ratefall 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel Spatari
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,158 @@
+# ratefall
+
+[![npm](https://img.shields.io/npm/v/ratefall?style=flat-square&color=fb7185)](https://www.npmjs.com/package/ratefall)
+[![CI](https://img.shields.io/github/actions/workflow/status/thtsdaniel/ratefall/ci.yml?branch=main&style=flat-square)](https://github.com/thtsdaniel/ratefall/actions)
+[![license](https://img.shields.io/npm/l/ratefall?style=flat-square&color=fb7185)](./LICENSE)
+[![zero deps](https://img.shields.io/badge/dependencies-0-fb7185?style=flat-square)](./package.json)
+
+A rate limiter that just works: distributed (Redis) in production, in-memory in development, the same code in both. No store wiring, no `if (env) new Redis()` ternary in every app.
+
+```ts
+import { rateLimit } from 'ratefall'
+
+const limiter = rateLimit({ limit: 10, window: '10s' })
+
+const { success, remaining, retryAfter } = await limiter.limit(userId)
+if (!success) {
+  return new Response('slow down', { status: 429 })
+}
+```
+
+That snippet runs on an in-memory counter locally with zero config. Set two Upstash env vars in production and the identical code becomes distributed. Nothing else changes.
+
+## Why
+
+Every app needs rate limiting, and every app ends up with the same boilerplate: a Redis client in production, an in-memory shim for local dev, and a branch to pick between them. `ratefall` collapses that into one call. It resolves the store for you, keeps the API identical across environments, and warns loudly if you ever ship an un-shared limiter to production by accident.
+
+- **Zero dependencies.** Nothing pulled into your bundle.
+- **Edge and serverless ready.** The built-in Upstash store uses `fetch`, so it runs on Node 18+, Vercel Edge, and Cloudflare Workers.
+- **Bring your own store.** Pass an `@upstash/redis` or `ioredis` client, or a fully custom store.
+- **Two algorithms.** Fixed window (cheap) and sliding window (smooth).
+- **Typed end to end.** Written in TypeScript, ships ESM and CJS.
+
+## Install
+
+```bash
+npm install ratefall
+```
+
+## Same code, dev to prod
+
+`ratefall` picks a store in this order:
+
+1. an explicit `store` you pass
+2. an explicit `redis` client you pass
+3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment
+4. an in-memory fallback
+
+So local development needs no setup at all. For production, set the two Upstash env vars and you are done:
+
+```bash
+UPSTASH_REDIS_REST_URL=https://your-db.upstash.io
+UPSTASH_REDIS_REST_TOKEN=your-token
+```
+
+If a limiter ends up on the in-memory store while `NODE_ENV=production`, it prints a one-time warning, because per-instance limits across a multi-instance deploy are almost never what you want. Pass `silent: true` to suppress it when single-instance is intentional.
+
+## Bring your own store
+
+Already have a Redis client? Pass it. Anything with `incr`, `pexpire`, and `get` works, which covers both major clients with no adapter:
+
+```ts
+import { Redis } from '@upstash/redis'
+import { rateLimit } from 'ratefall'
+
+const limiter = rateLimit({
+  limit: 100,
+  window: '1m',
+  redis: Redis.fromEnv(),
+})
+```
+
+```ts
+import Redis from 'ioredis'
+import { rateLimit } from 'ratefall'
+
+const limiter = rateLimit({
+  limit: 100,
+  window: '1m',
+  redis: new Redis(process.env.REDIS_URL),
+})
+```
+
+## Algorithms
+
+```ts
+rateLimit({ limit: 10, window: '10s', algorithm: 'fixed-window' })   // default
+rateLimit({ limit: 10, window: '10s', algorithm: 'sliding-window' })
+```
+
+- **`fixed-window`** counts requests inside contiguous windows. One counter per window, very cheap. Can allow up to 2x the limit across a boundary in the worst case.
+- **`sliding-window`** weights the previous window by how far the current one has elapsed, smoothing out those boundary bursts. Two counters per identifier.
+
+## Use in a Next.js route handler
+
+```ts
+import { rateLimit } from 'ratefall'
+
+const limiter = rateLimit({ limit: 5, window: '1m' })
+
+export async function POST(req: Request) {
+  const ip = req.headers.get('x-forwarded-for') ?? 'anonymous'
+  const { success, limit, remaining, reset } = await limiter.limit(ip)
+
+  if (!success) {
+    return new Response('Too many requests', {
+      status: 429,
+      headers: {
+        'RateLimit-Limit': String(limit),
+        'RateLimit-Remaining': String(remaining),
+        'RateLimit-Reset': String(Math.ceil((reset - Date.now()) / 1000)),
+      },
+    })
+  }
+
+  // ... handle the request
+}
+```
+
+## API
+
+### `rateLimit(options)`
+
+| Option | Type | Default | Description |
+| --- | --- | --- | --- |
+| `limit` | `number` | required | Max requests allowed per window. |
+| `window` | `string \| number` | required | Window length. A number is milliseconds, or a string like `'10s'`, `'1m'`, `'2h'`, `'1d'`. |
+| `algorithm` | `'fixed-window' \| 'sliding-window'` | `'fixed-window'` | Limiting algorithm. |
+| `prefix` | `string` | `'ratefall'` | Key namespace, so multiple limiters can share one store. |
+| `store` | `Store` | auto | An explicit store. Overrides everything else. |
+| `redis` | `RedisLike` | auto | A Redis client. Overrides env auto-detection. |
+| `silent` | `boolean` | `false` | Suppress the production in-memory warning. |
+
+Returns a `RateLimiter` with one method:
+
+### `limiter.limit(identifier)`
+
+`identifier` is any string that scopes the limit: an IP, a user id, an API key. Returns a `RateLimitResult`:
+
+| Field | Type | Description |
+| --- | --- | --- |
+| `success` | `boolean` | Whether the request is allowed. |
+| `limit` | `number` | The configured ceiling. |
+| `remaining` | `number` | Requests left in the window (never below 0). |
+| `reset` | `number` | Epoch milliseconds when the window resets. |
+| `retryAfter` | `number` | Milliseconds until the next request is allowed. `0` when allowed. |
+
+## How it compares
+
+If you are all-in on Upstash and want every algorithm, analytics, and multi-region support, use [`@upstash/ratelimit`](https://github.com/upstash/ratelimit). `ratefall` is the smaller, zero-dependency option focused on one thing: the same limiter working from local dev to production without you wiring the store. It falls back to memory with no Redis at all, which `@upstash/ratelimit` does not.
+
+## Notes
+
+- The in-memory store is per-process. It is meant for local development and single-instance deploys, not shared production traffic.
