ratefall 0.1.0 → 0.2.0

package/README.md

@@ -28,6 +28,7 @@ Every app needs rate limiting, and every app ends up with the same boilerplate:
 - **Edge and serverless ready.** The built-in Upstash store uses `fetch`, so it runs on Node 18+, Vercel Edge, and Cloudflare Workers.
 - **Bring your own store.** Pass an `@upstash/redis` or `ioredis` client, or a fully custom store.
 - **Two algorithms.** Fixed window (cheap) and sliding window (smooth).
+- **One round trip.** Every Redis check is a single atomic Lua call, not a read plus a write.
 - **Typed end to end.** Written in TypeScript, ships ESM and CJS.
 
 ## Install
@@ -80,6 +81,66 @@ const limiter = rateLimit({
 })
 ```
 
+## One atomic round trip
+
+A rate limiter written the obvious way costs two commands on the first request
+of every window: `INCR`, then `PEXPIRE` if the counter came back as 1.
+
+That second command is not just overhead, it is a correctness problem. If the
+process dies between the two, the key has no expiry and stays in Redis forever.
+You can watch it happen:
+
+```
+redis> INCR mykey
+(integer) 1
+redis> TTL mykey
+(integer) -1        # no expiry, this key is now immortal
+```
+
+One orphan per identifier per window, and nothing ever collects them.
+
+`ratefall` runs each check as a single `EVAL`. One round trip, and a TTL that
+cannot be orphaned:
+
+```lua
+local count = redis.call('INCR', KEYS[1])
+if count == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return count
+```
+
+This is automatic. `ratefall` detects whether your client wants `ioredis` style
+arguments (`eval(script, numKeys, ...keys, ...args)`) or `@upstash/redis` style
+(`eval(script, keys[], args[])`) and calls it correctly. Override the detection
+with `evalStyle` if you need to, including `'none'` to stay on the portable
+path:
+
+```ts
+rateLimit({ limit: 100, window: '1m', redis: client, evalStyle: 'none' })
+```
+
+If the server rejects scripting (a managed Redis with `EVAL` disabled, a proxy
+that does not implement it), the store notices the first failure and falls back
+to `INCR` + `PEXPIRE` permanently. Nothing throws, and it does not retry the
+script on every subsequent request.
+
+### What the Lua path does not change
+
+It does not make the limiter more accurate under concurrency. It is tempting to
+assume the two-command sliding window races, but it does not overshoot: the
+previous window's counter is a completed window that nothing increments any
+more, so concurrent callers all read the same stable value, and `INCR` on the
+current counter is atomic, so each caller gets a distinct count. Measured over
+50 concurrent callers against a real Redis, both paths allow exactly the same
+number through. The wins here are the orphaned TTL and the round trip, not
+accuracy.
+
+Custom stores are unaffected: implement the three required methods and you get
+the portable path, or add the optional `fixedWindowStep` / `slidingWindowStep`
+and the algorithms will use them. See
+[`examples/custom-store.ts`](./examples/custom-store.ts).
+
 ## Algorithms
 
 ```ts
@@ -116,6 +177,16 @@ export async function POST(req: Request) {
 }
 ```
 
+## Examples
+
+Runnable snippets live in [`examples/`](./examples): a
+[Next.js route handler](./examples/next-route-handler.ts),
+[Express middleware](./examples/express-middleware.ts),
+[Hono on the edge](./examples/hono-edge.ts),
+[your own ioredis client](./examples/ioredis-client.ts),
+[a custom store](./examples/custom-store.ts), and
+[tiered limits sharing one store](./examples/tiered-limits.ts).
+
 ## API
 
 ### `rateLimit(options)`
@@ -128,6 +199,7 @@ export async function POST(req: Request) {
 | `prefix` | `string` | `'ratefall'` | Key namespace, so multiple limiters can share one store. |
 | `store` | `Store` | auto | An explicit store. Overrides everything else. |
 | `redis` | `RedisLike` | auto | A Redis client. Overrides env auto-detection. |
+| `evalStyle` | `'auto' \| 'ioredis' \| 'upstash' \| 'none'` | `'auto'` | How to call the Redis client's `eval`. `'none'` disables the Lua path. |
 | `silent` | `boolean` | `false` | Suppress the production in-memory warning. |
 
 Returns a `RateLimiter` with one method:
@@ -146,12 +218,13 @@ Returns a `RateLimiter` with one method:
 
 ## How it compares
 
-If you are all-in on Upstash and want every algorithm, analytics, and multi-region support, use [`@upstash/ratelimit`](https://github.com/upstash/ratelimit). `ratefall` is the smaller, zero-dependency option focused on one thing: the same limiter working from local dev to production without you wiring the store. It falls back to memory with no Redis at all, which `@upstash/ratelimit` does not.
+If you are all-in on Upstash and want every algorithm, analytics, and multi-region support, use [`@upstash/ratelimit`](https://github.com/upstash/ratelimit). `ratefall` is the smaller, zero-dependency option focused on one thing: the same limiter working from local dev to production without you wiring the store. It falls back to memory with no Redis at all, which `@upstash/ratelimit` does not, and it works with `ioredis` and any duck-typed client rather than only Upstash.
 
 ## Notes
 
 - The in-memory store is per-process. It is meant for local development and single-instance deploys, not shared production traffic.
-- Redis operations use `incr` plus a conditional `pexpire`. A Lua-based single-round-trip path is on the roadmap.
+- Redis operations run as a single atomic `EVAL`. The `INCR` + `PEXPIRE` path is kept as an automatic fallback for servers without scripting.
+- The Lua scripts are exercised against a real Redis in CI, not just against fakes. To run those locally: `docker run -p 6379:6379 redis:7-alpine` then `REDIS_URL=redis://localhost:6379 npm test`.
 
 ## License
 

package/dist/index.cjs

@@ -1,12 +1,17 @@
 'use strict';
 
 // src/algorithms/fixed-window.ts
+async function step(store, key, ttlMs) {
+  if (store.fixedWindowStep) return store.fixedWindowStep(key, ttlMs);
+  const count = await store.incr(key);
+  if (count === 1) await store.pexpire(key, ttlMs);
+  return count;
+}
 var fixedWindow = async (store, ctx, identifier, now) => {
   const { limit, windowMs, prefix } = ctx;
   const windowStart = Math.floor(now / windowMs) * windowMs;
   const key = `${prefix}:${identifier}:${windowStart}`;
-  const count = await store.incr(key);
-  if (count === 1) await store.pexpire(key, windowMs);
+  const count = await step(store, key, windowMs);
   const reset = windowStart + windowMs;
   const success = count <= limit;
   return {
@@ -19,6 +24,13 @@ var fixedWindow = async (store, ctx, identifier, now) => {
 };
 
 // src/algorithms/sliding-window.ts
+async function step2(store, currentKey, previousKey, ttlMs) {
+  if (store.slidingWindowStep) return store.slidingWindowStep(currentKey, previousKey, ttlMs);
+  const previous = await store.get(previousKey);
+  const current = await store.incr(currentKey);
+  if (current === 1) await store.pexpire(currentKey, ttlMs);
+  return [previous, current];
+}
 var slidingWindow = async (store, ctx, identifier, now) => {
   const { limit, windowMs, prefix } = ctx;
   const currentStart = Math.floor(now / windowMs) * windowMs;
@@ -26,9 +38,7 @@ var slidingWindow = async (store, ctx, identifier, now) => {
   const fraction = (now - currentStart) / windowMs;
   const currentKey = `${prefix}:${identifier}:${currentStart}`;
   const previousKey = `${prefix}:${identifier}:${previousStart}`;
-  const previousCount = await store.get(previousKey);
-  const currentCount = await store.incr(currentKey);
-  if (currentCount === 1) await store.pexpire(currentKey, windowMs * 2);
+  const [previousCount, currentCount] = await step2(store, currentKey, previousKey, windowMs * 2);
   const weighted = previousCount * (1 - fraction) + currentCount;
   const reset = currentStart + windowMs;
   const success = weighted <= limit;
@@ -77,6 +87,25 @@ var MemoryStore = class {
   async get(key) {
     return this.live(key)?.count ?? 0;
   }
+  /**
+   * Atomic fixed-window step. JavaScript is single threaded and none of this
+   * awaits, so the increment and the TTL land together with no interleaving.
+   */
+  async fixedWindowStep(key, ttlMs) {
+    const entry = this.live(key);
+    if (!entry) {
+      this.map.set(key, { count: 1, expiresAt: Date.now() + ttlMs });
+      return 1;
+    }
+    entry.count += 1;
+    return entry.count;
+  }
+  /** Atomic sliding-window step. Same reasoning as {@link fixedWindowStep}. */
+  async slidingWindowStep(currentKey, previousKey, ttlMs) {
+    const previous = this.live(previousKey)?.count ?? 0;
+    const current = await this.fixedWindowStep(currentKey, ttlMs);
+    return [previous, current];
+  }
   sweep() {
     const now = Date.now();
     for (const [key, entry] of this.map) {
@@ -89,12 +118,75 @@ var MemoryStore = class {
   }
 };
 
+// src/lua.ts
+var FIXED_WINDOW_SCRIPT = `
+local count = redis.call('INCR', KEYS[1])
+if count == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return count
+`.trim();
+var SLIDING_WINDOW_SCRIPT = `
+local previous = redis.call('GET', KEYS[2])
+local previousCount = 0
+if previous then
+  previousCount = math.floor(tonumber(previous) or 0)
+end
+local current = redis.call('INCR', KEYS[1])
+if current == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return { previousCount, current }
+`.trim();
+
 // src/stores/redis.ts
+function toCount(value) {
+  if (value == null || value === false) return 0;
+  const n = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(n) ? n : 0;
+}
+function detectEvalStyle(client) {
+  if (typeof client.eval !== "function") return "none";
+  if (typeof client.defineCommand === "function") return "ioredis";
+  return "upstash";
+}
 var RedisStore = class {
-  constructor(client) {
+  client;
+  style;
+  constructor(client, options = {}) {
     this.client = client;
+    const requested = options.evalStyle ?? "auto";
+    this.style = requested === "auto" ? detectEvalStyle(client) : requested;
+    if (this.style !== "none" && typeof client.eval !== "function") {
+      this.style = "none";
+    }
+  }
+  /** True when this store will take the atomic Lua path. */
+  get atomic() {
+    return this.style !== "none";
+  }
+  async runScript(script, keys, args) {
+    const evalFn = this.client.eval;
+    if (this.style === "ioredis") {
+      return evalFn.call(this.client, script, keys.length, ...keys, ...args);
+    }
+    return evalFn.call(this.client, script, keys, args);
+  }
+  /**
+   * Run `script`, falling back to the portable path forever if the server or
+   * client cannot handle scripting. A single failure is enough to decide: a
+   * server either supports EVAL or it does not, so retrying every request would
+   * just double the cost of every check on that deployment.
