,QAC0B;AAC1B,QAAM,MAAM,MAAM,SAAS,OAAO,UAAU,eAAe,UAAU;AACrE,QAAM,OAAO,OAAO,QAAQ;AAE5B,QAAM,CAAC,SAAS,cAAc,IAAI,MAAM,MAAM;AAAA,IAC5C;AAAA,IACA,CAAC,GAAG;AAAA,IACJ,CAAC,OAAO,UAAU,OAAO,MAAM,IAAI;AAAA,EACrC;AAEA,QAAM,cAAc,OAAO,WAAW,cAAc;AACpD,QAAM,YAAY,YAAY;AAE9B,SAAO;AAAA,IACL,SAAS;AAAA,IACT,cAAc,KAAK,KAAK,WAAW;AAAA,IACnC,mBAAmB,YAAY,SAAY,KAAK,KAAK,WAAW;AAAA,EAClE;AACF;;;ACtDA,IAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoC9B,eAAsB,mBACpB,OACA,YACA,QAC0B;AAC1B,QAAM,MAAM,MAAM,SAAS,OAAO,UAAU,iBAAiB,UAAU;AAEvE,QAAM,CAAC,SAAS,WAAW,YAAY,IAAI,MAAM,MAAM,KAErD,uBAAuB,CAAC,GAAG,GAAG,CAAC,OAAO,OAAO,OAAO,aAAa,CAAC;AAEpE,SAAO;AAAA,IACL,SAAS,YAAY;AAAA,IACrB;AAAA,IACA;AAAA,EACF;AACF;;;ACpDA,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkC5B,eAAsB,iBACpB,OACA,YACA,QAC0B;AAC1B,QAAM,MAAM,MAAM,SAAS,OAAO,UAAU,eAAe,UAAU;AACrE,QAAM,OAAO,OAAO,QAAQ;AAE5B,QAAM,CAAC,SAAS,kBAAkB,IAAI,MAAM,MAAM;AAAA,IAChD;AAAA,IACA,CAAC,GAAG;AAAA,IACJ,CAAC,OAAO,UAAU,OAAO,YAAY,IAAI;AAAA,EAC3C;AAEA,QAAM,kBAAkB,OAAO,WAAW,kBAAkB;AAE5D,QAAM,eAAe,KAAK;AAAA,KACvB,OAAO,WAAW,mBAAmB,OAAO;AAAA,EAC/C;AAEA,SAAO;AAAA,IACL,SAAS,YAAY;AAAA,IACrB,WAAW;AAAA,IACX,cAAc,KAAK,IAAI,GAAG,YAAY;AAAA,EACxC;AACF;;;ACzDO,SAAS,sBACd,OACA,QACA,QAAqB,WACG;AACxB,QAAM,UACF,UAAU,YACR;AAAA,IACE,WAAW,SAAS,KAAK,eACvB,OAAO,aAAa,CACtB,WAAW,OAAO,YAAY;AAAA,EAChC,IACA;AAAA,IACE,mBAAmB,OAAO,KAAK;AAAA,IAC/B,uBAAuB,OAAO,OAAO,aAAa,CAAC;AAAA,IACnD,mBAAmB,OAAO,OAAO,YAAY;AAAA,EAC/C;AAEN,MAAI,OAAO,sBAAsB,QAAW;AAC1C,YAAQ,aAAa,IAAI,OAAO,OAAO,iBAAiB;AAAA,EAC1D;AAEA,SAAO;AACT;;;ANTA,SAAS,cAAc,QAAmC;AACxD,UAAQ,OAAO,WAAW;AAAA,IACxB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO;AAAA,EAClB;AACF;AAGA,eAAe,SACb,QACA,YAC0B;AAC1B,UAAQ,OAAO,WAAW;AAAA,IACxB,KAAK;AACH,aAAO,iBAAiB,OAAO,OAAO,YAAY,MAAM;AAAA,IAC1D,KAAK;AACH,aAAO,iBAAiB,OAAO,OAAO,YAAY,MAAM;AAAA,IAC1D,KAAK;AACH,aAAO,mBAAmB,OAAO,OAAO,YAAY,MAAM;AAAA,IAC5D,KAAK;AACH,aAAO,iBAAiB,OAAO,OAAO,YAAY,MAAM;AAAA,EAC5D;AACF;AAGO,SAAS,YAAY,QAA2B;AACrD,SAAO,iBAAiB,OAAO,GAAG,SAAS;AACzC,UAAM,aAAa,OAAO,WAAW,CAAC;AAEtC,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,QAAQ,UAAU;AAAA,IAC5C,QACM;AAEJ,UAAI,OAAO,YAAY,aAAa;AAClC,cAAM,KAAK;AACX;AAAA,MACF;AACA,QAAE,OAAO,GAAG;AACZ,aAAO,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAC;AAAA,IACrD;AAEA,UAAM,UAAU;AAAA,MACd,cAAc,MAAM;AAAA,MACpB;AAAA,MACA,OAAO;AAAA,IACT;AACA,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAE,OAAO,KAAK,KAAK;AAAA,IACrB;AAEA,QAAI,CAAC,OAAO,SAAS;AACnB,UAAI,OAAO;AACT,eAAO,OAAO,QAAQ,CAAC;AACzB,QAAE,OAAO,GAAG;AACZ,aAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,IAC9C;AAEA,UAAM,KAAK;AAAA,EACb,CAAC;AACH;;;AO9EO,IAAM,aAAN,MAA2C;AAAA,EAC/B;AAAA,EACA,kBAAkB,oBAAI,IAAY;AAAA,EAEnD,YAAY,SAA4B;AACtC,SAAK,SAAS,QAAQ;AAAA,EACxB;AAAA,EAEA,MAAM,KACJ,QACA,MACA,MACY;AACZ,UAAM,cAAc,aAAa,WAAW,MAAM,CAAC;AAEnD,QAAI,CAAC,KAAK,gBAAgB,IAAI,WAAW,GAAG;AAC1C,WAAK,OAAO,cAAc,aAAa;AAAA,QACrC,cAAc,KAAK;AAAA,QACnB,KAAK;AAAA,MACP,CAAC;AACD,WAAK,gBAAgB,IAAI,WAAW;AAAA,IACtC;AAGA,UAAM,SAAS,MAAM,KAAK,OAAO,WAAW,EAAE,GAAG,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC;AAC1E,WAAO;AAAA,EACT;AACF;AAGA,SAAS,WAAW,QAAwB;AAC1C,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAQ,QAAQ,KAAK,OAAO,OAAO,WAAW,CAAC;AAC/C,YAAQ;AAAA,EACV;AACA,SAAO,KAAK,IAAI,IAAI,EAAE,SAAS,EAAE;AACnC;;;ACpCO,IAAM,eAAN,MAA6C;AAAA,EACjC;AAAA,EAEjB,YAAY,SAA4B;AACtC,SAAK,SAAS,QAAQ;AAAA,EACxB;AAAA,EAEA,MAAM,KACJ,QACA,MACA,MACY;AACZ,UAAM,SAAS,MAAM,KAAK,OAAO,KAAK,QAAQ,MAAM,IAAI;AACxD,WAAO;AAAA,EACT;AACF;","names":[]}

package/package.json

@@ -0,0 +1,83 @@
+{
+  "name": "limitwall",
+  "type": "module",
+  "version": "0.1.0",
+  "description": "Rate limiting middleware for Hono, backed by Redis. Fixed window, sliding window, token bucket, and leaky bucket (GCRA) in one package",
+  "author": "Kevin Rozario",
+  "license": "MIT",
+  "homepage": "https://github.com/Kevin-Rozario/limitwall#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Kevin-Rozario/limitwall.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Kevin-Rozario/limitwall/issues"
+  },
+  "keywords": [
+    "hono",
+    "rate-limit",
+    "rate-limiter",
+    "redis",
+    "token-bucket",
+    "leaky-bucket",
+    "sliding-window",
+    "fixed-window",
+    "gcra",
+    "middleware"
+  ],
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "peerDependencies": {
+    "@upstash/redis": ">=1",
+    "hono": ">=4",
+    "ioredis": "^5"
+  },
+  "peerDependenciesMeta": {
+    "@upstash/redis": {
+      "optional": true
+    },
+    "ioredis": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@antfu/eslint-config": "^3",
+    "@types/node": "^22",
+    "@upstash/redis": "^1",
+    "eslint": "^9",
+    "eslint-plugin-format": "^2.0.1",
+    "hono": "^4",
+    "ioredis": "^5",
+    "testcontainers": "^10",
+    "tsup": "^8",
+    "typescript": "^5",
+    "vitest": "^2"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix"
+  }
+}