+- Redis operations use `incr` plus a conditional `pexpire`. A Lua-based single-round-trip path is on the roadmap.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,250 @@
+'use strict';
+
+// src/algorithms/fixed-window.ts
+var fixedWindow = async (store, ctx, identifier, now) => {
+  const { limit, windowMs, prefix } = ctx;
+  const windowStart = Math.floor(now / windowMs) * windowMs;
+  const key = `${prefix}:${identifier}:${windowStart}`;
+  const count = await store.incr(key);
+  if (count === 1) await store.pexpire(key, windowMs);
+  const reset = windowStart + windowMs;
+  const success = count <= limit;
+  return {
+    success,
+    limit,
+    remaining: Math.max(0, limit - count),
+    reset,
+    retryAfter: success ? 0 : reset - now
+  };
+};
+
+// src/algorithms/sliding-window.ts
+var slidingWindow = async (store, ctx, identifier, now) => {
+  const { limit, windowMs, prefix } = ctx;
+  const currentStart = Math.floor(now / windowMs) * windowMs;
+  const previousStart = currentStart - windowMs;
+  const fraction = (now - currentStart) / windowMs;
+  const currentKey = `${prefix}:${identifier}:${currentStart}`;
+  const previousKey = `${prefix}:${identifier}:${previousStart}`;
+  const previousCount = await store.get(previousKey);
+  const currentCount = await store.incr(currentKey);
+  if (currentCount === 1) await store.pexpire(currentKey, windowMs * 2);
+  const weighted = previousCount * (1 - fraction) + currentCount;
+  const reset = currentStart + windowMs;
+  const success = weighted <= limit;
+  return {
+    success,
+    limit,
+    remaining: Math.max(0, Math.floor(limit - weighted)),
+    reset,
+    retryAfter: success ? 0 : reset - now
+  };
+};
+
+// src/stores/memory.ts
+var MemoryStore = class {
+  map = /* @__PURE__ */ new Map();
+  sweeper;
+  /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */
+  constructor(sweepMs = 3e4) {
+    if (sweepMs > 0 && typeof setInterval === "function") {
+      this.sweeper = setInterval(() => this.sweep(), sweepMs);
+      this.sweeper.unref?.();
+    }
+  }
+  live(key) {
+    const entry = this.map.get(key);
+    if (!entry) return void 0;
+    if (entry.expiresAt <= Date.now()) {
+      this.map.delete(key);
+      return void 0;
+    }
+    return entry;
+  }
+  async incr(key) {
+    const entry = this.live(key);
+    if (!entry) {
+      this.map.set(key, { count: 1, expiresAt: Number.POSITIVE_INFINITY });
+      return 1;
+    }
+    entry.count += 1;
+    return entry.count;
+  }
+  async pexpire(key, ms) {
+    const entry = this.live(key);
+    if (entry) entry.expiresAt = Date.now() + ms;
+  }
+  async get(key) {
+    return this.live(key)?.count ?? 0;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [key, entry] of this.map) {
+      if (entry.expiresAt <= now) this.map.delete(key);
+    }
+  }
+  /** Stop the background sweeper. Optional; the timer is unref'd. */
+  dispose() {
+    if (this.sweeper) clearInterval(this.sweeper);
+  }
+};
+
+// src/stores/redis.ts
+var RedisStore = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async incr(key) {
+    return this.client.incr(key);
+  }
+  async pexpire(key, ms) {
+    await this.client.pexpire(key, ms);
+  }
+  async get(key) {
+    const value = await this.client.get(key);
+    if (value == null) return 0;
+    const n = typeof value === "number" ? value : Number(value);
+    return Number.isFinite(n) ? n : 0;
+  }
+};
+
+// src/stores/upstash-rest.ts
+var UpstashRestStore = class {
+  url;
+  token;
+  fetchImpl;
+  constructor(options) {
+    this.url = options.url.replace(/\/$/, "");
+    this.token = options.token;
+    const f = options.fetch ?? globalThis.fetch;
+    if (typeof f !== "function") {
+      throw new Error("ratefall: no global fetch available; pass a `fetch` implementation to UpstashRestStore.");
+    }
+    this.fetchImpl = f;
+  }
+  async command(args) {
+    const res = await this.fetchImpl(this.url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(args.map(String))
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new Error(`ratefall: Upstash REST error ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ""}`);
+    }
+    const body = await res.json();
+    if (body.error) {
+      throw new Error(`ratefall: Upstash command failed - ${body.error}`);
+    }
+    return body.result;
+  }
+  async incr(key) {
+    return Number(await this.command(["INCR", key]));
+  }
+  async pexpire(key, ms) {
+    await this.command(["PEXPIRE", key, ms]);
+  }
+  async get(key) {
+    const result = await this.command(["GET", key]);
+    if (result == null) return 0;
+    const n = Number(result);
+    return Number.isFinite(n) ? n : 0;
+  }
+};
+
+// src/resolve-store.ts
+function readEnv(key) {
+  const env = globalThis.process?.env;
+  return env?.[key];
+}
+function resolveStore(options) {
+  if (options.store) {
+    return { store: options.store, distributed: true, source: "custom store" };
+  }
+  if (options.redis) {
+    return { store: new RedisStore(options.redis), distributed: true, source: "redis client" };
+  }
+  const url = readEnv("UPSTASH_REDIS_REST_URL");
+  const token = readEnv("UPSTASH_REDIS_REST_TOKEN");
+  if (url && token) {
+    return { store: new UpstashRestStore({ url, token }), distributed: true, source: "Upstash REST (env)" };
+  }
+  return { store: new MemoryStore(), distributed: false, source: "in-memory" };
+}
+function isProduction() {
+  return readEnv("NODE_ENV") === "production";
+}
+
+// src/window.ts
+var UNITS = {
+  ms: 1,
+  s: 1e3,
+  m: 6e4,
+  h: 36e5,
+  d: 864e5
+};
+var PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/;
+function parseWindow(window) {
+  if (typeof window === "number") {
+    if (!Number.isFinite(window) || window <= 0) {
+      throw new RangeError(`ratefall: window must be a positive number of milliseconds, got ${window}`);
+    }
+    return Math.floor(window);
+  }
+  const match = PATTERN.exec(window.trim());
+  if (!match) {
+    throw new TypeError(`ratefall: invalid window "${window}". Use a number of ms or a string like "10s", "1m", "2h".`);
+  }
+  const value = Number(match[1]);
+  const unit = UNITS[match[2]];
+  const ms = Math.floor(value * unit);
+  if (ms <= 0) {
+    throw new RangeError(`ratefall: window must be greater than 0, got "${window}".`);
+  }
+  return ms;
+}
+
+// src/rate-limit.ts
+var ALGORITHMS = {
+  "fixed-window": fixedWindow,
+  "sliding-window": slidingWindow
+};
+function rateLimit(options) {
+  const { limit, algorithm = "fixed-window", prefix = "ratefall", silent = false } = options;
+  if (!Number.isInteger(limit) || limit <= 0) {
+    throw new RangeError(`ratefall: limit must be a positive integer, got ${limit}`);
+  }
+  const run = ALGORITHMS[algorithm];
+  if (!run) {
+    throw new TypeError(`ratefall: unknown algorithm "${algorithm}". Use "fixed-window" or "sliding-window".`);
+  }
+  const windowMs = parseWindow(options.window);
+  const { store, distributed, source } = resolveStore(options);
+  if (!distributed && !silent && isProduction()) {
+    console.warn(
+      `ratefall: running with an in-memory store in production. Limits are per-instance and NOT shared. Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN or pass a \`redis\` client. Pass \`silent: true\` to hide this.`
+    );
+  }
+  const ctx = { limit, windowMs, prefix };
+  return {
+    async limit(identifier) {
+      if (!identifier) {
+        throw new TypeError("ratefall: identifier must be a non-empty string.");
+      }
+      return run(store, ctx, identifier, Date.now());
+    }
+  };
+}
+
+exports.MemoryStore = MemoryStore;
+exports.RedisStore = RedisStore;
+exports.UpstashRestStore = UpstashRestStore;
+exports.parseWindow = parseWindow;
+exports.rateLimit = rateLimit;
+exports.resolveStore = resolveStore;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/algorithms/fixed-window.ts","../src/algorithms/sliding-window.ts","../src/stores/memory.ts","../src/stores/redis.ts","../src/stores/upstash-rest.ts","../src/resolve-store.ts","../src/window.ts","../src/rate-limit.ts"],"names":[],"mappings":";;;AAOO,IAAM,WAAA,GAA2B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC7E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AACjD,EAAA,MAAM,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,WAAW,CAAA,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAClC,EAAA,IAAI,UAAU,CAAA,EAAG,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,QAAQ,CAAA;AAElD,EAAA,MAAM,QAAQ,WAAA,GAAc,QAAA;AAC5B,EAAA,MAAM,UAAU,KAAA,IAAS,KAAA;AACzB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,KAAK,CAAA;AAAA,IACpC,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;ACjBO,IAAM,aAAA,GAA6B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC/E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AAClD,EAAA,MAAM,gBAAgB,YAAA,GAAe,QAAA;AACrC,EAAA,MAAM,QAAA,GAAA,CAAY,MAAM,YAAA,IAAgB,QAAA;AAExC,EAAA,MAAM,aAAa,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,YAAY,CAAA,CAAA;AAC1D,EAAA,MAAM,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,aAAa,CAAA,CAAA;AAE5D,EAAA,MAAM,aAAA,GAAgB,MAAM,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AACjD,EAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA;AAEhD,EAAA,IAAI,iBAAiB,CAAA,EAAG,MAAM,MAAM,OAAA,CAAQ,UAAA,EAAY,WAAW,CAAC,CAAA;AAEpE,EAAA,MAAM,QAAA,GAAW,aAAA,IAAiB,CAAA,GAAI,QAAA,CAAA,GAAY,YAAA;AAClD,EAAA,MAAM,QAAQ,YAAA,GAAe,QAAA;AAC7B,EAAA,MAAM,UAAU,QAAA,IAAY,KAAA;AAC5B,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,KAAA,GAAQ,QAAQ,CAAC,CAAA;AAAA,IACnD,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;AClBO,IAAM,cAAN,MAAmC;AAAA,EACvB,GAAA,uBAAU,GAAA,EAAmB;AAAA,EAC7B,OAAA;AAAA;AAAA,EAGjB,WAAA,CAAY,UAAU,GAAA,EAAQ;AAC5B,IAAA,IAAI,OAAA,GAAU,CAAA,IAAK,OAAO,WAAA,KAAgB,UAAA,EAAY;AACpD,MAAA,IAAA,CAAK,UAAU,WAAA,CAAY,MAAM,IAAA,CAAK,KAAA,IAAS,OAAO,CAAA;AAEtD,MAAA,IAAA,CAAK,QAAQ,KAAA,IAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEQ,KAAK,GAAA,EAAgC;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,EAAG;AACjC,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AACnB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO;AAEV,MAAA,IAAA,CAAK,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,OAAO,CAAA,EAAG,SAAA,EAAW,MAAA,CAAO,iBAAA,EAAmB,CAAA;AACnE,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,KAAA,EAAO,KAAA,CAAM,SAAA,GAAY,IAAA,CAAK,KAAI,GAAI,EAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAG,KAAA,IAAS,CAAA;AAAA,EAClC;AAAA,EAEQ,KAAA,GAAc;AACpB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAK,GAAA,EAAK;AACnC,MAAA,IAAI,MAAM,SAAA,IAAa,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AAAA,IACjD;AAAA,EACF;AAAA;AAAA,EAGA,OAAA,GAAgB;AACd,IAAA,IAAI,IAAA,CAAK,OAAA,EAAS,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9C;AACF;;;AC7DO,IAAM,aAAN,MAAkC;AAAA,EACvC,YAA6B,MAAA,EAAmB;AAAnB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAoB;AAAA,EAApB,MAAA;AAAA,EAE7B,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,IAAI,GAAG,CAAA;AACvC,IAAA,IAAI,KAAA,IAAS,MAAM,OAAO,CAAA;AAC1B,IAAA,MAAM,IAAI,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAK,CAAA;AAC1D,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,EAClC;AACF;;;ACTO,IAAM,mBAAN,MAAwC;AAAA,EAC5B,GAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EAEjB,YAAY,OAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxC,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AACrB,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AACtC,IAAA,IAAI,OAAO,MAAM,UAAA,EAAY;AAC3B,MAAA,MAAM,IAAI,MAAM,yFAAyF,CAAA;AAAA,IAC3G;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AAAA,EACnB;AAAA,EAEA,MAAc,QAAQ,IAAA,EAA6C;AACjE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,GAAA,EAAK;AAAA,MACzC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,QACnC,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAC;AAAA,KACtC,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,SAAS,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC9C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,EAAG,MAAA,GAAS,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,IAC/G;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,MAAA,CAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAC,CAAA;AAAA,EACjD;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAK,OAAA,CAAQ,CAAC,SAAA,EAAW,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,QAAQ,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAC9C,IAAA,IAAI,MAAA,IAAU,MAAM,OAAO,CAAA;AAC3B,IAAA,MAAM,CAAA,GAAI,OAAO,MAAM,CAAA;AACvB,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,EAClC;AACF;;;AClDA,SAAS,QAAQ,GAAA,EAAiC;AAChD,EAAA,MAAM,GAAA,GAAO,WAA0E,OAAA,EAAS,GAAA;AAChG,EAAA,OAAO,MAAM,GAAG,CAAA;AAClB;AASO,SAAS,aAAa,OAAA,EAA0C;AACrE,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,WAAA,EAAa,IAAA,EAAM,QAAQ,cAAA,EAAe;AAAA,EAC3E;AAEA,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,UAAA,CAAW,OAAA,CAAQ,KAAK,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,cAAA,EAAe;AAAA,EAC3F;AAEA,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAQ,0BAA0B,CAAA;AAChD,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,oBAAA,EAAqB;AAAA,EACxG;AAEA,EAAA,OAAO,EAAE,OAAO,IAAI,WAAA,IAAe,WAAA,EAAa,KAAA,EAAO,QAAQ,WAAA,EAAY;AAC7E;AAGO,SAAS,YAAA,GAAwB;AACtC,EAAA,OAAO,OAAA,CAAQ,UAAU,CAAA,KAAM,YAAA;AACjC;;;AC9CA,IAAM,KAAA,GAAgC;AAAA,EACpC,EAAA,EAAI,CAAA;AAAA,EACJ,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,IAAA;AAAA,EACH,CAAA,EAAG;AACL,CAAA;AAEA,IAAM,OAAA,GAAU,kCAAA;AAMT,SAAS,YAAY,MAAA,EAAiC;AAC3D,EAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,UAAU,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gEAAA,EAAmE,MAAM,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,0BAAA,EAA6B,MAAM,CAAA,yDAAA,CAA2D,CAAA;AAAA,EACpH;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAC,CAAW,CAAA;AACrC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,IAAI,CAAA;AAClC,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,8CAAA,EAAiD,MAAM,CAAA,EAAA,CAAI,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,EAAA;AACT;;;AC3BA,IAAM,UAAA,GAA0C;AAAA,EAC9C,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB;AACpB,CAAA;AAYO,SAAS,UAAU,OAAA,EAAwC;AAChE,EAAA,MAAM,EAAE,OAAO,SAAA,GAAY,cAAA,EAAgB,SAAS,UAAA,EAAY,MAAA,GAAS,OAAM,GAAI,OAAA;AAEnF,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gDAAA,EAAmD,KAAK,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,WAAW,SAAS,CAAA;AAChC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,6BAAA,EAAgC,SAAS,CAAA,0CAAA,CAA4C,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AAC3C,EAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAO,GAAI,aAAa,OAAO,CAAA;AAE3D,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,MAAA,IAAU,cAAa,EAAG;AAG7C,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,sNAAA;AAAA,KAEF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAwB,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO;AAExD,EAAA,OAAO;AAAA,IACL,MAAM,MAAM,UAAA,EAAoB;AAC9B,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,MAAM,IAAI,UAAU,kDAAkD,CAAA;AAAA,MACxE;AACA,MAAA,OAAO,IAAI,KAAA,EAAO,GAAA,EAAK,UAAA,EAAY,IAAA,CAAK,KAAK,CAAA;AAAA,IAC/C;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["import type { AlgorithmFn } from './index.js'\n\n/**\n * Fixed-window counter. Divides time into contiguous windows of `windowMs` and\n * counts requests per window. Simple and cheap (one counter per window), at the\n * cost of allowing up to 2x `limit` across a window boundary in the worst case.\n */\nexport const fixedWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const windowStart = Math.floor(now / windowMs) * windowMs\n  const key = `${prefix}:${identifier}:${windowStart}`\n\n  const count = await store.incr(key)\n  if (count === 1) await store.pexpire(key, windowMs)\n\n  const reset = windowStart + windowMs\n  const success = count <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, limit - count),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { AlgorithmFn } from './index.js'\n\n/**\n * Sliding-window counter. Weights the previous window's count by how far the\n * current window has elapsed and adds the current count, smoothing out the\n * boundary bursts that fixed-window allows. Uses two counters per identifier.\n */\nexport const slidingWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const currentStart = Math.floor(now / windowMs) * windowMs\n  const previousStart = currentStart - windowMs\n  const fraction = (now - currentStart) / windowMs // 0..1 through the current window\n\n  const currentKey = `${prefix}:${identifier}:${currentStart}`\n  const previousKey = `${prefix}:${identifier}:${previousStart}`\n\n  const previousCount = await store.get(previousKey)\n  const currentCount = await store.incr(currentKey)\n  // Keep the counter alive long enough to still be read as \"previous\" next window.\n  if (currentCount === 1) await store.pexpire(currentKey, windowMs * 2)\n\n  const weighted = previousCount * (1 - fraction) + currentCount\n  const reset = currentStart + windowMs\n  const success = weighted <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, Math.floor(limit - weighted)),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { Store } from '../types.js'\n\ninterface Entry {\n  count: number\n  expiresAt: number\n}\n\n/**\n * In-process counter store. Used as the automatic fallback when no Redis is\n * configured. State is per-instance and not shared across processes, so it is\n * meant for local development and single-instance deployments, not distributed\n * production traffic.\n */\nexport class MemoryStore implements Store {\n  private readonly map = new Map<string, Entry>()\n  private readonly sweeper: ReturnType<typeof setInterval> | undefined\n\n  /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */\n  constructor(sweepMs = 30_000) {\n    if (sweepMs > 0 && typeof setInterval === 'function') {\n      this.sweeper = setInterval(() => this.sweep(), sweepMs)\n      // Never keep the event loop alive for cleanup alone.\n      this.sweeper.unref?.()\n    }\n  }\n\n  private live(key: string): Entry | undefined {\n    const entry = this.map.get(key)\n    if (!entry) return undefined\n    if (entry.expiresAt <= Date.now()) {\n      this.map.delete(key)\n      return undefined\n    }\n    return entry\n  }\n\n  async incr(key: string): Promise<number> {\n    const entry = this.live(key)\n    if (!entry) {\n      // Default to no expiry; pexpire is expected to follow on the first hit.\n      this.map.set(key, { count: 1, expiresAt: Number.POSITIVE_INFINITY })\n      return 1\n    }\n    entry.count += 1\n    return entry.count\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    const entry = this.live(key)\n    if (entry) entry.expiresAt = Date.now() + ms\n  }\n\n  async get(key: string): Promise<number> {\n    return this.live(key)?.count ?? 0\n  }\n\n  private sweep(): void {\n    const now = Date.now()\n    for (const [key, entry] of this.map) {\n      if (entry.expiresAt <= now) this.map.delete(key)\n    }\n  }\n\n  /** Stop the background sweeper. Optional; the timer is unref'd. */\n  dispose(): void {\n    if (this.sweeper) clearInterval(this.sweeper)\n  }\n}\n","import type { RedisLike, Store } from '../types.js'\n\n/**\n * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`\n * and `ioredis` qualify) to the {@link Store} interface.\n */\nexport class RedisStore implements Store {\n  constructor(private readonly client: RedisLike) {}\n\n  async incr(key: string): Promise<number> {\n    return this.client.incr(key)\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.client.pexpire(key, ms)\n  }\n\n  async get(key: string): Promise<number> {\n    const value = await this.client.get(key)\n    if (value == null) return 0\n    const n = typeof value === 'number' ? value : Number(value)\n    return Number.isFinite(n) ? n : 0\n  }\n}\n","import type { Store } from '../types.js'\n\nexport interface UpstashRestOptions {\n  url: string\n  token: string\n  /** Custom fetch implementation. Defaults to the global `fetch`. */\n  fetch?: typeof fetch\n}\n\n/**\n * Zero-dependency store backed by the Upstash Redis REST API. Uses `fetch`, so\n * it runs anywhere the runtime provides one (Node 18+, edge, workers) without\n * pulling in a Redis client. This is what env auto-detection constructs.