+   */
+  async tryScript(script, keys, args, parse) {
+    if (this.style === "none") return void 0;
+    try {
+      return parse(await this.runScript(script, keys, args));
+    } catch {
+      this.style = "none";
+      return void 0;
+    }
   }
-  client;
   async incr(key) {
     return this.client.incr(key);
   }
@@ -102,14 +194,39 @@ var RedisStore = class {
     await this.client.pexpire(key, ms);
   }
   async get(key) {
-    const value = await this.client.get(key);
-    if (value == null) return 0;
-    const n = typeof value === "number" ? value : Number(value);
-    return Number.isFinite(n) ? n : 0;
+    return toCount(await this.client.get(key));
+  }
+  async fixedWindowStep(key, ttlMs) {
+    const viaScript = await this.tryScript(FIXED_WINDOW_SCRIPT, [key], [ttlMs], toCount);
+    if (viaScript !== void 0) return viaScript;
+    const count = await this.incr(key);
+    if (count === 1) await this.pexpire(key, ttlMs);
+    return count;
+  }
+  async slidingWindowStep(currentKey, previousKey, ttlMs) {
+    const viaScript = await this.tryScript(
+      SLIDING_WINDOW_SCRIPT,
+      [currentKey, previousKey],
+      [ttlMs],
+      (raw) => {
+        const pair = raw;
+        return [toCount(pair?.[0]), toCount(pair?.[1])];
+      }
+    );
+    if (viaScript !== void 0) return viaScript;
+    const previous = await this.get(previousKey);
+    const current = await this.incr(currentKey);
+    if (current === 1) await this.pexpire(currentKey, ttlMs);
+    return [previous, current];
   }
 };
 
 // src/stores/upstash-rest.ts
+function toCount2(value) {
+  if (value == null || value === false) return 0;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : 0;
+}
 var UpstashRestStore = class {
   url;
   token;
@@ -149,10 +266,18 @@ var UpstashRestStore = class {
     await this.command(["PEXPIRE", key, ms]);
   }
   async get(key) {
-    const result = await this.command(["GET", key]);
-    if (result == null) return 0;
-    const n = Number(result);
-    return Number.isFinite(n) ? n : 0;
+    return toCount2(await this.command(["GET", key]));
+  }
+  /** Run a Lua script through the REST API. Keys come first, then args. */
+  async evalScript(script, keys, args) {
+    return this.command(["EVAL", script, keys.length, ...keys, ...args]);
+  }
+  async fixedWindowStep(key, ttlMs) {
+    return toCount2(await this.evalScript(FIXED_WINDOW_SCRIPT, [key], [ttlMs]));
+  }
+  async slidingWindowStep(currentKey, previousKey, ttlMs) {
+    const raw = await this.evalScript(SLIDING_WINDOW_SCRIPT, [currentKey, previousKey], [ttlMs]);
+    return [toCount2(raw?.[0]), toCount2(raw?.[1])];
   }
 };
 
@@ -166,7 +291,12 @@ function resolveStore(options) {
     return { store: options.store, distributed: true, source: "custom store" };
   }
   if (options.redis) {
-    return { store: new RedisStore(options.redis), distributed: true, source: "redis client" };
+    const store = new RedisStore(options.redis, { evalStyle: options.evalStyle });
+    return {
+      store,
+      distributed: true,
+      source: store.atomic ? "redis client (atomic)" : "redis client"
+    };
   }
   const url = readEnv("UPSTASH_REDIS_REST_URL");
   const token = readEnv("UPSTASH_REDIS_REST_TOKEN");
@@ -240,9 +370,12 @@ function rateLimit(options) {
   };
 }
 
+exports.FIXED_WINDOW_SCRIPT = FIXED_WINDOW_SCRIPT;
 exports.MemoryStore = MemoryStore;
 exports.RedisStore = RedisStore;
+exports.SLIDING_WINDOW_SCRIPT = SLIDING_WINDOW_SCRIPT;
 exports.UpstashRestStore = UpstashRestStore;
+exports.detectEvalStyle = detectEvalStyle;
 exports.parseWindow = parseWindow;
 exports.rateLimit = rateLimit;
 exports.resolveStore = resolveStore;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/algorithms/fixed-window.ts","../src/algorithms/sliding-window.ts","../src/stores/memory.ts","../src/stores/redis.ts","../src/stores/upstash-rest.ts","../src/resolve-store.ts","../src/window.ts","../src/rate-limit.ts"],"names":[],"mappings":";;;AAOO,IAAM,WAAA,GAA2B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC7E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AACjD,EAAA,MAAM,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,WAAW,CAAA,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAClC,EAAA,IAAI,UAAU,CAAA,EAAG,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,QAAQ,CAAA;AAElD,EAAA,MAAM,QAAQ,WAAA,GAAc,QAAA;AAC5B,EAAA,MAAM,UAAU,KAAA,IAAS,KAAA;AACzB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,KAAK,CAAA;AAAA,IACpC,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;ACjBO,IAAM,aAAA,GAA6B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC/E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AAClD,EAAA,MAAM,gBAAgB,YAAA,GAAe,QAAA;AACrC,EAAA,MAAM,QAAA,GAAA,CAAY,MAAM,YAAA,IAAgB,QAAA;AAExC,EAAA,MAAM,aAAa,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,YAAY,CAAA,CAAA;AAC1D,EAAA,MAAM,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,aAAa,CAAA,CAAA;AAE5D,EAAA,MAAM,aAAA,GAAgB,MAAM,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AACjD,EAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA;AAEhD,EAAA,IAAI,iBAAiB,CAAA,EAAG,MAAM,MAAM,OAAA,CAAQ,UAAA,EAAY,WAAW,CAAC,CAAA;AAEpE,EAAA,MAAM,QAAA,GAAW,aAAA,IAAiB,CAAA,GAAI,QAAA,CAAA,GAAY,YAAA;AAClD,EAAA,MAAM,QAAQ,YAAA,GAAe,QAAA;AAC7B,EAAA,MAAM,UAAU,QAAA,IAAY,KAAA;AAC5B,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,KAAA,GAAQ,QAAQ,CAAC,CAAA;AAAA,IACnD,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;AClBO,IAAM,cAAN,MAAmC;AAAA,EACvB,GAAA,uBAAU,GAAA,EAAmB;AAAA,EAC7B,OAAA;AAAA;AAAA,EAGjB,WAAA,CAAY,UAAU,GAAA,EAAQ;AAC5B,IAAA,IAAI,OAAA,GAAU,CAAA,IAAK,OAAO,WAAA,KAAgB,UAAA,EAAY;AACpD,MAAA,IAAA,CAAK,UAAU,WAAA,CAAY,MAAM,IAAA,CAAK,KAAA,IAAS,OAAO,CAAA;AAEtD,MAAA,IAAA,CAAK,QAAQ,KAAA,IAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEQ,KAAK,GAAA,EAAgC;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,EAAG;AACjC,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AACnB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO;AAEV,MAAA,IAAA,CAAK,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,OAAO,CAAA,EAAG,SAAA,EAAW,MAAA,CAAO,iBAAA,EAAmB,CAAA;AACnE,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,KAAA,EAAO,KAAA,CAAM,SAAA,GAAY,IAAA,CAAK,KAAI,GAAI,EAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAG,KAAA,IAAS,CAAA;AAAA,EAClC;AAAA,EAEQ,KAAA,GAAc;AACpB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAK,GAAA,EAAK;AACnC,MAAA,IAAI,MAAM,SAAA,IAAa,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AAAA,IACjD;AAAA,EACF;AAAA;AAAA,EAGA,OAAA,GAAgB;AACd,IAAA,IAAI,IAAA,CAAK,OAAA,EAAS,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9C;AACF;;;AC7DO,IAAM,aAAN,MAAkC;AAAA,EACvC,YAA6B,MAAA,EAAmB;AAAnB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAoB;AAAA,EAApB,MAAA;AAAA,EAE7B,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,IAAI,GAAG,CAAA;AACvC,IAAA,IAAI,KAAA,IAAS,MAAM,OAAO,CAAA;AAC1B,IAAA,MAAM,IAAI,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAK,CAAA;AAC1D,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,EAClC;AACF;;;ACTO,IAAM,mBAAN,MAAwC;AAAA,EAC5B,GAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EAEjB,YAAY,OAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxC,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AACrB,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AACtC,IAAA,IAAI,OAAO,MAAM,UAAA,EAAY;AAC3B,MAAA,MAAM,IAAI,MAAM,yFAAyF,CAAA;AAAA,IAC3G;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AAAA,EACnB;AAAA,EAEA,MAAc,QAAQ,IAAA,EAA6C;AACjE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,GAAA,EAAK;AAAA,MACzC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,QACnC,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAC;AAAA,KACtC,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,SAAS,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC9C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,EAAG,MAAA,GAAS,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,IAC/G;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,MAAA,CAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAC,CAAA;AAAA,EACjD;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAK,OAAA,CAAQ,CAAC,SAAA,EAAW,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,QAAQ,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAC9C,IAAA,IAAI,MAAA,IAAU,MAAM,OAAO,CAAA;AAC3B,IAAA,MAAM,CAAA,GAAI,OAAO,MAAM,CAAA;AACvB,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,EAClC;AACF;;;AClDA,SAAS,QAAQ,GAAA,EAAiC;AAChD,EAAA,MAAM,GAAA,GAAO,WAA0E,OAAA,EAAS,GAAA;AAChG,EAAA,OAAO,MAAM,GAAG,CAAA;AAClB;AASO,SAAS,aAAa,OAAA,EAA0C;AACrE,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,WAAA,EAAa,IAAA,EAAM,QAAQ,cAAA,EAAe;AAAA,EAC3E;AAEA,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,UAAA,CAAW,OAAA,CAAQ,KAAK,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,cAAA,EAAe;AAAA,EAC3F;AAEA,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAQ,0BAA0B,CAAA;AAChD,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,oBAAA,EAAqB;AAAA,EACxG;AAEA,EAAA,OAAO,EAAE,OAAO,IAAI,WAAA,IAAe,WAAA,EAAa,KAAA,EAAO,QAAQ,WAAA,EAAY;AAC7E;AAGO,SAAS,YAAA,GAAwB;AACtC,EAAA,OAAO,OAAA,CAAQ,UAAU,CAAA,KAAM,YAAA;AACjC;;;AC9CA,IAAM,KAAA,GAAgC;AAAA,EACpC,EAAA,EAAI,CAAA;AAAA,EACJ,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,IAAA;AAAA,EACH,CAAA,EAAG;AACL,CAAA;AAEA,IAAM,OAAA,GAAU,kCAAA;AAMT,SAAS,YAAY,MAAA,EAAiC;AAC3D,EAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,UAAU,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gEAAA,EAAmE,MAAM,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,0BAAA,EAA6B,MAAM,CAAA,yDAAA,CAA2D,CAAA;AAAA,EACpH;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAC,CAAW,CAAA;AACrC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,IAAI,CAAA;AAClC,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,8CAAA,EAAiD,MAAM,CAAA,EAAA,CAAI,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,EAAA;AACT;;;AC3BA,IAAM,UAAA,GAA0C;AAAA,EAC9C,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB;AACpB,CAAA;AAYO,SAAS,UAAU,OAAA,EAAwC;AAChE,EAAA,MAAM,EAAE,OAAO,SAAA,GAAY,cAAA,EAAgB,SAAS,UAAA,EAAY,MAAA,GAAS,OAAM,GAAI,OAAA;AAEnF,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gDAAA,EAAmD,KAAK,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,WAAW,SAAS,CAAA;AAChC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,6BAAA,EAAgC,SAAS,CAAA,0CAAA,CAA4C,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AAC3C,EAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAO,GAAI,aAAa,OAAO,CAAA;AAE3D,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,MAAA,IAAU,cAAa,EAAG;AAG7C,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,sNAAA;AAAA,KAEF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAwB,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO;AAExD,EAAA,OAAO;AAAA,IACL,MAAM,MAAM,UAAA,EAAoB;AAC9B,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,MAAM,IAAI,UAAU,kDAAkD,CAAA;AAAA,MACxE;AACA,MAAA,OAAO,IAAI,KAAA,EAAO,GAAA,EAAK,UAAA,EAAY,IAAA,CAAK,KAAK,CAAA;AAAA,IAC/C;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["import type { AlgorithmFn } from './index.js'\n\n/**\n * Fixed-window counter. Divides time into contiguous windows of `windowMs` and\n * counts requests per window. Simple and cheap (one counter per window), at the\n * cost of allowing up to 2x `limit` across a window boundary in the worst case.\n */\nexport const fixedWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const windowStart = Math.floor(now / windowMs) * windowMs\n  const key = `${prefix}:${identifier}:${windowStart}`\n\n  const count = await store.incr(key)\n  if (count === 1) await store.pexpire(key, windowMs)\n\n  const reset = windowStart + windowMs\n  const success = count <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, limit - count),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { AlgorithmFn } from './index.js'\n\n/**\n * Sliding-window counter. Weights the previous window's count by how far the\n * current window has elapsed and adds the current count, smoothing out the\n * boundary bursts that fixed-window allows. Uses two counters per identifier.\n */\nexport const slidingWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const currentStart = Math.floor(now / windowMs) * windowMs\n  const previousStart = currentStart - windowMs\n  const fraction = (now - currentStart) / windowMs // 0..1 through the current window\n\n  const currentKey = `${prefix}:${identifier}:${currentStart}`\n  const previousKey = `${prefix}:${identifier}:${previousStart}`\n\n  const previousCount = await store.get(previousKey)\n  const currentCount = await store.incr(currentKey)\n  // Keep the counter alive long enough to still be read as \"previous\" next window.\n  if (currentCount === 1) await store.pexpire(currentKey, windowMs * 2)\n\n  const weighted = previousCount * (1 - fraction) + currentCount\n  const reset = currentStart + windowMs\n  const success = weighted <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, Math.floor(limit - weighted)),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { Store } from '../types.js'\n\ninterface Entry {\n  count: number\n  expiresAt: number\n}\n\n/**\n * In-process counter store. Used as the automatic fallback when no Redis is\n * configured. State is per-instance and not shared across processes, so it is\n * meant for local development and single-instance deployments, not distributed\n * production traffic.\n */\nexport class MemoryStore implements Store {\n  private readonly map = new Map<string, Entry>()\n  private readonly sweeper: ReturnType<typeof setInterval> | undefined\n\n  /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */\n  constructor(sweepMs = 30_000) {\n    if (sweepMs > 0 && typeof setInterval === 'function') {\n      this.sweeper = setInterval(() => this.sweep(), sweepMs)\n      // Never keep the event loop alive for cleanup alone.\n      this.sweeper.unref?.