\n */\nexport class UpstashRestStore implements Store {\n  private readonly url: string\n  private readonly token: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: UpstashRestOptions) {\n    this.url = options.url.replace(/\\/$/, '')\n    this.token = options.token\n    const f = options.fetch ?? globalThis.fetch\n    if (typeof f !== 'function') {\n      throw new Error('ratefall: no global fetch available; pass a `fetch` implementation to UpstashRestStore.')\n    }\n    this.fetchImpl = f\n  }\n\n  private async command(args: (string | number)[]): Promise<unknown> {\n    const res = await this.fetchImpl(this.url, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.token}`,\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(args.map(String)),\n    })\n    if (!res.ok) {\n      const detail = await res.text().catch(() => '')\n      throw new Error(`ratefall: Upstash REST error ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ''}`)\n    }\n    const body = (await res.json()) as { result?: unknown; error?: string }\n    if (body.error) {\n      throw new Error(`ratefall: Upstash command failed - ${body.error}`)\n    }\n    return body.result\n  }\n\n  async incr(key: string): Promise<number> {\n    return Number(await this.command(['INCR', key]))\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.command(['PEXPIRE', key, ms])\n  }\n\n  async get(key: string): Promise<number> {\n    const result = await this.command(['GET', key])\n    if (result == null) return 0\n    const n = Number(result)\n    return Number.isFinite(n) ? n : 0\n  }\n}\n","import type { RateLimitOptions, Store } from './types.js'\nimport { MemoryStore } from './stores/memory.js'\nimport { RedisStore } from './stores/redis.js'\nimport { UpstashRestStore } from './stores/upstash-rest.js'\n\nexport interface ResolvedStore {\n  store: Store\n  /** Whether the store is shared across processes (Redis) vs per-instance (memory). */\n  distributed: boolean\n  /** Human-readable source, for the dev warning. */\n  source: string\n}\n\nfunction readEnv(key: string): string | undefined {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env\n  return env?.[key]\n}\n\n/**\n * Decide which store to use, in priority order:\n * 1. an explicit `store`\n * 2. an explicit `redis` client\n * 3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment\n * 4. in-memory fallback\n */\nexport function resolveStore(options: RateLimitOptions): ResolvedStore {\n  if (options.store) {\n    return { store: options.store, distributed: true, source: 'custom store' }\n  }\n\n  if (options.redis) {\n    return { store: new RedisStore(options.redis), distributed: true, source: 'redis client' }\n  }\n\n  const url = readEnv('UPSTASH_REDIS_REST_URL')\n  const token = readEnv('UPSTASH_REDIS_REST_TOKEN')\n  if (url && token) {\n    return { store: new UpstashRestStore({ url, token }), distributed: true, source: 'Upstash REST (env)' }\n  }\n\n  return { store: new MemoryStore(), distributed: false, source: 'in-memory' }\n}\n\n/** True when the runtime looks like a production deployment. */\nexport function isProduction(): boolean {\n  return readEnv('NODE_ENV') === 'production'\n}\n","const UNITS: Record<string, number> = {\n  ms: 1,\n  s: 1000,\n  m: 60_000,\n  h: 3_600_000,\n  d: 86_400_000,\n}\n\nconst PATTERN = /^(\\d+(?:\\.\\d+)?)\\s*(ms|s|m|h|d)$/\n\n/**\n * Normalize a window into milliseconds. Accepts a raw millisecond number or a\n * duration string like `'500ms'`, `'10s'`, `'1m'`, `'2h'`, `'1d'`.\n */\nexport function parseWindow(window: string | number): number {\n  if (typeof window === 'number') {\n    if (!Number.isFinite(window) || window <= 0) {\n      throw new RangeError(`ratefall: window must be a positive number of milliseconds, got ${window}`)\n    }\n    return Math.floor(window)\n  }\n\n  const match = PATTERN.exec(window.trim())\n  if (!match) {\n    throw new TypeError(`ratefall: invalid window \"${window}\". Use a number of ms or a string like \"10s\", \"1m\", \"2h\".`)\n  }\n\n  const value = Number(match[1])\n  const unit = UNITS[match[2] as string] as number\n  const ms = Math.floor(value * unit)\n  if (ms <= 0) {\n    throw new RangeError(`ratefall: window must be greater than 0, got \"${window}\".`)\n  }\n  return ms\n}\n","import type { AlgorithmContext, AlgorithmFn } from './algorithms/index.js'\nimport { fixedWindow } from './algorithms/fixed-window.js'\nimport { slidingWindow } from './algorithms/sliding-window.js'\nimport { isProduction, resolveStore } from './resolve-store.js'\nimport type { RateLimiter, RateLimitOptions } from './types.js'\nimport { parseWindow } from './window.js'\n\nconst ALGORITHMS: Record<string, AlgorithmFn> = {\n  'fixed-window': fixedWindow,\n  'sliding-window': slidingWindow,\n}\n\n/**\n * Create a rate limiter. With no store configured it uses an in-memory counter\n * (great for local dev); set `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN`,\n * or pass a `redis` client, and the exact same code becomes distributed.\n *\n * @example\n * const limiter = rateLimit({ limit: 10, window: '10s' })\n * const { success } = await limiter.limit(userId)\n * if (!success) return new Response('slow down', { status: 429 })\n */\nexport function rateLimit(options: RateLimitOptions): RateLimiter {\n  const { limit, algorithm = 'fixed-window', prefix = 'ratefall', silent = false } = options\n\n  if (!Number.isInteger(limit) || limit <= 0) {\n    throw new RangeError(`ratefall: limit must be a positive integer, got ${limit}`)\n  }\n\n  const run = ALGORITHMS[algorithm]\n  if (!run) {\n    throw new TypeError(`ratefall: unknown algorithm \"${algorithm}\". Use \"fixed-window\" or \"sliding-window\".`)\n  }\n\n  const windowMs = parseWindow(options.window)\n  const { store, distributed, source } = resolveStore(options)\n\n  if (!distributed && !silent && isProduction()) {\n    // Not an error: single-instance prod is legitimate. But un-shared limits in a\n    // multi-instance deploy are a footgun, so make it loud exactly once.\n    console.warn(\n      `ratefall: running with an in-memory store in production. Limits are per-instance and NOT shared. ` +\n        `Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN or pass a \\`redis\\` client. Pass \\`silent: true\\` to hide this.`,\n    )\n  }\n\n  const ctx: AlgorithmContext = { limit, windowMs, prefix }\n\n  return {\n    async limit(identifier: string) {\n      if (!identifier) {\n        throw new TypeError('ratefall: identifier must be a non-empty string.')\n      }\n      return run(store, ctx, identifier, Date.now())\n    },\n  }\n}\n\n/** The resolved store source, exposed for debugging/tests. */\nexport { resolveStore } from './resolve-store.js'\n"]}

package/dist/index.d.cts

@@ -0,0 +1,147 @@
+/** Result of a single rate-limit check. */
+interface RateLimitResult {
+    /** Whether the request is allowed. */
+    success: boolean;
+    /** The configured request ceiling for the window. */
+    limit: number;
+    /** Requests remaining in the current window (never below 0). */
+    remaining: number;
+    /** Epoch milliseconds at which the window resets. */
+    reset: number;
+    /** Milliseconds until the next request would be allowed. 0 when `success` is true. */
+    retryAfter: number;
+}
+/**
+ * Minimal counter backend. Mirrors the handful of Redis commands the
+ * algorithms need, so any store (memory, Upstash REST, a duck-typed Redis
+ * client) can satisfy it.
+ */
+interface Store {
+    /** Increment the counter at `key`, returning the new value. */
+    incr(key: string): Promise<number>;
+    /** Set the time-to-live of `key` in milliseconds. */
+    pexpire(key: string, ms: number): Promise<void>;
+    /** Read the counter at `key`. Returns 0 when the key is absent or expired. */
+    get(key: string): Promise<number>;
+}
+/**
+ * The subset of a Redis client `ratefall` uses. Both `@upstash/redis` and
+ * `ioredis` satisfy this shape, so you can pass either without an adapter.
+ */
+interface RedisLike {
+    incr(key: string): Promise<number>;
+    pexpire(key: string, ms: number): Promise<unknown>;
+    get(key: string): Promise<string | number | null>;
+}
+type Algorithm = 'fixed-window' | 'sliding-window';
+interface RateLimitOptions {
+    /** Maximum number of requests allowed per window. */
+    limit: number;
+    /** Window length. A number is milliseconds, or a duration string like `'10s'`, `'1m'`, `'2h'`. */
+    window: string | number;
+    /** Limiting algorithm. Defaults to `'fixed-window'`. */
+    algorithm?: Algorithm;
+    /** Key namespace, so multiple limiters can share a store. Defaults to `'ratefall'`. */
+    prefix?: string;
+    /** An explicit store. Overrides `redis` and env auto-detection. */
+    store?: Store;
+    /** A Redis client (`@upstash/redis`, `ioredis`, ...). Overrides env auto-detection. */
+    redis?: RedisLike;
+    /** Suppress the "no distributed store in production" warning. */
+    silent?: boolean;
+}
+/** A configured rate limiter. */
+interface RateLimiter {
+    /** Check and consume one request for `identifier` (an IP, user id, API key, ...). */
+    limit(identifier: string): Promise<RateLimitResult>;
+}
+
+interface ResolvedStore {
+    store: Store;
+    /** Whether the store is shared across processes (Redis) vs per-instance (memory). */
+    distributed: boolean;
+    /** Human-readable source, for the dev warning. */
+    source: string;
+}
+/**
+ * Decide which store to use, in priority order:
+ * 1. an explicit `store`
+ * 2. an explicit `redis` client
+ * 3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment
+ * 4. in-memory fallback
+ */
+declare function resolveStore(options: RateLimitOptions): ResolvedStore;
+
+/**
+ * Create a rate limiter. With no store configured it uses an in-memory counter
+ * (great for local dev); set `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN`,
+ * or pass a `redis` client, and the exact same code becomes distributed.
+ *
+ * @example
+ * const limiter = rateLimit({ limit: 10, window: '10s' })
+ * const { success } = await limiter.limit(userId)
+ * if (!success) return new Response('slow down', { status: 429 })
+ */
+declare function rateLimit(options: RateLimitOptions): RateLimiter;
+
+/**
+ * In-process counter store. Used as the automatic fallback when no Redis is
+ * configured. State is per-instance and not shared across processes, so it is
+ * meant for local development and single-instance deployments, not distributed
+ * production traffic.
+ */
+declare class MemoryStore implements Store {
+    private readonly map;
+    private readonly sweeper;
+    /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */
+    constructor(sweepMs?: number);
+    private live;
+    incr(key: string): Promise<number>;
+    pexpire(key: string, ms: number): Promise<void>;
+    get(key: string): Promise<number>;
+    private sweep;
+    /** Stop the background sweeper. Optional; the timer is unref'd. */
+    dispose(): void;
+}
+
+/**
+ * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`
+ * and `ioredis` qualify) to the {@link Store} interface.
+ */
+declare class RedisStore implements Store {
+    private readonly client;
+    constructor(client: RedisLike);
+    incr(key: string): Promise<number>;
+    pexpire(key: string, ms: number): Promise<void>;
+    get(key: string): Promise<number>;
+}
+
+interface UpstashRestOptions {
+    url: string;
+    token: string;
+    /** Custom fetch implementation. Defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+}
+/**
+ * Zero-dependency store backed by the Upstash Redis REST API. Uses `fetch`, so
+ * it runs anywhere the runtime provides one (Node 18+, edge, workers) without
+ * pulling in a Redis client. This is what env auto-detection constructs.
+ */
+declare class UpstashRestStore implements Store {
+    private readonly url;
+    private readonly token;
+    private readonly fetchImpl;
+    constructor(options: UpstashRestOptions);
+    private command;
+    incr(key: string): Promise<number>;
+    pexpire(key: string, ms: number): Promise<void>;
+    get(key: string): Promise<number>;
+}
+
+/**
+ * Normalize a window into milliseconds. Accepts a raw millisecond number or a
+ * duration string like `'500ms'`, `'10s'`, `'1m'`, `'2h'`, `'1d'`.
+ */
+declare function parseWindow(window: string | number): number;
+
+export { type Algorithm, MemoryStore, type RateLimitOptions, type RateLimitResult, type RateLimiter, type RedisLike, RedisStore, type Store, type UpstashRestOptions, UpstashRestStore, parseWindow, rateLimit, resolveStore };

package/dist/index.d.ts

@@ -0,0 +1,147 @@
+/** Result of a single rate-limit check. */
+interface RateLimitResult {
+    /** Whether the request is allowed. */
+    success: boolean;
+    /** The configured request ceiling for the window. */
+    limit: number;
+    /** Requests remaining in the current window (never below 0). */
+    remaining: number;
+    /** Epoch milliseconds at which the window resets. */
+    reset: number;
+    /** Milliseconds until the next request would be allowed. 0 when `success` is true. */
+    retryAfter: number;
+}
+/**
+ * Minimal counter backend. Mirrors the handful of Redis commands the
+ * algorithms need, so any store (memory, Upstash REST, a duck-typed Redis
+ * client) can satisfy it.
+ */
+interface Store {
+    /** Increment the counter at `key`, returning the new value. */
+    incr(key: string): Promise<number>;
+    /** Set the time-to-live of `key` in milliseconds. */
+    pexpire(key: string, ms: number): Promise<void>;
+    /** Read the counter at `key`. Returns 0 when the key is absent or expired. */
+    get(key: string): Promise<number>;
+}
+/**
+ * The subset of a Redis client `ratefall` uses. Both `@upstash/redis` and
+ * `ioredis` satisfy this shape, so you can pass either without an adapter.
+ */
+interface RedisLike {
+    incr(key: string): Promise<number>;
+    pexpire(key: string, ms: number): Promise<unknown>;
+    get(key: string): Promise<string | number | null>;
+}
+type Algorithm = 'fixed-window' | 'sliding-window';
+interface RateLimitOptions {
+    /** Maximum number of requests allowed per window. */
+    limit: number;
+    /** Window length. A number is milliseconds, or a duration string like `'10s'`, `'1m'`, `'2h'`. */
+    window: string | number;
+    /** Limiting algorithm. Defaults to `'fixed-window'`. */
+    algorithm?: Algorithm;
+    /** Key namespace, so multiple limiters can share a store. Defaults to `'ratefall'`. */
+    prefix?: string;
+    /** An explicit store. Overrides `redis` and env auto-detection. */
+    store?: Store;
+    /** A Redis client (`@upstash/redis`, `ioredis`, ...). Overrides env auto-detection. */
+    redis?: RedisLike;
+    /** Suppress the "no distributed store in production" warning. */
+    silent?: boolean;
+}
+/** A configured rate limiter. */
+interface RateLimiter {
+    /** Check and consume one request for `identifier` (an IP, user id, API key, ...). */
+    limit(identifier: string): Promise<RateLimitResult>;
+}
+
+interface ResolvedStore {
+    store: Store;
+    /** Whether the store is shared across processes (Redis) vs per-instance (memory). */
+    distributed: boolean;
+    /** Human-readable source, for the dev warning. */
+    source: string;
+}
+/**
+ * Decide which store to use, in priority order:
+ * 1. an explicit `store`
+ * 2. an explicit `redis` client
+ * 3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment
+ * 4. in-memory fallback
+ */
+declare function resolveStore(options: RateLimitOptions): ResolvedStore;
+
+/**
+ * Create a rate limiter. With no store configured it uses an in-memory counter
+ * (great for local dev); set `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN`,
+ * or pass a `redis` client, and the exact same code becomes distributed.
+ *
+ * @example
+ * const limiter = rateLimit({ limit: 10, window: '10s' })
+ * const { success } = await limiter.limit(userId)
+ * if (!success) return new Response('slow down', { status: 429 })
+ */
+declare function rateLimit(options: RateLimitOptions): RateLimiter;
+
+/**
+ * In-process counter store. Used as the automatic fallback when no Redis is
+ * configured. State is per-instance and not shared across processes, so it is
+ * meant for local development and single-instance deployments, not distributed
+ * production traffic.
+ */
+declare class MemoryStore implements Store {
+    private readonly map;
+    private readonly sweeper;
+    /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */
+    constructor(sweepMs?: number);
+    private live;
+    incr(key: string): Promise<number>;
+    pexpire(key: string, ms: number): Promise<void>;
+    get(key: string): Promise<number>;
+    private sweep;
+    /** Stop the background sweeper. Optional; the timer is unref'd. */
+    dispose(): void;
+}
+
+/**
+ * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`
+ * and `ioredis` qualify) to the {@link Store} interface.
+ */
+declare class RedisStore implements Store {
+    private readonly client;
+    constructor(client: RedisLike);
+    incr(key: string): Promise<number>;
+    pexpire(key: string, ms: number): Promise<void>;
+    get(key: string): Promise<number>;
+}
+
+interface UpstashRestOptions {
+    url: string;
+    token: string;
+    /** Custom fetch implementation. Defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+}
+/**
+ * Zero-dependency store backed by the Upstash Redis REST API. Uses `fetch`, so
+ * it runs anywhere the runtime provides one (Node 18+, edge, workers) without
+ * pulling in a Redis client. This is what env auto-detection constructs.
+ */
+declare class UpstashRestStore implements Store {
+    private readonly url;
+    private readonly token;
+    private readonly fetchImpl;
+    constructor(options: UpstashRestOptions);
+    private command;
+    incr(key: string): Promise<number>;
+    pexpire(key: string, ms: number): Promise<void>;
+    get(key: string): Promise<number>;
+}
+
+/**
+ * Normalize a window into milliseconds. Accepts a raw millisecond number or a
+ * duration string like `'500ms'`, `'10s'`, `'1m'`, `'2h'`, `'1d'`.