()\n    }\n  }\n\n  private live(key: string): Entry | undefined {\n    const entry = this.map.get(key)\n    if (!entry) return undefined\n    if (entry.expiresAt <= Date.now()) {\n      this.map.delete(key)\n      return undefined\n    }\n    return entry\n  }\n\n  async incr(key: string): Promise<number> {\n    const entry = this.live(key)\n    if (!entry) {\n      // Default to no expiry; pexpire is expected to follow on the first hit.\n      this.map.set(key, { count: 1, expiresAt: Number.POSITIVE_INFINITY })\n      return 1\n    }\n    entry.count += 1\n    return entry.count\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    const entry = this.live(key)\n    if (entry) entry.expiresAt = Date.now() + ms\n  }\n\n  async get(key: string): Promise<number> {\n    return this.live(key)?.count ?? 0\n  }\n\n  private sweep(): void {\n    const now = Date.now()\n    for (const [key, entry] of this.map) {\n      if (entry.expiresAt <= now) this.map.delete(key)\n    }\n  }\n\n  /** Stop the background sweeper. Optional; the timer is unref'd. */\n  dispose(): void {\n    if (this.sweeper) clearInterval(this.sweeper)\n  }\n}\n","import type { RedisLike, Store } from '../types.js'\n\n/**\n * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`\n * and `ioredis` qualify) to the {@link Store} interface.\n */\nexport class RedisStore implements Store {\n  constructor(private readonly client: RedisLike) {}\n\n  async incr(key: string): Promise<number> {\n    return this.client.incr(key)\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.client.pexpire(key, ms)\n  }\n\n  async get(key: string): Promise<number> {\n    const value = await this.client.get(key)\n    if (value == null) return 0\n    const n = typeof value === 'number' ? value : Number(value)\n    return Number.isFinite(n) ? n : 0\n  }\n}\n","import type { Store } from '../types.js'\n\nexport interface UpstashRestOptions {\n  url: string\n  token: string\n  /** Custom fetch implementation. Defaults to the global `fetch`. */\n  fetch?: typeof fetch\n}\n\n/**\n * Zero-dependency store backed by the Upstash Redis REST API. Uses `fetch`, so\n * it runs anywhere the runtime provides one (Node 18+, edge, workers) without\n * pulling in a Redis client. This is what env auto-detection constructs.\n */\nexport class UpstashRestStore implements Store {\n  private readonly url: string\n  private readonly token: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: UpstashRestOptions) {\n    this.url = options.url.replace(/\\/$/, '')\n    this.token = options.token\n    const f = options.fetch ?? globalThis.fetch\n    if (typeof f !== 'function') {\n      throw new Error('ratefall: no global fetch available; pass a `fetch` implementation to UpstashRestStore.')\n    }\n    this.fetchImpl = f\n  }\n\n  private async command(args: (string | number)[]): Promise<unknown> {\n    const res = await this.fetchImpl(this.url, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.token}`,\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(args.map(String)),\n    })\n    if (!res.ok) {\n      const detail = await res.text().catch(() => '')\n      throw new Error(`ratefall: Upstash REST error ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ''}`)\n    }\n    const body = (await res.json()) as { result?: unknown; error?: string }\n    if (body.error) {\n      throw new Error(`ratefall: Upstash command failed - ${body.error}`)\n    }\n    return body.result\n  }\n\n  async incr(key: string): Promise<number> {\n    return Number(await this.command(['INCR', key]))\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.command(['PEXPIRE', key, ms])\n  }\n\n  async get(key: string): Promise<number> {\n    const result = await this.command(['GET', key])\n    if (result == null) return 0\n    const n = Number(result)\n    return Number.isFinite(n) ? n : 0\n  }\n}\n","import type { RateLimitOptions, Store } from './types.js'\nimport { MemoryStore } from './stores/memory.js'\nimport { RedisStore } from './stores/redis.js'\nimport { UpstashRestStore } from './stores/upstash-rest.js'\n\nexport interface ResolvedStore {\n  store: Store\n  /** Whether the store is shared across processes (Redis) vs per-instance (memory). */\n  distributed: boolean\n  /** Human-readable source, for the dev warning. */\n  source: string\n}\n\nfunction readEnv(key: string): string | undefined {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env\n  return env?.[key]\n}\n\n/**\n * Decide which store to use, in priority order:\n * 1. an explicit `store`\n * 2. an explicit `redis` client\n * 3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment\n * 4. in-memory fallback\n */\nexport function resolveStore(options: RateLimitOptions): ResolvedStore {\n  if (options.store) {\n    return { store: options.store, distributed: true, source: 'custom store' }\n  }\n\n  if (options.redis) {\n    return { store: new RedisStore(options.redis), distributed: true, source: 'redis client' }\n  }\n\n  const url = readEnv('UPSTASH_REDIS_REST_URL')\n  const token = readEnv('UPSTASH_REDIS_REST_TOKEN')\n  if (url && token) {\n    return { store: new UpstashRestStore({ url, token }), distributed: true, source: 'Upstash REST (env)' }\n  }\n\n  return { store: new MemoryStore(), distributed: false, source: 'in-memory' }\n}\n\n/** True when the runtime looks like a production deployment. */\nexport function isProduction(): boolean {\n  return readEnv('NODE_ENV') === 'production'\n}\n","const UNITS: Record<string, number> = {\n  ms: 1,\n  s: 1000,\n  m: 60_000,\n  h: 3_600_000,\n  d: 86_400_000,\n}\n\nconst PATTERN = /^(\\d+(?:\\.\\d+)?)\\s*(ms|s|m|h|d)$/\n\n/**\n * Normalize a window into milliseconds. Accepts a raw millisecond number or a\n * duration string like `'500ms'`, `'10s'`, `'1m'`, `'2h'`, `'1d'`.\n */\nexport function parseWindow(window: string | number): number {\n  if (typeof window === 'number') {\n    if (!Number.isFinite(window) || window <= 0) {\n      throw new RangeError(`ratefall: window must be a positive number of milliseconds, got ${window}`)\n    }\n    return Math.floor(window)\n  }\n\n  const match = PATTERN.exec(window.trim())\n  if (!match) {\n    throw new TypeError(`ratefall: invalid window \"${window}\". Use a number of ms or a string like \"10s\", \"1m\", \"2h\".`)\n  }\n\n  const value = Number(match[1])\n  const unit = UNITS[match[2] as string] as number\n  const ms = Math.floor(value * unit)\n  if (ms <= 0) {\n    throw new RangeError(`ratefall: window must be greater than 0, got \"${window}\".`)\n  }\n  return ms\n}\n","import type { AlgorithmContext, AlgorithmFn } from './algorithms/index.js'\nimport { fixedWindow } from './algorithms/fixed-window.js'\nimport { slidingWindow } from './algorithms/sliding-window.js'\nimport { isProduction, resolveStore } from './resolve-store.js'\nimport type { RateLimiter, RateLimitOptions } from './types.js'\nimport { parseWindow } from './window.js'\n\nconst ALGORITHMS: Record<string, AlgorithmFn> = {\n  'fixed-window': fixedWindow,\n  'sliding-window': slidingWindow,\n}\n\n/**\n * Create a rate limiter. With no store configured it uses an in-memory counter\n * (great for local dev); set `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN`,\n * or pass a `redis` client, and the exact same code becomes distributed.\n *\n * @example\n * const limiter = rateLimit({ limit: 10, window: '10s' })\n * const { success } = await limiter.limit(userId)\n * if (!success) return new Response('slow down', { status: 429 })\n */\nexport function rateLimit(options: RateLimitOptions): RateLimiter {\n  const { limit, algorithm = 'fixed-window', prefix = 'ratefall', silent = false } = options\n\n  if (!Number.isInteger(limit) || limit <= 0) {\n    throw new RangeError(`ratefall: limit must be a positive integer, got ${limit}`)\n  }\n\n  const run = ALGORITHMS[algorithm]\n  if (!run) {\n    throw new TypeError(`ratefall: unknown algorithm \"${algorithm}\". Use \"fixed-window\" or \"sliding-window\".`)\n  }\n\n  const windowMs = parseWindow(options.window)\n  const { store, distributed, source } = resolveStore(options)\n\n  if (!distributed && !silent && isProduction()) {\n    // Not an error: single-instance prod is legitimate. But un-shared limits in a\n    // multi-instance deploy are a footgun, so make it loud exactly once.\n    console.warn(\n      `ratefall: running with an in-memory store in production. Limits are per-instance and NOT shared. ` +\n        `Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN or pass a \\`redis\\` client. Pass \\`silent: true\\` to hide this.`,\n    )\n  }\n\n  const ctx: AlgorithmContext = { limit, windowMs, prefix }\n\n  return {\n    async limit(identifier: string) {\n      if (!identifier) {\n        throw new TypeError('ratefall: identifier must be a non-empty string.')\n      }\n      return run(store, ctx, identifier, Date.now())\n    },\n  }\n}\n\n/** The resolved store source, exposed for debugging/tests. */\nexport { resolveStore } from './resolve-store.js'\n"]}
+{"version":3,"sources":["../src/algorithms/fixed-window.ts","../src/algorithms/sliding-window.ts","../src/stores/memory.ts","../src/lua.ts","../src/stores/redis.ts","../src/stores/upstash-rest.ts","../src/resolve-store.ts","../src/window.ts","../src/rate-limit.ts"],"names":["step","toCount"],"mappings":";;;AAQA,eAAe,IAAA,CAAK,KAAA,EAAc,GAAA,EAAa,KAAA,EAAgC;AAC7E,EAAA,IAAI,MAAM,eAAA,EAAiB,OAAO,KAAA,CAAM,eAAA,CAAgB,KAAK,KAAK,CAAA;AAElE,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAClC,EAAA,IAAI,UAAU,CAAA,EAAG,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,KAAK,CAAA;AAC/C,EAAA,OAAO,KAAA;AACT;AAOO,IAAM,WAAA,GAA2B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC7E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AACjD,EAAA,MAAM,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,WAAW,CAAA,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,KAAA,EAAO,KAAK,QAAQ,CAAA;AAE7C,EAAA,MAAM,QAAQ,WAAA,GAAc,QAAA;AAC5B,EAAA,MAAM,UAAU,KAAA,IAAS,KAAA;AACzB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,KAAK,CAAA;AAAA,IACpC,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;ACvBA,eAAeA,KAAAA,CACb,KAAA,EACA,UAAA,EACA,WAAA,EACA,KAAA,EAC2B;AAC3B,EAAA,IAAI,MAAM,iBAAA,EAAmB,OAAO,MAAM,iBAAA,CAAkB,UAAA,EAAY,aAAa,KAAK,CAAA;AAE1F,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,YAAY,CAAA,EAAG,MAAM,KAAA,CAAM,OAAA,CAAQ,YAAY,KAAK,CAAA;AACxD,EAAA,OAAO,CAAC,UAAU,OAAO,CAAA;AAC3B;AAOO,IAAM,aAAA,GAA6B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC/E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AAClD,EAAA,MAAM,gBAAgB,YAAA,GAAe,QAAA;AACrC,EAAA,MAAM,QAAA,GAAA,CAAY,MAAM,YAAA,IAAgB,QAAA;AAExC,EAAA,MAAM,aAAa,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,YAAY,CAAA,CAAA;AAC1D,EAAA,MAAM,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,aAAa,CAAA,CAAA;AAI5D,EAAA,MAAM,CAAC,aAAA,EAAe,YAAY,CAAA,GAAI,MAAMA,MAAK,KAAA,EAAO,UAAA,EAAY,WAAA,EAAa,QAAA,GAAW,CAAC,CAAA;AAE7F,EAAA,MAAM,QAAA,GAAW,aAAA,IAAiB,CAAA,GAAI,QAAA,CAAA,GAAY,YAAA;AAClD,EAAA,MAAM,QAAQ,YAAA,GAAe,QAAA;AAC7B,EAAA,MAAM,UAAU,QAAA,IAAY,KAAA;AAC5B,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,KAAA,GAAQ,QAAQ,CAAC,CAAA;AAAA,IACnD,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;AC3CO,IAAM,cAAN,MAAmC;AAAA,EACvB,GAAA,uBAAU,GAAA,EAAmB;AAAA,EAC7B,OAAA;AAAA;AAAA,EAGjB,WAAA,CAAY,UAAU,GAAA,EAAQ;AAC5B,IAAA,IAAI,OAAA,GAAU,CAAA,IAAK,OAAO,WAAA,KAAgB,UAAA,EAAY;AACpD,MAAA,IAAA,CAAK,UAAU,WAAA,CAAY,MAAM,IAAA,CAAK,KAAA,IAAS,OAAO,CAAA;AAEtD,MAAA,IAAA,CAAK,QAAQ,KAAA,IAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEQ,KAAK,GAAA,EAAgC;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,EAAG;AACjC,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AACnB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO;AAEV,MAAA,IAAA,CAAK,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,OAAO,CAAA,EAAG,SAAA,EAAW,MAAA,CAAO,iBAAA,EAAmB,CAAA;AACnE,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,KAAA,EAAO,KAAA,CAAM,SAAA,GAAY,IAAA,CAAK,KAAI,GAAI,EAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAG,KAAA,IAAS,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAA,CAAgB,GAAA,EAAa,KAAA,EAAgC;AACjE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,EAAE,KAAA,EAAO,CAAA,EAAG,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,EAAO,CAAA;AAC7D,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf;AAAA;AAAA,EAGA,MAAM,iBAAA,CACJ,UAAA,EACA,WAAA,EACA,KAAA,EAC2B;AAC3B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,WAAW,GAAG,KAAA,IAAS,CAAA;AAClD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,eAAA,CAAgB,YAAY,KAAK,CAAA;AAC5D,IAAA,OAAO,CAAC,UAAU,OAAO,CAAA;AAAA,EAC3B;AAAA,EAEQ,KAAA,GAAc;AACpB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAK,GAAA,EAAK;AACnC,MAAA,IAAI,MAAM,SAAA,IAAa,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AAAA,IACjD;AAAA,EACF;AAAA;AAAA,EAGA,OAAA,GAAgB;AACd,IAAA,IAAI,IAAA,CAAK,OAAA,EAAS,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9C;AACF;;;AChEO,IAAM,mBAAA,GAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAMjC,IAAA;AAYK,IAAM,qBAAA,GAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAWnC,IAAA;;;AChDF,SAAS,QAAQ,KAAA,EAAwB;AACvC,EAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,KAAU,KAAA,EAAO,OAAO,CAAA;AAC7C,EAAA,MAAM,IAAI,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAK,CAAA;AAC1D,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAClC;AASO,SAAS,gBAAgB,MAAA,EAA+C;AAC7E,EAAA,IAAI,OAAO,MAAA,CAAO,IAAA,KAAS,UAAA,EAAY,OAAO,MAAA;AAC9C,EAAA,IAAI,OAAQ,MAAA,CAAuC,aAAA,KAAkB,UAAA,EAAY,OAAO,SAAA;AACxF,EAAA,OAAO,SAAA;AACT;AAUO,IAAM,aAAN,MAAkC;AAAA,EACtB,MAAA;AAAA,EACT,KAAA;AAAA,EAER,WAAA,CAAY,MAAA,EAAmB,OAAA,GAA6B,EAAC,EAAG;AAC9D,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,MAAA;AACvC,IAAA,IAAA,CAAK,KAAA,GAAQ,SAAA,KAAc,MAAA,GAAS,eAAA,CAAgB,MAAM,CAAA,GAAI,SAAA;AAC9D,IAAA,IAAI,KAAK,KAAA,KAAU,MAAA,IAAU,OAAO,MAAA,CAAO,SAAS,UAAA,EAAY;AAE9D,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,IACf;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAAkB;AACpB,IAAA,OAAO,KAAK,KAAA,KAAU,MAAA;AAAA,EACxB;AAAA,EAEA,MAAc,SAAA,CAAU,MAAA,EAAgB,IAAA,EAAgB,IAAA,EAA6C;AACnG,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,IAAA;AAC3B,IAAA,IAAI,IAAA,CAAK,UAAU,SAAA,EAAW;AAC5B,MAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,MAAA,EAAQ,KAAK,MAAA,EAAQ,GAAG,IAAA,EAAM,GAAG,IAAI,CAAA;AAAA,IACvE;AACA,IAAA,OAAO,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,SAAA,CACZ,MAAA,EACA,IAAA,EACA,MACA,KAAA,EACwB;AACxB,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAQ,OAAO,MAAA;AAClC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AACb,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAO,QAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAM,eAAA,CAAgB,GAAA,EAAa,KAAA,EAAgC;AACjE,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,SAAA,CAAU,mBAAA,EAAqB,CAAC,GAAG,CAAA,EAAG,CAAC,KAAK,CAAA,EAAG,OAAO,CAAA;AACnF,IAAA,IAAI,SAAA,KAAc,QAAW,OAAO,SAAA;AAEpC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AACjC,IAAA,IAAI,UAAU,CAAA,EAAG,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,KAAK,CAAA;AAC9C,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,iBAAA,CACJ,UAAA,EACA,WAAA,EACA,KAAA,EAC2B;AAC3B,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,SAAA;AAAA,MAC3B,qBAAA;AAAA,MACA,CAAC,YAAY,WAAW,CAAA;AAAA,MACxB,CAAC,KAAK,CAAA;AAAA,MACN,CAAC,GAAA,KAA0B;AACzB,QAAA,MAAM,IAAA,GAAO,GAAA;AACb,QAAA,OAAO,CAAC,OAAA,CAAQ,IAAA,GAAO,CAAC,CAAC,GAAG,OAAA,CAAQ,IAAA,GAAO,CAAC,CAAC,CAAC,CAAA;AAAA,MAChD;AAAA,KACF;AACA,IAAA,IAAI,SAAA,KAAc,QAAW,OAAO,SAAA;AAEpC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAAI,WAAW,CAAA;AAC3C,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA;AAC1C,IAAA,IAAI,YAAY,CAAA,EAAG,MAAM,IAAA,CAAK,OAAA,CAAQ,YAAY,KAAK,CAAA;AACvD,IAAA,OAAO,CAAC,UAAU,OAAO,CAAA;AAAA,EAC3B;AACF;;;ACnHA,SAASC,SAAQ,KAAA,EAAwB;AACvC,EAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,KAAU,KAAA,EAAO,OAAO,CAAA;AAC7C,EAAA,MAAM,CAAA,GAAI,OAAO,KAAK,CAAA;AACtB,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAClC;AAOO,IAAM,mBAAN,MAAwC;AAAA,EAC5B,GAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EAEjB,YAAY,OAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxC,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AACrB,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AACtC,IAAA,IAAI,OAAO,MAAM,UAAA,EAAY;AAC3B,MAAA,MAAM,IAAI,MAAM,yFAAyF,CAAA;AAAA,IAC3G;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AAAA,EACnB;AAAA,EAEA,MAAc,QAAQ,IAAA,EAA6C;AACjE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,GAAA,EAAK;AAAA,MACzC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,QACnC,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAC;AAAA,KACtC,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,SAAS,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC9C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,EAAG,MAAA,GAAS,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,IAC/G;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,MAAA,CAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAC,CAAA;AAAA,EACjD;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAK,OAAA,CAAQ,CAAC,SAAA,EAAW,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAOA,QAAAA,CAAQ,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAG,CAAC,CAAC,CAAA;AAAA,EACjD;AAAA;AAAA,EAGA,MAAc,UAAA,CACZ,MAAA,EACA,IAAA,EACA,IAAA,EACkB;AAClB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,GAAG,IAAA,EAAM,GAAG,IAAI,CAAC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,eAAA,CAAgB,GAAA,EAAa,KAAA,EAAgC;AACjE,IAAA,OAAOA,QAAAA,CAAQ,MAAM,IAAA,CAAK,UAAA,CAAW,mBAAA,EAAqB,CAAC,GAAG,CAAA,EAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,iBAAA,CACJ,UAAA,EACA,WAAA,EACA,KAAA,EAC2B;AAC3B,IAAA,MAAM,GAAA,GAAO,MAAM,IAAA,CAAK,UAAA,CAAW,qBAAA,EAAuB,CAAC,UAAA,EAAY,WAAW,CAAA,EAAG,CAAC,KAAK,CAAC,CAAA;AAC5F,IAAA,OAAO,CAACA,QAAAA,CAAQ,GAAA,GAAM,CAAC,CAAC,GAAGA,QAAAA,CAAQ,GAAA,GAAM,CAAC,CAAC,CAAC,CAAA;AAAA,EAC9C;AACF;;;AC7EA,SAAS,QAAQ,GAAA,EAAiC;AAChD,EAAA,MAAM,GAAA,GAAO,WAA0E,OAAA,EAAS,GAAA;AAChG,EAAA,OAAO,MAAM,GAAG,CAAA;AAClB;AASO,SAAS,aAAa,OAAA,EAA0C;AACrE,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,WAAA,EAAa,IAAA,EAAM,QAAQ,cAAA,EAAe;AAAA,EAC3E;AAEA,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,OAAA,CAAQ,OAAO,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAW,CAAA;AAC5E,IAAA,OAAO;AAAA,MACL,KAAA;AAAA,MACA,WAAA,EAAa,IAAA;AAAA,MACb,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,uBAAA,GAA0B;AAAA,KACnD;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAQ,0BAA0B,CAAA;AAChD,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,oBAAA,EAAqB;AAAA,EACxG;AAEA,EAAA,OAAO,EAAE,OAAO,IAAI,WAAA,IAAe,WAAA,EAAa,KAAA,EAAO,QAAQ,WAAA,EAAY;AAC7E;AAGO,SAAS,YAAA,GAAwB;AACtC,EAAA,OAAO,OAAA,CAAQ,UAAU,CAAA,KAAM,YAAA;AACjC;;;ACnDA,IAAM,KAAA,GAAgC;AAAA,EACpC,EAAA,EAAI,CAAA;AAAA,EACJ,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,IAAA;AAAA,EACH,CAAA,EAAG;AACL,CAAA;AAEA,IAAM,OAAA,GAAU,kCAAA;AAMT,SAAS,YAAY,MAAA,EAAiC;AAC3D,EAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,UAAU,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gEAAA,EAAmE,MAAM,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,0BAAA,EAA6B,MAAM,CAAA,yDAAA,CAA2D,CAAA;AAAA,EACpH;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAC,CAAW,CAAA;AACrC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,IAAI,CAAA;AAClC,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,8CAAA,EAAiD,MAAM,CAAA,EAAA,CAAI,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,EAAA;AACT;;;AC3BA,IAAM,UAAA,GAA0C;AAAA,EAC9C,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB;AACpB,CAAA;AAYO,SAAS,UAAU,OAAA,EAAwC;AAChE,EAAA,MAAM,EAAE,OAAO,SAAA,GAAY,cAAA,EAAgB,SAAS,UAAA,EAAY,MAAA,GAAS,OAAM,GAAI,OAAA;AAEnF,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gDAAA,EAAmD,KAAK,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,WAAW,SAAS,CAAA;AAChC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,6BAAA,EAAgC,SAAS,CAAA,0CAAA,CAA4C,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AAC3C,EAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAO,GAAI,aAAa,OAAO,CAAA;AAE3D,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,MAAA,IAAU,cAAa,EAAG;AAG7C,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,sNAAA;AAAA,KAEF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAwB,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO;AAExD,EAAA,OAAO;AAAA,IACL,MAAM,MAAM,UAAA,EAAoB;AAC9B,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,MAAM,IAAI,UAAU,kDAAkD,CAAA;AAAA,MACxE;AACA,MAAA,OAAO,IAAI,KAAA,EAAO,GAAA,EAAK,UAAA,EAAY,IAAA,CAAK,KAAK,CAAA;AAAA,IAC/C;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["import type { AlgorithmFn } from './index.js'\nimport type { Store } from '../types.js'\n\n/**\n * Increment the window counter, preferring the store's atomic single-call path\n * and falling back to `incr` + a conditional `pexpire` for stores that only\n * implement the three required methods.\n */\nasync function step(store: Store, key: string, ttlMs: number): Promise<number> {\n  if (store.fixedWindowStep) return store.fixedWindowStep(key, ttlMs)\n\n  const count = await store.incr(key)\n  if (count === 1) await store.pexpire(key, ttlMs)\n  return count\n}\n\n/**\n * Fixed-window counter. Divides time into contiguous windows of `windowMs` and\n * counts requests per window. Simple and cheap (one counter per window), at the\n * cost of allowing up to 2x `limit` across a window boundary in the worst case.\n */\nexport const fixedWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const windowStart = Math.floor(now / windowMs) * windowMs\n  const key = `${prefix}:${identifier}:${windowStart}`\n\n  const count = await step(store, key, windowMs)\n\n  const reset = windowStart + windowMs\n  const success = count <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, limit - count),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { AlgorithmFn } from './index.js'\nimport type { Store } from '../types.js'\n\n/**\n * Read the previous window's counter and increment the current one, preferring\n * the store's atomic single-call path.\n *\n * The fallback runs the read and the increment as two separate commands. That\n * costs an extra round trip, and it means the two observations are taken at\n * slightly different moments, so a request landing exactly on a window boundary\n * can weight a previous count that moved between the `GET` and the `INCR`. It\n * does not overshoot the limit under ordinary concurrency: the previous window\n * is complete and therefore stable, and `INCR` is atomic.\n */\nasync function step(\n  store: Store,\n  currentKey: string,\n  previousKey: string,\n  ttlMs: number,\n): Promise<[number, number]> {\n  if (store.slidingWindowStep) return store.slidingWindowStep(currentKey, previousKey, ttlMs)\n\n  const previous = await store.get(previousKey)\n  const current = await store.incr(currentKey)\n  if (current === 1) await store.pexpire(currentKey, ttlMs)\n  return [previous, current]\n}\n\n/**\n * Sliding-window counter. Weights the previous window's count by how far the\n * current window has elapsed and adds the current count, smoothing out the\n * boundary bursts that fixed-window allows. Uses two counters per identifier.\n */\nexport const slidingWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const currentStart = Math.floor(now / windowMs) * windowMs\n  const previousStart = currentStart - windowMs\n  const fraction = (now - currentStart) / windowMs // 0..1 through the current window\n\n  const currentKey = `${prefix}:${identifier}:${currentStart}`\n  const previousKey = `${prefix}:${identifier}:${previousStart}`\n\n  // Keep the current counter alive long enough to still be read as \"previous\"\n  // during the next window.\n  const [previousCount, currentCount] = await step(store, currentKey, previousKey, windowMs * 2)\n\n  const weighted = previousCount * (1 - fraction) + currentCount\n  const reset = currentStart + windowMs\n  const success = weighted <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, Math.floor(limit - weighted)),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { Store } from '../types.js'\n\ninterface Entry {\n  count: number\n  expiresAt: number\n}\n\n/**\n * In-process counter store. Used as the automatic fallback when no Redis is\n * configured. State is per-instance and not shared across processes, so it is\n * meant for local development and single-instance deployments, not distributed\n * production traffic.\n */\nexport class MemoryStore implements Store {\n  private readonly map = new Map<string, Entry>()\n  private readonly sweeper: ReturnType<typeof setInterval> | undefined\n\n  /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */\n  constructor(sweepMs = 30_000) {\n    if (sweepMs > 0 && typeof setInterval === 'function') {\n      this.sweeper = setInterval(() => this.sweep(), sweepMs)\n      // Never keep the event loop alive for cleanup alone.\n      this.sweeper.unref?.()\n    }\n  }\n\n  private live(key: string): Entry | undefined {\n    const entry = this.map.get(key)\n    if (!entry) return undefined\n    if (entry.expiresAt <= Date.now()) {\n      this.map.delete(key)\n      return undefined\n    }\n    return entry\n  }\n\n  async incr(key: string): Promise<number> {\n    const entry = this.live(key)\n    if (!entry) {\n      // Default to no expiry; pexpire is expected to follow on the first hit.\n      this.map.set(key, { count: 1, expiresAt: Number.POSITIVE_INFINITY })\n      return 1\n    }\n    entry.count += 1\n    return entry.count\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    const entry = this.live(key)\n    if (entry) entry.expiresAt = Date.now() + ms\n  }\n\n  async get(key: string): Promise<number> {\n    return this.live(key)?.count ?? 0\n  }\n\n  /**\n   * Atomic fixed-window step. JavaScript is single threaded and none of this\n   * awaits, so the increment and the TTL land together with no interleaving.\n   */\n  async fixedWindowStep(key: string, ttlMs: number): Promise<number> {\n    const entry = this.live(key)\n    if (!entry) {\n      this.map.set(key, { count: 1, expiresAt: Date.now() + ttlMs })\n      return 1\n    }\n    entry.count += 1\n    return entry.count\n  }\n\n  /** Atomic sliding-window step. Same reasoning as {@link fixedWindowStep}. */\n  async slidingWindowStep(\n    currentKey: string,\n    previousKey: string,\n    ttlMs: number,\n  ): Promise<[number, number]> {\n    const previous = this.live(previousKey)?.count ?? 0\n    const current = await this.fixedWindowStep(currentKey, ttlMs)\n    return [previous, current]\n  }\n\n  private sweep(): void {\n    const now = Date.now()\n    for (const [key, entry] of this.map) {\n      if (entry.expiresAt <= now) this.map.delete(key)\n    }\n  }\n\n  /** Stop the background sweeper. Optional; the timer is unref'd. */\n  dispose(): void {\n    if (this.sweeper) clearInterval(this.sweeper)\n  }\n}\n","/**\n * Lua scripts for the single-round-trip Redis path.\n *\n * The fallback path (`INCR` then a conditional `PEXPIRE`) costs two round trips\n * on the first hit of every window, and is not atomic: a process that dies\n * between the two commands leaves a key with no TTL, which then leaks in Redis\n * forever. Verified against Redis 7.4: `INCR` on a fresh key reports `TTL -1`\n * until the `PEXPIRE` lands.\n *\n * Running the same work inside `EVAL` fixes both: one round trip, and a TTL\n * that cannot be orphaned.\n *\n * Note on what this does NOT fix. It is tempting to claim the fallback races\n * under concurrency. It does not, at least not in a way that overshoots the\n * limit: the previous window's counter is a completed window that nothing\n * increments any more, so every concurrent caller reads the same stable value,\n * and `INCR` on the current key is atomic, so each caller gets a distinct\n * count. Measured over 50 concurrent callers against a real Redis, both paths\n * allow exactly the same number through.\n */\n\n/**\n * Fixed window. Increments the counter and sets the TTL on first touch.