+ */
+declare function parseWindow(window: string | number): number;
+
+export { type Algorithm, MemoryStore, type RateLimitOptions, type RateLimitResult, type RateLimiter, type RedisLike, RedisStore, type Store, type UpstashRestOptions, UpstashRestStore, parseWindow, rateLimit, resolveStore };

package/dist/index.js

@@ -0,0 +1,243 @@
+// src/algorithms/fixed-window.ts
+var fixedWindow = async (store, ctx, identifier, now) => {
+  const { limit, windowMs, prefix } = ctx;
+  const windowStart = Math.floor(now / windowMs) * windowMs;
+  const key = `${prefix}:${identifier}:${windowStart}`;
+  const count = await store.incr(key);
+  if (count === 1) await store.pexpire(key, windowMs);
+  const reset = windowStart + windowMs;
+  const success = count <= limit;
+  return {
+    success,
+    limit,
+    remaining: Math.max(0, limit - count),
+    reset,
+    retryAfter: success ? 0 : reset - now
+  };
+};
+
+// src/algorithms/sliding-window.ts
+var slidingWindow = async (store, ctx, identifier, now) => {
+  const { limit, windowMs, prefix } = ctx;
+  const currentStart = Math.floor(now / windowMs) * windowMs;
+  const previousStart = currentStart - windowMs;
+  const fraction = (now - currentStart) / windowMs;
+  const currentKey = `${prefix}:${identifier}:${currentStart}`;
+  const previousKey = `${prefix}:${identifier}:${previousStart}`;
+  const previousCount = await store.get(previousKey);
+  const currentCount = await store.incr(currentKey);
+  if (currentCount === 1) await store.pexpire(currentKey, windowMs * 2);
+  const weighted = previousCount * (1 - fraction) + currentCount;
+  const reset = currentStart + windowMs;
+  const success = weighted <= limit;
+  return {
+    success,
+    limit,
+    remaining: Math.max(0, Math.floor(limit - weighted)),
+    reset,
+    retryAfter: success ? 0 : reset - now
+  };
+};
+
+// src/stores/memory.ts
+var MemoryStore = class {
+  map = /* @__PURE__ */ new Map();
+  sweeper;
+  /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */
+  constructor(sweepMs = 3e4) {
+    if (sweepMs > 0 && typeof setInterval === "function") {
+      this.sweeper = setInterval(() => this.sweep(), sweepMs);
+      this.sweeper.unref?.();
+    }
+  }
+  live(key) {
+    const entry = this.map.get(key);
+    if (!entry) return void 0;
+    if (entry.expiresAt <= Date.now()) {
+      this.map.delete(key);
+      return void 0;
+    }
+    return entry;
+  }
+  async incr(key) {
+    const entry = this.live(key);
+    if (!entry) {
+      this.map.set(key, { count: 1, expiresAt: Number.POSITIVE_INFINITY });
+      return 1;
+    }
+    entry.count += 1;
+    return entry.count;
+  }
+  async pexpire(key, ms) {
+    const entry = this.live(key);
+    if (entry) entry.expiresAt = Date.now() + ms;
+  }
+  async get(key) {
+    return this.live(key)?.count ?? 0;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [key, entry] of this.map) {
+      if (entry.expiresAt <= now) this.map.delete(key);
+    }
+  }
+  /** Stop the background sweeper. Optional; the timer is unref'd. */
+  dispose() {
+    if (this.sweeper) clearInterval(this.sweeper);
+  }
+};
+
+// src/stores/redis.ts
+var RedisStore = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async incr(key) {
+    return this.client.incr(key);
+  }
+  async pexpire(key, ms) {
+    await this.client.pexpire(key, ms);
+  }
+  async get(key) {
+    const value = await this.client.get(key);
+    if (value == null) return 0;
+    const n = typeof value === "number" ? value : Number(value);
+    return Number.isFinite(n) ? n : 0;
+  }
+};
+
+// src/stores/upstash-rest.ts
+var UpstashRestStore = class {
+  url;
+  token;
+  fetchImpl;
+  constructor(options) {
+    this.url = options.url.replace(/\/$/, "");
+    this.token = options.token;
+    const f = options.fetch ?? globalThis.fetch;
+    if (typeof f !== "function") {
+      throw new Error("ratefall: no global fetch available; pass a `fetch` implementation to UpstashRestStore.");
+    }
+    this.fetchImpl = f;
+  }
+  async command(args) {
+    const res = await this.fetchImpl(this.url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(args.map(String))
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new Error(`ratefall: Upstash REST error ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ""}`);
+    }
+    const body = await res.json();
+    if (body.error) {
+      throw new Error(`ratefall: Upstash command failed - ${body.error}`);
+    }
+    return body.result;
+  }
+  async incr(key) {
+    return Number(await this.command(["INCR", key]));
+  }
+  async pexpire(key, ms) {
+    await this.command(["PEXPIRE", key, ms]);
+  }
+  async get(key) {
+    const result = await this.command(["GET", key]);
+    if (result == null) return 0;
+    const n = Number(result);
+    return Number.isFinite(n) ? n : 0;
+  }
+};
+
+// src/resolve-store.ts
+function readEnv(key) {
+  const env = globalThis.process?.env;
+  return env?.[key];
+}
+function resolveStore(options) {
+  if (options.store) {
+    return { store: options.store, distributed: true, source: "custom store" };
+  }
+  if (options.redis) {
+    return { store: new RedisStore(options.redis), distributed: true, source: "redis client" };
+  }
+  const url = readEnv("UPSTASH_REDIS_REST_URL");
+  const token = readEnv("UPSTASH_REDIS_REST_TOKEN");
+  if (url && token) {
+    return { store: new UpstashRestStore({ url, token }), distributed: true, source: "Upstash REST (env)" };
+  }
+  return { store: new MemoryStore(), distributed: false, source: "in-memory" };
+}
+function isProduction() {
+  return readEnv("NODE_ENV") === "production";
+}
+
+// src/window.ts
+var UNITS = {
+  ms: 1,
+  s: 1e3,
+  m: 6e4,
+  h: 36e5,
+  d: 864e5
+};
+var PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/;
+function parseWindow(window) {
+  if (typeof window === "number") {
+    if (!Number.isFinite(window) || window <= 0) {
+      throw new RangeError(`ratefall: window must be a positive number of milliseconds, got ${window}`);
+    }
+    return Math.floor(window);
+  }
+  const match = PATTERN.exec(window.trim());
+  if (!match) {
+    throw new TypeError(`ratefall: invalid window "${window}". Use a number of ms or a string like "10s", "1m", "2h".`);
+  }
+  const value = Number(match[1]);
+  const unit = UNITS[match[2]];
+  const ms = Math.floor(value * unit);
+  if (ms <= 0) {
+    throw new RangeError(`ratefall: window must be greater than 0, got "${window}".`);
+  }
+  return ms;
+}
+
+// src/rate-limit.ts
+var ALGORITHMS = {
+  "fixed-window": fixedWindow,
+  "sliding-window": slidingWindow
+};
+function rateLimit(options) {
+  const { limit, algorithm = "fixed-window", prefix = "ratefall", silent = false } = options;
+  if (!Number.isInteger(limit) || limit <= 0) {
+    throw new RangeError(`ratefall: limit must be a positive integer, got ${limit}`);
+  }
+  const run = ALGORITHMS[algorithm];
+  if (!run) {
+    throw new TypeError(`ratefall: unknown algorithm "${algorithm}". Use "fixed-window" or "sliding-window".`);
+  }
+  const windowMs = parseWindow(options.window);
+  const { store, distributed, source } = resolveStore(options);
+  if (!distributed && !silent && isProduction()) {
+    console.warn(
+      `ratefall: running with an in-memory store in production. Limits are per-instance and NOT shared. Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN or pass a \`redis\` client. Pass \`silent: true\` to hide this.`
+    );
+  }
+  const ctx = { limit, windowMs, prefix };
+  return {
+    async limit(identifier) {
+      if (!identifier) {
+        throw new TypeError("ratefall: identifier must be a non-empty string.");
+      }
+      return run(store, ctx, identifier, Date.now());
+    }
+  };
+}
+
+export { MemoryStore, RedisStore, UpstashRestStore, parseWindow, rateLimit, resolveStore };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/algorithms/fixed-window.ts","../src/algorithms/sliding-window.ts","../src/stores/memory.ts","../src/stores/redis.ts","../src/stores/upstash-rest.ts","../src/resolve-store.ts","../src/window.ts","../src/rate-limit.ts"],"names":[],"mappings":";AAOO,IAAM,WAAA,GAA2B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC7E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AACjD,EAAA,MAAM,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,WAAW,CAAA,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAClC,EAAA,IAAI,UAAU,CAAA,EAAG,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,QAAQ,CAAA;AAElD,EAAA,MAAM,QAAQ,WAAA,GAAc,QAAA;AAC5B,EAAA,MAAM,UAAU,KAAA,IAAS,KAAA;AACzB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,KAAK,CAAA;AAAA,IACpC,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;ACjBO,IAAM,aAAA,GAA6B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC/E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AAClD,EAAA,MAAM,gBAAgB,YAAA,GAAe,QAAA;AACrC,EAAA,MAAM,QAAA,GAAA,CAAY,MAAM,YAAA,IAAgB,QAAA;AAExC,EAAA,MAAM,aAAa,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,YAAY,CAAA,CAAA;AAC1D,EAAA,MAAM,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,aAAa,CAAA,CAAA;AAE5D,EAAA,MAAM,aAAA,GAAgB,MAAM,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AACjD,EAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA;AAEhD,EAAA,IAAI,iBAAiB,CAAA,EAAG,MAAM,MAAM,OAAA,CAAQ,UAAA,EAAY,WAAW,