\n *\n * KEYS[1] window counter\n * ARGV[1] window length in milliseconds\n * returns the new count\n */\nexport const FIXED_WINDOW_SCRIPT = `\nlocal count = redis.call('INCR', KEYS[1])\nif count == 1 then\n  redis.call('PEXPIRE', KEYS[1], ARGV[1])\nend\nreturn count\n`.trim()\n\n/**\n * Sliding window. Reads the previous window's counter and increments the\n * current one as a single atomic unit.\n *\n * KEYS[1] current window counter\n * KEYS[2] previous window counter\n * ARGV[1] retention in milliseconds (two windows, so the current counter is\n *         still readable as \"previous\" during the next window)\n * returns { previousCount, currentCount }\n */\nexport const SLIDING_WINDOW_SCRIPT = `\nlocal previous = redis.call('GET', KEYS[2])\nlocal previousCount = 0\nif previous then\n  previousCount = math.floor(tonumber(previous) or 0)\nend\nlocal current = redis.call('INCR', KEYS[1])\nif current == 1 then\n  redis.call('PEXPIRE', KEYS[1], ARGV[1])\nend\nreturn { previousCount, current }\n`.trim()\n","import { FIXED_WINDOW_SCRIPT, SLIDING_WINDOW_SCRIPT } from '../lua.js'\nimport type { EvalStyle, RedisLike, Store } from '../types.js'\n\nexport interface RedisStoreOptions {\n  /** How to call the client's `eval`. Defaults to `'auto'`. */\n  evalStyle?: EvalStyle\n}\n\n/** Coerce whatever a client returns for a counter into a non-negative number. */\nfunction toCount(value: unknown): number {\n  if (value == null || value === false) return 0\n  const n = typeof value === 'number' ? value : Number(value)\n  return Number.isFinite(n) ? n : 0\n}\n\n/**\n * Decide which `eval` calling convention a client uses.\n *\n * `ioredis` is the odd one out: it takes a key count followed by flat keys and\n * args, and it is the only one of the two that exposes `defineCommand`. Every\n * other client we support (`@upstash/redis`) takes two arrays.\n */\nexport function detectEvalStyle(client: RedisLike): Exclude<EvalStyle, 'auto'> {\n  if (typeof client.eval !== 'function') return 'none'\n  if (typeof (client as { defineCommand?: unknown }).defineCommand === 'function') return 'ioredis'\n  return 'upstash'\n}\n\n/**\n * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`\n * and `ioredis` qualify) to the {@link Store} interface.\n *\n * When the client also exposes `eval`, checks run as a single atomic Lua call\n * instead of two or three separate commands. If a server rejects scripting the\n * store degrades to the portable path once and stays there.\n */\nexport class RedisStore implements Store {\n  private readonly client: RedisLike\n  private style: Exclude<EvalStyle, 'auto'>\n\n  constructor(client: RedisLike, options: RedisStoreOptions = {}) {\n    this.client = client\n    const requested = options.evalStyle ?? 'auto'\n    this.style = requested === 'auto' ? detectEvalStyle(client) : requested\n    if (this.style !== 'none' && typeof client.eval !== 'function') {\n      // An explicit style cannot conjure a method that is not there.\n      this.style = 'none'\n    }\n  }\n\n  /** True when this store will take the atomic Lua path. */\n  get atomic(): boolean {\n    return this.style !== 'none'\n  }\n\n  private async runScript(script: string, keys: string[], args: (string | number)[]): Promise<unknown> {\n    const evalFn = this.client.eval as (...a: unknown[]) => Promise<unknown>\n    if (this.style === 'ioredis') {\n      return evalFn.call(this.client, script, keys.length, ...keys, ...args)\n    }\n    return evalFn.call(this.client, script, keys, args)\n  }\n\n  /**\n   * Run `script`, falling back to the portable path forever if the server or\n   * client cannot handle scripting. A single failure is enough to decide: a\n   * server either supports EVAL or it does not, so retrying every request would\n   * just double the cost of every check on that deployment.\n   */\n  private async tryScript<T>(\n    script: string,\n    keys: string[],\n    args: (string | number)[],\n    parse: (raw: unknown) => T,\n  ): Promise<T | undefined> {\n    if (this.style === 'none') return undefined\n    try {\n      return parse(await this.runScript(script, keys, args))\n    } catch {\n      this.style = 'none'\n      return undefined\n    }\n  }\n\n  async incr(key: string): Promise<number> {\n    return this.client.incr(key)\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.client.pexpire(key, ms)\n  }\n\n  async get(key: string): Promise<number> {\n    return toCount(await this.client.get(key))\n  }\n\n  async fixedWindowStep(key: string, ttlMs: number): Promise<number> {\n    const viaScript = await this.tryScript(FIXED_WINDOW_SCRIPT, [key], [ttlMs], toCount)\n    if (viaScript !== undefined) return viaScript\n\n    const count = await this.incr(key)\n    if (count === 1) await this.pexpire(key, ttlMs)\n    return count\n  }\n\n  async slidingWindowStep(\n    currentKey: string,\n    previousKey: string,\n    ttlMs: number,\n  ): Promise<[number, number]> {\n    const viaScript = await this.tryScript(\n      SLIDING_WINDOW_SCRIPT,\n      [currentKey, previousKey],\n      [ttlMs],\n      (raw): [number, number] => {\n        const pair = raw as unknown[]\n        return [toCount(pair?.[0]), toCount(pair?.[1])]\n      },\n    )\n    if (viaScript !== undefined) return viaScript\n\n    const previous = await this.get(previousKey)\n    const current = await this.incr(currentKey)\n    if (current === 1) await this.pexpire(currentKey, ttlMs)\n    return [previous, current]\n  }\n}\n","import { FIXED_WINDOW_SCRIPT, SLIDING_WINDOW_SCRIPT } from '../lua.js'\nimport type { Store } from '../types.js'\n\nexport interface UpstashRestOptions {\n  url: string\n  token: string\n  /** Custom fetch implementation. Defaults to the global `fetch`. */\n  fetch?: typeof fetch\n}\n\n/** Coerce a REST result into a non-negative counter value. */\nfunction toCount(value: unknown): number {\n  if (value == null || value === false) return 0\n  const n = Number(value)\n  return Number.isFinite(n) ? n : 0\n}\n\n/**\n * Zero-dependency store backed by the Upstash Redis REST API. Uses `fetch`, so\n * it runs anywhere the runtime provides one (Node 18+, edge, workers) without\n * pulling in a Redis client. This is what env auto-detection constructs.\n */\nexport class UpstashRestStore implements Store {\n  private readonly url: string\n  private readonly token: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: UpstashRestOptions) {\n    this.url = options.url.replace(/\\/$/, '')\n    this.token = options.token\n    const f = options.fetch ?? globalThis.fetch\n    if (typeof f !== 'function') {\n      throw new Error('ratefall: no global fetch available; pass a `fetch` implementation to UpstashRestStore.')\n    }\n    this.fetchImpl = f\n  }\n\n  private async command(args: (string | number)[]): Promise<unknown> {\n    const res = await this.fetchImpl(this.url, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.token}`,\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(args.map(String)),\n    })\n    if (!res.ok) {\n      const detail = await res.text().catch(() => '')\n      throw new Error(`ratefall: Upstash REST error ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ''}`)\n    }\n    const body = (await res.json()) as { result?: unknown; error?: string }\n    if (body.error) {\n      throw new Error(`ratefall: Upstash command failed - ${body.error}`)\n    }\n    return body.result\n  }\n\n  async incr(key: string): Promise<number> {\n    return Number(await this.command(['INCR', key]))\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.command(['PEXPIRE', key, ms])\n  }\n\n  async get(key: string): Promise<number> {\n    return toCount(await this.command(['GET', key]))\n  }\n\n  /** Run a Lua script through the REST API. Keys come first, then args. */\n  private async evalScript(\n    script: string,\n    keys: string[],\n    args: (string | number)[],\n  ): Promise<unknown> {\n    return this.command(['EVAL', script, keys.length, ...keys, ...args])\n  }\n\n  async fixedWindowStep(key: string, ttlMs: number): Promise<number> {\n    return toCount(await this.evalScript(FIXED_WINDOW_SCRIPT, [key], [ttlMs]))\n  }\n\n  async slidingWindowStep(\n    currentKey: string,\n    previousKey: string,\n    ttlMs: number,\n  ): Promise<[number, number]> {\n    const raw = (await this.evalScript(SLIDING_WINDOW_SCRIPT, [currentKey, previousKey], [ttlMs])) as unknown[]\n    return [toCount(raw?.[0]), toCount(raw?.[1])]\n  }\n}\n","import type { RateLimitOptions, Store } from './types.js'\nimport { MemoryStore } from './stores/memory.js'\nimport { RedisStore } from './stores/redis.js'\nimport { UpstashRestStore } from './stores/upstash-rest.js'\n\nexport interface ResolvedStore {\n  store: Store\n  /** Whether the store is shared across processes (Redis) vs per-instance (memory). */\n  distributed: boolean\n  /** Human-readable source, for the dev warning. */\n  source: string\n}\n\nfunction readEnv(key: string): string | undefined {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env\n  return env?.[key]\n}\n\n/**\n * Decide which store to use, in priority order:\n * 1. an explicit `store`\n * 2. an explicit `redis` client\n * 3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment\n * 4. in-memory fallback\n */\nexport function resolveStore(options: RateLimitOptions): ResolvedStore {\n  if (options.store) {\n    return { store: options.store, distributed: true, source: 'custom store' }\n  }\n\n  if (options.redis) {\n    const store = new RedisStore(options.redis, { evalStyle: options.evalStyle })\n    return {\n      store,\n      distributed: true,\n      source: store.atomic ? 'redis client (atomic)' : 'redis client',\n    }\n  }\n\n  const url = readEnv('UPSTASH_REDIS_REST_URL')\n  const token = readEnv('UPSTASH_REDIS_REST_TOKEN')\n  if (url && token) {\n    return { store: new UpstashRestStore({ url, token }), distributed: true, source: 'Upstash REST (env)' }\n  }\n\n  return { store: new MemoryStore(), distributed: false, source: 'in-memory' }\n}\n\n/** True when the runtime looks like a production deployment. */\nexport function isProduction(): boolean {\n  return readEnv('NODE_ENV') === 'production'\n}\n","const UNITS: Record<string, number> = {\n  ms: 1,\n  s: 1000,\n  m: 60_000,\n  h: 3_600_000,\n  d: 86_400_000,\n}\n\nconst PATTERN = /^(\\d+(?:\\.\\d+)?)\\s*(ms|s|m|h|d)$/\n\n/**\n * Normalize a window into milliseconds. Accepts a raw millisecond number or a\n * duration string like `'500ms'`, `'10s'`, `'1m'`, `'2h'`, `'1d'`.\n */\nexport function parseWindow(window: string | number): number {\n  if (typeof window === 'number') {\n    if (!Number.isFinite(window) || window <= 0) {\n      throw new RangeError(`ratefall: window must be a positive number of milliseconds, got ${window}`)\n    }\n    return Math.floor(window)\n  }\n\n  const match = PATTERN.exec(window.trim())\n  if (!match) {\n    throw new TypeError(`ratefall: invalid window \"${window}\". Use a number of ms or a string like \"10s\", \"1m\", \"2h\".`)\n  }\n\n  const value = Number(match[1])\n  const unit = UNITS[match[2] as string] as number\n  const ms = Math.floor(value * unit)\n  if (ms <= 0) {\n    throw new RangeError(`ratefall: window must be greater than 0, got \"${window}\".`)\n  }\n  return ms\n}\n","import type { AlgorithmContext, AlgorithmFn } from './algorithms/index.js'\nimport { fixedWindow } from './algorithms/fixed-window.js'\nimport { slidingWindow } from './algorithms/sliding-window.js'\nimport { isProduction, resolveStore } from './resolve-store.js'\nimport type { RateLimiter, RateLimitOptions } from './types.js'\nimport { parseWindow } from './window.js'\n\nconst ALGORITHMS: Record<string, AlgorithmFn> = {\n  'fixed-window': fixedWindow,\n  'sliding-window': slidingWindow,\n}\n\n/**\n * Create a rate limiter. With no store configured it uses an in-memory counter\n * (great for local dev); set `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN`,\n * or pass a `redis` client, and the exact same code becomes distributed.\n *\n * @example\n * const limiter = rateLimit({ limit: 10, window: '10s' })\n * const { success } = await limiter.limit(userId)\n * if (!success) return new Response('slow down', { status: 429 })\n */\nexport function rateLimit(options: RateLimitOptions): RateLimiter {\n  const { limit, algorithm = 'fixed-window', prefix = 'ratefall', silent = false } = options\n\n  if (!Number.isInteger(limit) || limit <= 0) {\n    throw new RangeError(`ratefall: limit must be a positive integer, got ${limit}`)\n  }\n\n  const run = ALGORITHMS[algorithm]\n  if (!run) {\n    throw new TypeError(`ratefall: unknown algorithm \"${algorithm}\". Use \"fixed-window\" or \"sliding-window\".`)\n  }\n\n  const windowMs = parseWindow(options.window)\n  const { store, distributed, source } = resolveStore(options)\n\n  if (!distributed && !silent && isProduction()) {\n    // Not an error: single-instance prod is legitimate. But un-shared limits in a\n    // multi-instance deploy are a footgun, so make it loud exactly once.\n    console.warn(\n      `ratefall: running with an in-memory store in production. Limits are per-instance and NOT shared. ` +\n        `Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN or pass a \\`redis\\` client. Pass \\`silent: true\\` to hide this.`,\n    )\n  }\n\n  const ctx: AlgorithmContext = { limit, windowMs, prefix }\n\n  return {\n    async limit(identifier: string) {\n      if (!identifier) {\n        throw new TypeError('ratefall: identifier must be a non-empty string.')\n      }\n      return run(store, ctx, identifier, Date.now())\n    },\n  }\n}\n\n/** The resolved store source, exposed for debugging/tests. */\nexport { resolveStore } from './resolve-store.js'\n"]}

package/dist/index.d.cts

@@ -15,6 +15,10 @@ interface RateLimitResult {
  * Minimal counter backend. Mirrors the handful of Redis commands the
  * algorithms need, so any store (memory, Upstash REST, a duck-typed Redis
  * client) can satisfy it.