CAAC,CAAA;AAEpE,EAAA,MAAM,QAAA,GAAW,aAAA,IAAiB,CAAA,GAAI,QAAA,CAAA,GAAY,YAAA;AAClD,EAAA,MAAM,QAAQ,YAAA,GAAe,QAAA;AAC7B,EAAA,MAAM,UAAU,QAAA,IAAY,KAAA;AAC5B,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,KAAA,GAAQ,QAAQ,CAAC,CAAA;AAAA,IACnD,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;AClBO,IAAM,cAAN,MAAmC;AAAA,EACvB,GAAA,uBAAU,GAAA,EAAmB;AAAA,EAC7B,OAAA;AAAA;AAAA,EAGjB,WAAA,CAAY,UAAU,GAAA,EAAQ;AAC5B,IAAA,IAAI,OAAA,GAAU,CAAA,IAAK,OAAO,WAAA,KAAgB,UAAA,EAAY;AACpD,MAAA,IAAA,CAAK,UAAU,WAAA,CAAY,MAAM,IAAA,CAAK,KAAA,IAAS,OAAO,CAAA;AAEtD,MAAA,IAAA,CAAK,QAAQ,KAAA,IAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEQ,KAAK,GAAA,EAAgC;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,EAAG;AACjC,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AACnB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO;AAEV,MAAA,IAAA,CAAK,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,OAAO,CAAA,EAAG,SAAA,EAAW,MAAA,CAAO,iBAAA,EAAmB,CAAA;AACnE,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,KAAA,EAAO,KAAA,CAAM,SAAA,GAAY,IAAA,CAAK,KAAI,GAAI,EAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAG,KAAA,IAAS,CAAA;AAAA,EAClC;AAAA,EAEQ,KAAA,GAAc;AACpB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAK,GAAA,EAAK;AACnC,MAAA,IAAI,MAAM,SAAA,IAAa,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AAAA,IACjD;AAAA,EACF;AAAA;AAAA,EAGA,OAAA,GAAgB;AACd,IAAA,IAAI,IAAA,CAAK,OAAA,EAAS,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9C;AACF;;;AC7DO,IAAM,aAAN,MAAkC;AAAA,EACvC,YAA6B,MAAA,EAAmB;AAAnB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAoB;AAAA,EAApB,MAAA;AAAA,EAE7B,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,IAAI,GAAG,CAAA;AACvC,IAAA,IAAI,KAAA,IAAS,MAAM,OAAO,CAAA;AAC1B,IAAA,MAAM,IAAI,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAK,CAAA;AAC1D,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,EAClC;AACF;;;ACTO,IAAM,mBAAN,MAAwC;AAAA,EAC5B,GAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EAEjB,YAAY,OAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxC,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AACrB,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AACtC,IAAA,IAAI,OAAO,MAAM,UAAA,EAAY;AAC3B,MAAA,MAAM,IAAI,MAAM,yFAAyF,CAAA;AAAA,IAC3G;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AAAA,EACnB;AAAA,EAEA,MAAc,QAAQ,IAAA,EAA6C;AACjE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,GAAA,EAAK;AAAA,MACzC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,QACnC,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAC;AAAA,KACtC,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,SAAS,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC9C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,EAAG,MAAA,GAAS,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,IAC/G;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,MAAA,CAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAC,CAAA;AAAA,EACjD;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAK,OAAA,CAAQ,CAAC,SAAA,EAAW,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,QAAQ,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAC9C,IAAA,IAAI,MAAA,IAAU,MAAM,OAAO,CAAA;AAC3B,IAAA,MAAM,CAAA,GAAI,OAAO,MAAM,CAAA;AACvB,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,EAClC;AACF;;;AClDA,SAAS,QAAQ,GAAA,EAAiC;AAChD,EAAA,MAAM,GAAA,GAAO,WAA0E,OAAA,EAAS,GAAA;AAChG,EAAA,OAAO,MAAM,GAAG,CAAA;AAClB;AASO,SAAS,aAAa,OAAA,EAA0C;AACrE,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,WAAA,EAAa,IAAA,EAAM,QAAQ,cAAA,EAAe;AAAA,EAC3E;AAEA,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,UAAA,CAAW,OAAA,CAAQ,KAAK,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,cAAA,EAAe;AAAA,EAC3F;AAEA,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAQ,0BAA0B,CAAA;AAChD,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,oBAAA,EAAqB;AAAA,EACxG;AAEA,EAAA,OAAO,EAAE,OAAO,IAAI,WAAA,IAAe,WAAA,EAAa,KAAA,EAAO,QAAQ,WAAA,EAAY;AAC7E;AAGO,SAAS,YAAA,GAAwB;AACtC,EAAA,OAAO,OAAA,CAAQ,UAAU,CAAA,KAAM,YAAA;AACjC;;;AC9CA,IAAM,KAAA,GAAgC;AAAA,EACpC,EAAA,EAAI,CAAA;AAAA,EACJ,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,IAAA;AAAA,EACH,CAAA,EAAG;AACL,CAAA;AAEA,IAAM,OAAA,GAAU,kCAAA;AAMT,SAAS,YAAY,MAAA,EAAiC;AAC3D,EAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,UAAU,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gEAAA,EAAmE,MAAM,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,0BAAA,EAA6B,MAAM,CAAA,yDAAA,CAA2D,CAAA;AAAA,EACpH;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAC,CAAW,CAAA;AACrC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,IAAI,CAAA;AAClC,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,8CAAA,EAAiD,MAAM,CAAA,EAAA,CAAI,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,EAAA;AACT;;;AC3BA,IAAM,UAAA,GAA0C;AAAA,EAC9C,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB;AACpB,CAAA;AAYO,SAAS,UAAU,OAAA,EAAwC;AAChE,EAAA,MAAM,EAAE,OAAO,SAAA,GAAY,cAAA,EAAgB,SAAS,UAAA,EAAY,MAAA,GAAS,OAAM,GAAI,OAAA;AAEnF,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gDAAA,EAAmD,KAAK,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,WAAW,SAAS,CAAA;AAChC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,6BAAA,EAAgC,SAAS,CAAA,0CAAA,CAA4C,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AAC3C,EAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAO,GAAI,aAAa,OAAO,CAAA;AAE3D,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,MAAA,IAAU,cAAa,EAAG;AAG7C,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,sNAAA;AAAA,KAEF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAwB,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO;AAExD,EAAA,OAAO;AAAA,IACL,MAAM,MAAM,UAAA,EAAoB;AAC9B,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,MAAM,IAAI,UAAU,kDAAkD,CAAA;AAAA,MACxE;AACA,MAAA,OAAO,IAAI,KAAA,EAAO,GAAA,EAAK,UAAA,EAAY,IAAA,CAAK,KAAK,CAAA;AAAA,IAC/C;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import type { AlgorithmFn } from './index.js'\n\n/**\n * Fixed-window counter. Divides time into contiguous windows of `windowMs` and\n * counts requests per window. Simple and cheap (one counter per window), at the\n * cost of allowing up to 2x `limit` across a window boundary in the worst case.\n */\nexport const fixedWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const windowStart = Math.floor(now / windowMs) * windowMs\n  const key = `${prefix}:${identifier}:${windowStart}`\n\n  const count = await store.incr(key)\n  if (count === 1) await store.pexpire(key, windowMs)\n\n  const reset = windowStart + windowMs\n  const success = count <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, limit - count),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { AlgorithmFn } from './index.js'\n\n/**\n * Sliding-window counter. Weights the previous window's count by how far the\n * current window has elapsed and adds the current count, smoothing out the\n * boundary bursts that fixed-window allows. Uses two counters per identifier.\n */\nexport const slidingWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const currentStart = Math.floor(now / windowMs) * windowMs\n  const previousStart = currentStart - windowMs\n  const fraction = (now - currentStart) / windowMs // 0..1 through the current window\n\n  const currentKey = `${prefix}:${identifier}:${currentStart}`\n  const previousKey = `${prefix}:${identifier}:${previousStart}`\n\n  const previousCount = await store.get(previousKey)\n  const currentCount = await store.incr(currentKey)\n  // Keep the counter alive long enough to still be read as \"previous\" next window.\n  if (currentCount === 1) await store.pexpire(currentKey, windowMs * 2)\n\n  const weighted = previousCount * (1 - fraction) + currentCount\n  const reset = currentStart + windowMs\n  const success = weighted <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, Math.floor(limit - weighted)),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { Store } from '../types.js'\n\ninterface Entry {\n  count: number\n  expiresAt: number\n}\n\n/**\n * In-process counter store. Used as the automatic fallback when no Redis is\n * configured. State is per-instance and not shared across processes, so it is\n * meant for local development and single-instance deployments, not distributed\n * production traffic.\n */\nexport class MemoryStore implements Store {\n  private readonly map = new Map<string, Entry>()\n  private readonly sweeper: ReturnType<typeof setInterval> | undefined\n\n  /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */\n  constructor(sweepMs = 30_000) {\n    if (sweepMs > 0 && typeof setInterval === 'function') {\n      this.sweeper = setInterval(() => this.sweep(), sweepMs)\n      // Never keep the event loop alive for cleanup alone.\n      this.sweeper.unref?.()\n    }\n  }\n\n  private live(key: string): Entry | undefined {\n    const entry = this.map.get(key)\n    if (!entry) return undefined\n    if (entry.expiresAt <= Date.now()) {\n      this.map.delete(key)\n      return undefined\n    }\n    return entry\n  }\n\n  async incr(key: string): Promise<number> {\n    const entry = this.live(key)\n    if (!entry) {\n      // Default to no expiry; pexpire is expected to follow on the first hit.