+ *
+ * The three required methods are the portable fallback path. A store may also
+ * implement either optional method below to collapse a check into one atomic
+ * operation; the algorithms use them automatically when present.
  */
 interface Store {
     /** Increment the counter at `key`, returning the new value. */
@@ -23,16 +27,41 @@ interface Store {
     pexpire(key: string, ms: number): Promise<void>;
     /** Read the counter at `key`. Returns 0 when the key is absent or expired. */
     get(key: string): Promise<number>;
+    /**
+     * Optional atomic fixed-window step: increment `key` and set its TTL to
+     * `ttlMs` if this was the first hit, in one indivisible operation. Returns
+     * the new count.
+     */
+    fixedWindowStep?(key: string, ttlMs: number): Promise<number>;
+    /**
+     * Optional atomic sliding-window step: read `previousKey` and increment
+     * `currentKey` (setting its TTL to `ttlMs` on first hit) in one indivisible
+     * operation. Returns `[previousCount, currentCount]`.
+     */
+    slidingWindowStep?(currentKey: string, previousKey: string, ttlMs: number): Promise<[previous: number, current: number]>;
 }
 /**
  * The subset of a Redis client `ratefall` uses. Both `@upstash/redis` and
  * `ioredis` satisfy this shape, so you can pass either without an adapter.
+ *
+ * `eval` is optional. When the client exposes it, `ratefall` uses the atomic
+ * single-round-trip path; otherwise it falls back to `incr` + `pexpire`.
  */
 interface RedisLike {
     incr(key: string): Promise<number>;
     pexpire(key: string, ms: number): Promise<unknown>;
     get(key: string): Promise<string | number | null>;
+    eval?(...args: never[]): Promise<unknown>;
 }
+/**
+ * How a Redis client's `eval` wants its arguments.
+ *
+ * - `'ioredis'`: `eval(script, numKeys, ...keys, ...args)`
+ * - `'upstash'`: `eval(script, keys[], args[])`
+ * - `'auto'`: sniff the client (default)
+ * - `'none'`: never use `eval`, always take the portable fallback path
+ */
+type EvalStyle = 'auto' | 'ioredis' | 'upstash' | 'none';
 type Algorithm = 'fixed-window' | 'sliding-window';
 interface RateLimitOptions {
     /** Maximum number of requests allowed per window. */
@@ -47,6 +76,11 @@ interface RateLimitOptions {
     store?: Store;
     /** A Redis client (`@upstash/redis`, `ioredis`, ...). Overrides env auto-detection. */
     redis?: RedisLike;
+    /**
+     * How to call the Redis client's `eval`. Defaults to `'auto'`, which detects
+     * `ioredis` and `@upstash/redis`. Set `'none'` to disable the Lua path.
+     */
+    evalStyle?: EvalStyle;
     /** Suppress the "no distributed store in production" warning. */
     silent?: boolean;
 }
@@ -99,21 +133,57 @@ declare class MemoryStore implements Store {
     incr(key: string): Promise<number>;
     pexpire(key: string, ms: number): Promise<void>;
     get(key: string): Promise<number>;
+    /**
+     * Atomic fixed-window step. JavaScript is single threaded and none of this
+     * awaits, so the increment and the TTL land together with no interleaving.
+     */
+    fixedWindowStep(key: string, ttlMs: number): Promise<number>;
+    /** Atomic sliding-window step. Same reasoning as {@link fixedWindowStep}. */
+    slidingWindowStep(currentKey: string, previousKey: string, ttlMs: number): Promise<[number, number]>;
     private sweep;
     /** Stop the background sweeper. Optional; the timer is unref'd. */
     dispose(): void;
 }
 
+interface RedisStoreOptions {
+    /** How to call the client's `eval`. Defaults to `'auto'`. */
+    evalStyle?: EvalStyle;
+}
+/**
+ * Decide which `eval` calling convention a client uses.
+ *
+ * `ioredis` is the odd one out: it takes a key count followed by flat keys and
+ * args, and it is the only one of the two that exposes `defineCommand`. Every
+ * other client we support (`@upstash/redis`) takes two arrays.
+ */
+declare function detectEvalStyle(client: RedisLike): Exclude<EvalStyle, 'auto'>;
 /**
  * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`
  * and `ioredis` qualify) to the {@link Store} interface.
+ *
+ * When the client also exposes `eval`, checks run as a single atomic Lua call
+ * instead of two or three separate commands. If a server rejects scripting the
+ * store degrades to the portable path once and stays there.
  */
 declare class RedisStore implements Store {
     private readonly client;
-    constructor(client: RedisLike);
+    private style;
+    constructor(client: RedisLike, options?: RedisStoreOptions);
+    /** True when this store will take the atomic Lua path. */
+    get atomic(): boolean;
+    private runScript;
+    /**
+     * Run `script`, falling back to the portable path forever if the server or
+     * client cannot handle scripting. A single failure is enough to decide: a
+     * server either supports EVAL or it does not, so retrying every request would
+     * just double the cost of every check on that deployment.
+     */
+    private tryScript;
     incr(key: string): Promise<number>;
     pexpire(key: string, ms: number): Promise<void>;
     get(key: string): Promise<number>;
+    fixedWindowStep(key: string, ttlMs: number): Promise<number>;
+    slidingWindowStep(currentKey: string, previousKey: string, ttlMs: number): Promise<[number, number]>;
 }
 
 interface UpstashRestOptions {
@@ -136,6 +206,10 @@ declare class UpstashRestStore implements Store {
     incr(key: string): Promise<number>;
     pexpire(key: string, ms: number): Promise<void>;
     get(key: string): Promise<number>;
+    /** Run a Lua script through the REST API. Keys come first, then args. */
+    private evalScript;
+    fixedWindowStep(key: string, ttlMs: number): Promise<number>;
+    slidingWindowStep(currentKey: string, previousKey: string, ttlMs: number): Promise<[number, number]>;
 }
 
 /**
@@ -144,4 +218,44 @@ declare class UpstashRestStore implements Store {
  */
 declare function parseWindow(window: string | number): number;
 
-export { type Algorithm, MemoryStore, type RateLimitOptions, type RateLimitResult, type RateLimiter, type RedisLike, RedisStore, type Store, type UpstashRestOptions, UpstashRestStore, parseWindow, rateLimit, resolveStore };
+/**
+ * Lua scripts for the single-round-trip Redis path.
+ *
+ * The fallback path (`INCR` then a conditional `PEXPIRE`) costs two round trips
+ * on the first hit of every window, and is not atomic: a process that dies
+ * between the two commands leaves a key with no TTL, which then leaks in Redis
+ * forever. Verified against Redis 7.4: `INCR` on a fresh key reports `TTL -1`
+ * until the `PEXPIRE` lands.
+ *
+ * Running the same work inside `EVAL` fixes both: one round trip, and a TTL
+ * that cannot be orphaned.
+ *
+ * Note on what this does NOT fix. It is tempting to claim the fallback races
+ * under concurrency. It does not, at least not in a way that overshoots the
+ * limit: the previous window's counter is a completed window that nothing
+ * increments any more, so every concurrent caller reads the same stable value,
+ * and `INCR` on the current key is atomic, so each caller gets a distinct
+ * count. Measured over 50 concurrent callers against a real Redis, both paths
+ * allow exactly the same number through.
+ */
+/**
+ * Fixed window. Increments the counter and sets the TTL on first touch.
+ *
+ * KEYS[1] window counter
+ * ARGV[1] window length in milliseconds
+ * returns the new count
+ */
+declare const FIXED_WINDOW_SCRIPT: string;
+/**
+ * Sliding window. Reads the previous window's counter and increments the
+ * current one as a single atomic unit.
+ *
+ * KEYS[1] current window counter
+ * KEYS[2] previous window counter
+ * ARGV[1] retention in milliseconds (two windows, so the current counter is
+ *         still readable as "previous" during the next window)
+ * returns { previousCount, currentCount }
+ */
+declare const SLIDING_WINDOW_SCRIPT: string;
+
+export { type Algorithm, type EvalStyle, FIXED_WINDOW_SCRIPT, MemoryStore, type RateLimitOptions, type RateLimitResult, type RateLimiter, type RedisLike, RedisStore, type RedisStoreOptions, SLIDING_WINDOW_SCRIPT, type Store, type UpstashRestOptions, UpstashRestStore, detectEvalStyle, parseWindow, rateLimit, resolveStore };

package/dist/index.d.ts

@@ -15,6 +15,10 @@ interface RateLimitResult {
  * Minimal counter backend. Mirrors the handful of Redis commands the
  * algorithms need, so any store (memory, Upstash REST, a duck-typed Redis
  * client) can satisfy it.
+ *
+ * The three required methods are the portable fallback path. A store may also
+ * implement either optional method below to collapse a check into one atomic
+ * operation; the algorithms use them automatically when present.
  */
 interface Store {
     /** Increment the counter at `key`, returning the new value. */
@@ -23,16 +27,41 @@ interface Store {
     pexpire(key: string, ms: number): Promise<void>;
     /** Read the counter at `key`. Returns 0 when the key is absent or expired. */
     get(key: string): Promise<number>;
+    /**
+     * Optional atomic fixed-window step: increment `key` and set its TTL to
+     * `ttlMs` if this was the first hit, in one indivisible operation. Returns
+     * the new count.
+     */
+    fixedWindowStep?(key: string, ttlMs: number): Promise<number>;
+    /**
+     * Optional atomic sliding-window step: read `previousKey` and increment
+     * `currentKey` (setting its TTL to `ttlMs` on first hit) in one indivisible
+     * operation. Returns `[previousCount, currentCount]`.
+     */
+    slidingWindowStep?(currentKey: string, previousKey: string, ttlMs: number): Promise<[previous: number, current: number]>;
 }
 /**
  * The subset of a Redis client `ratefall` uses. Both `@upstash/redis` and
  * `ioredis` satisfy this shape, so you can pass either without an adapter.
+ *
+ * `eval` is optional. When the client exposes it, `ratefall` uses the atomic
+ * single-round-trip path; otherwise it falls back to `incr` + `pexpire`.
  */
 interface RedisLike {
     incr(key: string): Promise<number>;
     pexpire(key: string, ms: number): Promise<unknown>;
     get(key: string): Promise<string | number | null>;
+    eval?(...args: never[]): Promise<unknown>;
 }
+/**
+ * How a Redis client's `eval` wants its arguments.
+ *
+ * - `'ioredis'`: `eval(script, numKeys, ...keys, ...args)`
+ * - `'upstash'`: `eval(script, keys[], args[])`
+ * - `'auto'`: sniff the client (default)
+ * - `'none'`: never use `eval`, always take the portable fallback path
+ */
+type EvalStyle = 'auto' | 'ioredis' | 'upstash' | 'none';
 type Algorithm = 'fixed-window' | 'sliding-window';
 interface RateLimitOptions {
     /** Maximum number of requests allowed per window. */
@@ -47,6 +76,11 @@ interface RateLimitOptions {
     store?: Store;
     /** A Redis client (`@upstash/redis`, `ioredis`, ...). Overrides env auto-detection. */
     redis?: RedisLike;
+    /**
+     * How to call the Redis client's `eval`. Defaults to `'auto'`, which detects
+     * `ioredis` and `@upstash/redis`. Set `'none'` to disable the Lua path.
+     */
+    evalStyle?: EvalStyle;
     /** Suppress the "no distributed store in production" warning. */
     silent?: boolean;
 }
@@ -99,21 +133,57 @@ declare class MemoryStore implements Store {
     incr(key: string): Promise<number>;
     pexpire(key: string, ms: number): Promise<void>;
     get(key: string): Promise<number>;
+    /**
+     * Atomic fixed-window step. JavaScript is single threaded and none of this
+     * awaits, so the increment and the TTL land together with no interleaving.