\n      this.map.set(key, { count: 1, expiresAt: Number.POSITIVE_INFINITY })\n      return 1\n    }\n    entry.count += 1\n    return entry.count\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    const entry = this.live(key)\n    if (entry) entry.expiresAt = Date.now() + ms\n  }\n\n  async get(key: string): Promise<number> {\n    return this.live(key)?.count ?? 0\n  }\n\n  private sweep(): void {\n    const now = Date.now()\n    for (const [key, entry] of this.map) {\n      if (entry.expiresAt <= now) this.map.delete(key)\n    }\n  }\n\n  /** Stop the background sweeper. Optional; the timer is unref'd. */\n  dispose(): void {\n    if (this.sweeper) clearInterval(this.sweeper)\n  }\n}\n","import type { RedisLike, Store } from '../types.js'\n\n/**\n * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`\n * and `ioredis` qualify) to the {@link Store} interface.\n */\nexport class RedisStore implements Store {\n  constructor(private readonly client: RedisLike) {}\n\n  async incr(key: string): Promise<number> {\n    return this.client.incr(key)\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.client.pexpire(key, ms)\n  }\n\n  async get(key: string): Promise<number> {\n    const value = await this.client.get(key)\n    if (value == null) return 0\n    const n = typeof value === 'number' ? value : Number(value)\n    return Number.isFinite(n) ? n : 0\n  }\n}\n","import type { Store } from '../types.js'\n\nexport interface UpstashRestOptions {\n  url: string\n  token: string\n  /** Custom fetch implementation. Defaults to the global `fetch`. */\n  fetch?: typeof fetch\n}\n\n/**\n * Zero-dependency store backed by the Upstash Redis REST API. Uses `fetch`, so\n * it runs anywhere the runtime provides one (Node 18+, edge, workers) without\n * pulling in a Redis client. This is what env auto-detection constructs.\n */\nexport class UpstashRestStore implements Store {\n  private readonly url: string\n  private readonly token: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: UpstashRestOptions) {\n    this.url = options.url.replace(/\\/$/, '')\n    this.token = options.token\n    const f = options.fetch ?? globalThis.fetch\n    if (typeof f !== 'function') {\n      throw new Error('ratefall: no global fetch available; pass a `fetch` implementation to UpstashRestStore.')\n    }\n    this.fetchImpl = f\n  }\n\n  private async command(args: (string | number)[]): Promise<unknown> {\n    const res = await this.fetchImpl(this.url, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.token}`,\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(args.map(String)),\n    })\n    if (!res.ok) {\n      const detail = await res.text().catch(() => '')\n      throw new Error(`ratefall: Upstash REST error ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ''}`)\n    }\n    const body = (await res.json()) as { result?: unknown; error?: string }\n    if (body.error) {\n      throw new Error(`ratefall: Upstash command failed - ${body.error}`)\n    }\n    return body.result\n  }\n\n  async incr(key: string): Promise<number> {\n    return Number(await this.command(['INCR', key]))\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.command(['PEXPIRE', key, ms])\n  }\n\n  async get(key: string): Promise<number> {\n    const result = await this.command(['GET', key])\n    if (result == null) return 0\n    const n = Number(result)\n    return Number.isFinite(n) ? n : 0\n  }\n}\n","import type { RateLimitOptions, Store } from './types.js'\nimport { MemoryStore } from './stores/memory.js'\nimport { RedisStore } from './stores/redis.js'\nimport { UpstashRestStore } from './stores/upstash-rest.js'\n\nexport interface ResolvedStore {\n  store: Store\n  /** Whether the store is shared across processes (Redis) vs per-instance (memory). */\n  distributed: boolean\n  /** Human-readable source, for the dev warning. */\n  source: string\n}\n\nfunction readEnv(key: string): string | undefined {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env\n  return env?.[key]\n}\n\n/**\n * Decide which store to use, in priority order:\n * 1. an explicit `store`\n * 2. an explicit `redis` client\n * 3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment\n * 4. in-memory fallback\n */\nexport function resolveStore(options: RateLimitOptions): ResolvedStore {\n  if (options.store) {\n    return { store: options.store, distributed: true, source: 'custom store' }\n  }\n\n  if (options.redis) {\n    return { store: new RedisStore(options.redis), distributed: true, source: 'redis client' }\n  }\n\n  const url = readEnv('UPSTASH_REDIS_REST_URL')\n  const token = readEnv('UPSTASH_REDIS_REST_TOKEN')\n  if (url && token) {\n    return { store: new UpstashRestStore({ url, token }), distributed: true, source: 'Upstash REST (env)' }\n  }\n\n  return { store: new MemoryStore(), distributed: false, source: 'in-memory' }\n}\n\n/** True when the runtime looks like a production deployment. */\nexport function isProduction(): boolean {\n  return readEnv('NODE_ENV') === 'production'\n}\n","const UNITS: Record<string, number> = {\n  ms: 1,\n  s: 1000,\n  m: 60_000,\n  h: 3_600_000,\n  d: 86_400_000,\n}\n\nconst PATTERN = /^(\\d+(?:\\.\\d+)?)\\s*(ms|s|m|h|d)$/\n\n/**\n * Normalize a window into milliseconds. Accepts a raw millisecond number or a\n * duration string like `'500ms'`, `'10s'`, `'1m'`, `'2h'`, `'1d'`.\n */\nexport function parseWindow(window: string | number): number {\n  if (typeof window === 'number') {\n    if (!Number.isFinite(window) || window <= 0) {\n      throw new RangeError(`ratefall: window must be a positive number of milliseconds, got ${window}`)\n    }\n    return Math.floor(window)\n  }\n\n  const match = PATTERN.exec(window.trim())\n  if (!match) {\n    throw new TypeError(`ratefall: invalid window \"${window}\". Use a number of ms or a string like \"10s\", \"1m\", \"2h\".`)\n  }\n\n  const value = Number(match[1])\n  const unit = UNITS[match[2] as string] as number\n  const ms = Math.floor(value * unit)\n  if (ms <= 0) {\n    throw new RangeError(`ratefall: window must be greater than 0, got \"${window}\".`)\n  }\n  return ms\n}\n","import type { AlgorithmContext, AlgorithmFn } from './algorithms/index.js'\nimport { fixedWindow } from './algorithms/fixed-window.js'\nimport { slidingWindow } from './algorithms/sliding-window.js'\nimport { isProduction, resolveStore } from './resolve-store.js'\nimport type { RateLimiter, RateLimitOptions } from './types.js'\nimport { parseWindow } from './window.js'\n\nconst ALGORITHMS: Record<string, AlgorithmFn> = {\n  'fixed-window': fixedWindow,\n  'sliding-window': slidingWindow,\n}\n\n/**\n * Create a rate limiter. With no store configured it uses an in-memory counter\n * (great for local dev); set `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN`,\n * or pass a `redis` client, and the exact same code becomes distributed.\n *\n * @example\n * const limiter = rateLimit({ limit: 10, window: '10s' })\n * const { success } = await limiter.limit(userId)\n * if (!success) return new Response('slow down', { status: 429 })\n */\nexport function rateLimit(options: RateLimitOptions): RateLimiter {\n  const { limit, algorithm = 'fixed-window', prefix = 'ratefall', silent = false } = options\n\n  if (!Number.isInteger(limit) || limit <= 0) {\n    throw new RangeError(`ratefall: limit must be a positive integer, got ${limit}`)\n  }\n\n  const run = ALGORITHMS[algorithm]\n  if (!run) {\n    throw new TypeError(`ratefall: unknown algorithm \"${algorithm}\". Use \"fixed-window\" or \"sliding-window\".`)\n  }\n\n  const windowMs = parseWindow(options.window)\n  const { store, distributed, source } = resolveStore(options)\n\n  if (!distributed && !silent && isProduction()) {\n    // Not an error: single-instance prod is legitimate. But un-shared limits in a\n    // multi-instance deploy are a footgun, so make it loud exactly once.\n    console.warn(\n      `ratefall: running with an in-memory store in production. Limits are per-instance and NOT shared. ` +\n        `Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN or pass a \\`redis\\` client. Pass \\`silent: true\\` to hide this.`,\n    )\n  }\n\n  const ctx: AlgorithmContext = { limit, windowMs, prefix }\n\n  return {\n    async limit(identifier: string) {\n      if (!identifier) {\n        throw new TypeError('ratefall: identifier must be a non-empty string.')\n      }\n      return run(store, ctx, identifier, Date.now())\n    },\n  }\n}\n\n/** The resolved store source, exposed for debugging/tests. */\nexport { resolveStore } from './resolve-store.js'\n"]}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "ratefall",
+  "version": "0.1.0",
+  "description": "A rate limiter that just works: distributed (Redis) in production, in-memory in development, same code, zero store wiring.",
+  "keywords": [
+    "rate-limit",
+    "rate-limiter",
+    "ratelimit",
+    "throttle",
+    "redis",
+    "upstash",
+    "edge",
+    "serverless",
+    "sliding-window",
+    "fixed-window"
+  ],
+  "license": "MIT",
+  "author": "Daniel Spatari <daniel@ghostrev.io> (https://danielspatari.com)",
+  "homepage": "https://github.com/thtsdaniel/ratefall#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/thtsdaniel/ratefall.git"
+  },
+  "bugs": {
+    "url": "https://github.com/thtsdaniel/ratefall/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run typecheck && npm run test && npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  }
+}