+     */
+    fixedWindowStep(key: string, ttlMs: number): Promise<number>;
+    /** Atomic sliding-window step. Same reasoning as {@link fixedWindowStep}. */
+    slidingWindowStep(currentKey: string, previousKey: string, ttlMs: number): Promise<[number, number]>;
     private sweep;
     /** Stop the background sweeper. Optional; the timer is unref'd. */
     dispose(): void;
 }
 
+interface RedisStoreOptions {
+    /** How to call the client's `eval`. Defaults to `'auto'`. */
+    evalStyle?: EvalStyle;
+}
+/**
+ * Decide which `eval` calling convention a client uses.
+ *
+ * `ioredis` is the odd one out: it takes a key count followed by flat keys and
+ * args, and it is the only one of the two that exposes `defineCommand`. Every
+ * other client we support (`@upstash/redis`) takes two arrays.
+ */
+declare function detectEvalStyle(client: RedisLike): Exclude<EvalStyle, 'auto'>;
 /**
  * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`
  * and `ioredis` qualify) to the {@link Store} interface.
+ *
+ * When the client also exposes `eval`, checks run as a single atomic Lua call
+ * instead of two or three separate commands. If a server rejects scripting the
+ * store degrades to the portable path once and stays there.
  */
 declare class RedisStore implements Store {
     private readonly client;
-    constructor(client: RedisLike);
+    private style;
+    constructor(client: RedisLike, options?: RedisStoreOptions);
+    /** True when this store will take the atomic Lua path. */
+    get atomic(): boolean;
+    private runScript;
+    /**
+     * Run `script`, falling back to the portable path forever if the server or
+     * client cannot handle scripting. A single failure is enough to decide: a
+     * server either supports EVAL or it does not, so retrying every request would
+     * just double the cost of every check on that deployment.
+     */
+    private tryScript;
     incr(key: string): Promise<number>;
     pexpire(key: string, ms: number): Promise<void>;
     get(key: string): Promise<number>;
+    fixedWindowStep(key: string, ttlMs: number): Promise<number>;
+    slidingWindowStep(currentKey: string, previousKey: string, ttlMs: number): Promise<[number, number]>;
 }
 
 interface UpstashRestOptions {
@@ -136,6 +206,10 @@ declare class UpstashRestStore implements Store {
     incr(key: string): Promise<number>;
     pexpire(key: string, ms: number): Promise<void>;
     get(key: string): Promise<number>;
+    /** Run a Lua script through the REST API. Keys come first, then args. */
+    private evalScript;
+    fixedWindowStep(key: string, ttlMs: number): Promise<number>;
+    slidingWindowStep(currentKey: string, previousKey: string, ttlMs: number): Promise<[number, number]>;
 }
 
 /**
@@ -144,4 +218,44 @@ declare class UpstashRestStore implements Store {
  */
 declare function parseWindow(window: string | number): number;
 
-export { type Algorithm, MemoryStore, type RateLimitOptions, type RateLimitResult, type RateLimiter, type RedisLike, RedisStore, type Store, type UpstashRestOptions, UpstashRestStore, parseWindow, rateLimit, resolveStore };
+/**
+ * Lua scripts for the single-round-trip Redis path.
+ *
+ * The fallback path (`INCR` then a conditional `PEXPIRE`) costs two round trips
+ * on the first hit of every window, and is not atomic: a process that dies
+ * between the two commands leaves a key with no TTL, which then leaks in Redis
+ * forever. Verified against Redis 7.4: `INCR` on a fresh key reports `TTL -1`
+ * until the `PEXPIRE` lands.
+ *
+ * Running the same work inside `EVAL` fixes both: one round trip, and a TTL
+ * that cannot be orphaned.
+ *
+ * Note on what this does NOT fix. It is tempting to claim the fallback races
+ * under concurrency. It does not, at least not in a way that overshoots the
+ * limit: the previous window's counter is a completed window that nothing
+ * increments any more, so every concurrent caller reads the same stable value,
+ * and `INCR` on the current key is atomic, so each caller gets a distinct
+ * count. Measured over 50 concurrent callers against a real Redis, both paths
+ * allow exactly the same number through.
+ */
+/**
+ * Fixed window. Increments the counter and sets the TTL on first touch.
+ *
+ * KEYS[1] window counter
+ * ARGV[1] window length in milliseconds
+ * returns the new count
+ */
+declare const FIXED_WINDOW_SCRIPT: string;
+/**
+ * Sliding window. Reads the previous window's counter and increments the
+ * current one as a single atomic unit.
+ *
+ * KEYS[1] current window counter
+ * KEYS[2] previous window counter
+ * ARGV[1] retention in milliseconds (two windows, so the current counter is
+ *         still readable as "previous" during the next window)
+ * returns { previousCount, currentCount }
+ */
+declare const SLIDING_WINDOW_SCRIPT: string;
+
+export { type Algorithm, type EvalStyle, FIXED_WINDOW_SCRIPT, MemoryStore, type RateLimitOptions, type RateLimitResult, type RateLimiter, type RedisLike, RedisStore, type RedisStoreOptions, SLIDING_WINDOW_SCRIPT, type Store, type UpstashRestOptions, UpstashRestStore, detectEvalStyle, parseWindow, rateLimit, resolveStore };

package/dist/index.js

@@ -1,10 +1,15 @@
 // src/algorithms/fixed-window.ts
+async function step(store, key, ttlMs) {
+  if (store.fixedWindowStep) return store.fixedWindowStep(key, ttlMs);
+  const count = await store.incr(key);
+  if (count === 1) await store.pexpire(key, ttlMs);
+  return count;
+}
 var fixedWindow = async (store, ctx, identifier, now) => {
   const { limit, windowMs, prefix } = ctx;
   const windowStart = Math.floor(now / windowMs) * windowMs;
   const key = `${prefix}:${identifier}:${windowStart}`;
-  const count = await store.incr(key);
-  if (count === 1) await store.pexpire(key, windowMs);
+  const count = await step(store, key, windowMs);
   const reset = windowStart + windowMs;
   const success = count <= limit;
   return {
@@ -17,6 +22,13 @@ var fixedWindow = async (store, ctx, identifier, now) => {
 };
 
 // src/algorithms/sliding-window.ts
+async function step2(store, currentKey, previousKey, ttlMs) {
+  if (store.slidingWindowStep) return store.slidingWindowStep(currentKey, previousKey, ttlMs);
+  const previous = await store.get(previousKey);
+  const current = await store.incr(currentKey);
+  if (current === 1) await store.pexpire(currentKey, ttlMs);
+  return [previous, current];
+}
 var slidingWindow = async (store, ctx, identifier, now) => {
   const { limit, windowMs, prefix } = ctx;
   const currentStart = Math.floor(now / windowMs) * windowMs;
@@ -24,9 +36,7 @@ var slidingWindow = async (store, ctx, identifier, now) => {
   const fraction = (now - currentStart) / windowMs;
   const currentKey = `${prefix}:${identifier}:${currentStart}`;
   const previousKey = `${prefix}:${identifier}:${previousStart}`;
-  const previousCount = await store.get(previousKey);
-  const currentCount = await store.incr(currentKey);
-  if (currentCount === 1) await store.pexpire(currentKey, windowMs * 2);
+  const [previousCount, currentCount] = await step2(store, currentKey, previousKey, windowMs * 2);
   const weighted = previousCount * (1 - fraction) + currentCount;
   const reset = currentStart + windowMs;
   const success = weighted <= limit;
@@ -75,6 +85,25 @@ var MemoryStore = class {
   async get(key) {
     return this.live(key)?.count ?? 0;
   }
+  /**
+   * Atomic fixed-window step. JavaScript is single threaded and none of this
+   * awaits, so the increment and the TTL land together with no interleaving.
+   */
+  async fixedWindowStep(key, ttlMs) {
+    const entry = this.live(key);
+    if (!entry) {
+      this.map.set(key, { count: 1, expiresAt: Date.now() + ttlMs });
+      return 1;
+    }
+    entry.count += 1;
+    return entry.count;
+  }
+  /** Atomic sliding-window step. Same reasoning as {@link fixedWindowStep}. */
+  async slidingWindowStep(currentKey, previousKey, ttlMs) {
+    const previous = this.live(previousKey)?.count ?? 0;
+    const current = await this.fixedWindowStep(currentKey, ttlMs);
+    return [previous, current];
+  }
   sweep() {
     const now = Date.now();
     for (const [key, entry] of this.map) {
@@ -87,12 +116,75 @@ var MemoryStore = class {
   }
 };
 
+// src/lua.ts
+var FIXED_WINDOW_SCRIPT = `
+local count = redis.call('INCR', KEYS[1])
+if count == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return count
+`.trim();
+var SLIDING_WINDOW_SCRIPT = `
+local previous = redis.call('GET', KEYS[2])
+local previousCount = 0
+if previous then
+  previousCount = math.floor(tonumber(previous) or 0)
+end
+local current = redis.call('INCR', KEYS[1])
+if current == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return { previousCount, current }
+`.trim();
+
 // src/stores/redis.ts
+function toCount(value) {
+  if (value == null || value === false) return 0;
+  const n = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(n) ? n : 0;
+}
+function detectEvalStyle(client) {
+  if (typeof client.eval !== "function") return "none";
+  if (typeof client.defineCommand === "function") return "ioredis";
+  return "upstash";
+}
 var RedisStore = class {
-  constructor(client) {
+  client;
+  style;
+  constructor(client, options = {}) {
     this.client = client;
+    const requested = options.evalStyle ?? "auto";
+    this.style = requested === "auto" ? detectEvalStyle(client) : requested;
+    if (this.style !== "none" && typeof client.eval !== "function") {
+      this.style = "none";
+    }
+  }
+  /** True when this store will take the atomic Lua path. */
+  get atomic() {
+    return this.style !== "none";
+  }
+  async runScript(script, keys, args) {
+    const evalFn = this.client.eval;
+    if (this.style === "ioredis") {
+      return evalFn.call(this.client, script, keys.length, ...keys, ...args);
+    }
+    return evalFn.call(this.client, script, keys, args);
+  }
+  /**
+   * Run `script`, falling back to the portable path forever if the server or
+   * client cannot handle scripting. A single failure is enough to decide: a
+   * server either supports EVAL or it does not, so retrying every request would
+   * just double the cost of every check on that deployment.
+   */
+  async tryScript(script, keys, args, parse) {
+    if (this.style === "none") return void 0;
+    try {
+      return parse(await this.runScript(script, keys, args));
+    } catch {
+      this.style = "none";
+      return void 0;
+    }
   }
-  client;
   async incr(key) {
     return this.client.incr(key);
   }
@@ -100,14 +192,39 @@ var RedisStore = class {
     await this.client.pexpire(key, ms);
   }
   async get(key) {
-    const value = await this.client.get(key);
-    if (value == null) return 0;
-    const n = typeof value === "number" ? value : Number(value);
-    return Number.isFinite(n) ? n : 0;
+    return toCount(await this.client.get(key));
+  }
+  async fixedWindowStep(key, ttlMs) {
+    const viaScript = await this.tryScript(FIXED_WINDOW_SCRIPT, [key], [ttlMs], toCount);
+    if (viaScript !== void 0) return viaScript;
+    const count = await this.incr(key);
+    if (count === 1) await this.pexpire(key, ttlMs);
+    return count;
+  }
+  async slidingWindowStep(currentKey, previousKey, ttlMs) {
+    const viaScript = await this.tryScript(
+      SLIDING_WINDOW_SCRIPT,
+      [currentKey, previousKey],
+      [ttlMs],
+      (raw) => {
+        const pair = raw;
+        return [toCount(pair?.[0]), toCount(pair?.[1])];
+      }
+    );
+    if (viaScript !== void 0) return viaScript;
+    const previous = await this.get(previousKey);
+    const current = await this.incr(currentKey);
+    if (current === 1) await this.pexpire(currentKey, ttlMs);
+    return [previous, current];
   }
 };
 
 // src/stores/upstash-rest.ts
+function toCount2(value) {
+  if (value == null || value === false) return 0;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : 0;
+}
 var UpstashRestStore = class {
   url;
   token;
@@ -147,10 +264,18 @@ var UpstashRestStore = class {
     await this.command(["PEXPIRE", key, ms]);
   }
   async get(key) {
-    const result = await this.command(["GET", key]);
-    if (result == null) return 0;
-    const n = Number(result);
-    return Number.isFinite(n) ? n : 0;
+    return toCount2(await this.command(["GET", key]));
+  }
+  /** Run a Lua script through the REST API. Keys come first, then args. */
+  async evalScript(script, keys, args) {
+    return this.command(["EVAL", script, keys.length, ...keys, ...args]);
+  }
+  async fixedWindowStep(key, ttlMs) {
+    return toCount2(await this.evalScript(FIXED_WINDOW_SCRIPT, [key], [ttlMs]));
+  }
+  async slidingWindowStep(currentKey, previousKey, ttlMs) {
+    const raw = await this.evalScript(SLIDING_WINDOW_SCRIPT, [currentKey, previousKey], [ttlMs]);
+    return [toCount2(raw?.[0]), toCount2(raw?.[1])];
   }
 };
 
@@ -164,7 +289,12 @@ function resolveStore(options) {
     return { store: options.store, distributed: true, source: "custom store" };
   }
   if (options.redis) {
-    return { store: new RedisStore(options.redis), distributed: true, source: "redis client" };
+    const store = new RedisStore(options.redis, { evalStyle: options.evalStyle });
+    return {
+      store,
+      distributed: true,
+      source: store.atomic ? "redis client (atomic)" : "redis client"
+    };
   }
   const url = readEnv("UPSTASH_REDIS_REST_URL");
   const token = readEnv("UPSTASH_REDIS_REST_TOKEN");
@@ -238,6 +368,6 @@ function rateLimit(options) {
   };
 }
 
-export { MemoryStore, RedisStore, UpstashRestStore, parseWindow, rateLimit, resolveStore };
+export { FIXED_WINDOW_SCRIPT, MemoryStore, RedisStore, SLIDING_WINDOW_SCRIPT, UpstashRestStore, detectEvalStyle, parseWindow, rateLimit, resolveStore };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/algorithms/fixed-window.ts","../src/algorithms/sliding-window.ts","../src/stores/memory.ts","../src/stores/redis.ts","../src/stores/upstash-rest.ts","../src/resolve-store.ts","../src/window.ts","../src/rate-limit.ts"],"names":[],"mappings":";AAOO,IAAM,WAAA,GAA2B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC7E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AACjD,EAAA,MAAM,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,WAAW,CAAA,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAClC,EAAA,IAAI,UAAU,CAAA,EAAG,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,QAAQ,CAAA;AAElD,EAAA,MAAM,QAAQ,WAAA,GAAc,QAAA;AAC5B,EAAA,MAAM,UAAU,KAAA,IAAS,KAAA;AACzB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,KAAK,CAAA;AAAA,IACpC,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;ACjBO,IAAM,aAAA,GAA6B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC/E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AAClD,EAAA,MAAM,gBAAgB,YAAA,GAAe,QAAA;AACrC,EAAA,MAAM,QAAA,GAAA,CAAY,MAAM,YAAA,IAAgB,QAAA;AAExC,EAAA,MAAM,aAAa,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,YAAY,CAAA,CAAA;AAC1D,EAAA,MAAM,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,aAAa,CAAA,CAAA;AAE5D,EAAA,MAAM,aAAA,GAAgB,MAAM,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AACjD,EAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA;AAEhD,EAAA,IAAI,iBAAiB,CAAA,EAAG,MAAM,MAAM,OAAA,CAAQ,UAAA,EAAY,WAAW,CAAC,CAAA;AAEpE,EAAA,MAAM,QAAA,GAAW,aAAA,IAAiB,CAAA,GAAI,QAAA,CAAA,GAAY,YAAA;AAClD,EAAA,MAAM,QAAQ,YAAA,GAAe,QAAA;AAC7B,EAAA,MAAM,UAAU,QAAA,IAAY,KAAA;AAC5B,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,KAAA,GAAQ,QAAQ,CAAC,CAAA;AAAA,IACnD,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;AClBO,IAAM,cAAN,MAAmC;AAAA,EACvB,GAAA,uBAAU,GAAA,EAAmB;AAAA,EAC7B,OAAA;AAAA;AAAA,EAGjB,WAAA,CAAY,UAAU,GAAA,EAAQ;AAC5B,IAAA,IAAI,OAAA,GAAU,CAAA,IAAK,OAAO,WAAA,KAAgB,UAAA,EAAY;AACpD,MAAA,IAAA,CAAK,UAAU,WAAA,CAAY,MAAM,IAAA,CAAK,KAAA,IAAS,OAAO,CAAA;AAEtD,MAAA,IAAA,CAAK,QAAQ,KAAA,IAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEQ,KAAK,GAAA,EAAgC;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,EAAG;AACjC,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AACnB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO;AAEV,MAAA,IAAA,CAAK,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,OAAO,CAAA,EAAG,SAAA,EAAW,MAAA,CAAO,iBAAA,EAAmB,CAAA;AACnE,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,KAAA,EAAO,KAAA,CAAM,SAAA,GAAY,IAAA,CAAK,KAAI,GAAI,EAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAG,KAAA,IAAS,CAAA;AAAA,EAClC;AAAA,EAEQ,KAAA,GAAc;AACpB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAK,GAAA,EAAK;AACnC,MAAA,IAAI,MAAM,SAAA,IAAa,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AAAA,IACjD;AAAA,EACF;AAAA;AAAA,EAGA,OAAA,GAAgB;AACd,IAAA,IAAI,IAAA,CAAK,OAAA,EAAS,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9C;AACF;;;AC7DO,IAAM,aAAN,MAAkC;AAAA,EACvC,YAA6B,MAAA,EAAmB;AAAnB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAoB;AAAA,EAApB,MAAA;AAAA,EAE7B,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,IAAI,GAAG,CAAA;AACvC,IAAA,IAAI,KAAA,IAAS,MAAM,OAAO,CAAA;AAC1B,IAAA,MAAM,IAAI,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAK,CAAA;AAC1D,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,EAClC;AACF;;;ACTO,IAAM,mBAAN,MAAwC;AAAA,EAC5B,GAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EAEjB,YAAY,OAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxC,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AACrB,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AACtC,IAAA,IAAI,OAAO,MAAM,UAAA,EAAY;AAC3B,MAAA,MAAM,IAAI,MAAM,yFAAyF,CAAA;AAAA,IAC3G;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AAAA,EACnB;AAAA,EAEA,MAAc,QAAQ,IAAA,EAA6C;AACjE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,GAAA,EAAK;AAAA,MACzC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,QACnC,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAC;AAAA,KACtC,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,SAAS,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC9C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,EAAG,MAAA,GAAS,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,IAC/G;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,MAAA,CAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAC,CAAA;AAAA,EACjD;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAK,OAAA,CAAQ,CAAC,SAAA,EAAW,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,QAAQ,CAAC,KAAA,EAAO,GAAG,CAAC,CAAA;AAC9C,IAAA,IAAI,MAAA,IAAU,MAAM,OAAO,CAAA;AAC3B,IAAA,MAAM,CAAA,GAAI,OAAO,MAAM,CAAA;AACvB,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,EAClC;AACF;;;AClDA,SAAS,QAAQ,GAAA,EAAiC;AAChD,EAAA,MAAM,GAAA,GAAO,WAA0E,OAAA,EAAS,GAAA;AAChG,EAAA,OAAO,MAAM,GAAG,CAAA;AAClB;AASO,SAAS,aAAa,OAAA,EAA0C;AACrE,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,WAAA,EAAa,IAAA,EAAM,QAAQ,cAAA,EAAe;AAAA,EAC3E;AAEA,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,UAAA,CAAW,OAAA,CAAQ,KAAK,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,cAAA,EAAe;AAAA,EAC3F;AAEA,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAQ,0BAA0B,CAAA;AAChD,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,oBAAA,EAAqB;AAAA,EACxG;AAEA,EAAA,OAAO,EAAE,OAAO,IAAI,WAAA,IAAe,WAAA,EAAa,KAAA,EAAO,QAAQ,WAAA,EAAY;AAC7E;AAGO,SAAS,YAAA,GAAwB;AACtC,EAAA,OAAO,OAAA,CAAQ,UAAU,CAAA,KAAM,YAAA;AACjC;;;AC9CA,IAAM,KAAA,GAAgC;AAAA,EACpC,EAAA,EAAI,CAAA;AAAA,EACJ,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,IAAA;AAAA,EACH,CAAA,EAAG;AACL,CAAA;AAEA,IAAM,OAAA,GAAU,kCAAA;AAMT,SAAS,YAAY,MAAA,EAAiC;AAC3D,EAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,UAAU,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gEAAA,EAAmE,MAAM,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,0BAAA,EAA6B,MAAM,CAAA,yDAAA,CAA2D,CAAA;AAAA,EACpH;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAC,CAAW,CAAA;AACrC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,IAAI,CAAA;AAClC,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,8CAAA,EAAiD,MAAM,CAAA,EAAA,CAAI,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,EAAA;AACT;;;AC3BA,IAAM,UAAA,GAA0C;AAAA,EAC9C,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB;AACpB,CAAA;AAYO,SAAS,UAAU,OAAA,EAAwC;AAChE,EAAA,MAAM,EAAE,OAAO,SAAA,GAAY,cAAA,EAAgB,SAAS,UAAA,EAAY,MAAA,GAAS,OAAM,GAAI,OAAA;AAEnF,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gDAAA,EAAmD,KAAK,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,WAAW,SAAS,CAAA;AAChC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,6BAAA,EAAgC,SAAS,CAAA,0CAAA,CAA4C,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AAC3C,EAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAO,GAAI,aAAa,OAAO,CAAA;AAE3D,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,MAAA,IAAU,cAAa,EAAG;AAG7C,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,sNAAA;AAAA,KAEF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAwB,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO;AAExD,EAAA,OAAO;AAAA,IACL,MAAM,MAAM,UAAA,EAAoB;AAC9B,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,MAAM,IAAI,UAAU,kDAAkD,CAAA;AAAA,MACxE;AACA,MAAA,OAAO,IAAI,KAAA,EAAO,GAAA,EAAK,UAAA,EAAY,IAAA,CAAK,KAAK,CAAA;AAAA,IAC/C;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import type { AlgorithmFn } from './index.js'\n\n/**\n * Fixed-window counter. Divides time into contiguous windows of `windowMs` and\n * counts requests per window. Simple and cheap (one counter per window), at the\n * cost of allowing up to 2x `limit` across a window boundary in the worst case.\n */\nexport const fixedWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const windowStart = Math.floor(now / windowMs) * windowMs\n  const key = `${prefix}:${identifier}:${windowStart}`\n\n  const count = await store.incr(key)\n  if (count === 1) await store.pexpire(key, windowMs)\n\n  const reset = windowStart + windowMs\n  const success = count <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, limit - count),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { AlgorithmFn } from './index.js'\n\n/**\n * Sliding-window counter. Weights the previous window's count by how far the\n * current window has elapsed and adds the current count, smoothing out the\n * boundary bursts that fixed-window allows. Uses two counters per identifier.\n */\nexport const slidingWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const currentStart = Math.floor(now / windowMs) * windowMs\n  const previousStart = currentStart - windowMs\n  const fraction = (now - currentStart) / windowMs // 0..1 through the current window\n\n  const currentKey = `${prefix}:${identifier}:${currentStart}`\n  const previousKey = `${prefix}:${identifier}:${previousStart}`\n\n  const previousCount = await store.get(previousKey)\n  const currentCount = await store.incr(currentKey)\n  // Keep the counter alive long enough to still be read as \"previous\" next window.\n  if (currentCount === 1) await store.pexpire(currentKey, windowMs * 2)\n\n  const weighted = previousCount * (1 - fraction) + currentCount\n  const reset = currentStart + windowMs\n  const success = weighted <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, Math.floor(limit - weighted)),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { Store } from '../types.js'\n\ninterface Entry {\n  count: number\n  expiresAt: number\n}\n\n/**\n * In-process counter store. Used as the automatic fallback when no Redis is\n * configured. State is per-instance and not shared across processes, so it is\n * meant for local development and single-instance deployments, not distributed\n * production traffic.\n */\nexport class MemoryStore implements Store {\n  private readonly map = new Map<string, Entry>()\n  private readonly sweeper: ReturnType<typeof setInterval> | undefined\n\n  /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */\n  constructor(sweepMs = 30_000) {\n    if (sweepMs > 0 && typeof setInterval === 'function') {\n      this.sweeper = setInterval(() => this.sweep(), sweepMs)\n      // Never keep the event loop alive for cleanup alone.\n      this.sweeper.unref?.()\n    }\n  }\n\n  private live(key: string): Entry | undefined {\n    const entry = this.map.get(key)\n    if (!entry) return undefined\n    if (entry.expiresAt <= Date.now()) {\n      this.map.delete(key)\n      return undefined\n    }\n    return entry\n  }\n\n  async incr(key: string): Promise<number> {\n    const entry = this.live(key)\n    if (!entry) {\n      // Default to no expiry; pexpire is expected to follow on the first hit.\n      this.map.set(key, { count: 1, expiresAt: Number.POSITIVE_INFINITY })\n      return 1\n    }\n    entry.count += 1\n    return entry.count\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    const entry = this.live(key)\n    if (entry) entry.expiresAt = Date.now() + ms\n  }\n\n  async get(key: string): Promise<number> {\n    return this.live(key)?.count ?? 0\n  }\n\n  private sweep(): void {\n    const now = Date.now()\n    for (const [key, entry] of this.map) {\n      if (entry.expiresAt <= now) this.map.delete(key)\n    }\n  }\n\n  /** Stop the background sweeper. Optional; the timer is unref'd. */\n  dispose(): void {\n    if (this.sweeper) clearInterval(this.sweeper)\n  }\n}\n","import type { RedisLike, Store } from '../types.js'\n\n/**\n * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`\n * and `ioredis` qualify) to the {@link Store} interface.\n */\nexport class RedisStore implements Store {\n  constructor(private readonly client: RedisLike) {}\n\n  async incr(key: string): Promise<number> {\n    return this.client.incr(key)\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.client.pexpire(key, ms)\n  }\n\n  async get(key: string): Promise<number> {\n    const value = await this.client.get(key)\n    if (value == null) return 0\n    const n = typeof value === 'number' ? value : Number(value)\n    return Number.isFinite(n) ? n : 0\n  }\n}\n","import type { Store } from '../types.js'\n\nexport interface UpstashRestOptions {\n  url: string\n  token: string\n  /** Custom fetch implementation. Defaults to the global `fetch`. */\n  fetch?: typeof fetch\n}\n\n/**\n * Zero-dependency store backed by the Upstash Redis REST API. Uses `fetch`, so\n * it runs anywhere the runtime provides one (Node 18+, edge, workers) without\n * pulling in a Redis client. This is what env auto-detection constructs.\n */\nexport class UpstashRestStore implements Store {\n  private readonly url: string\n  private readonly token: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: UpstashRestOptions) {\n    this.url = options.url.replace(/\\/$/, '')\n    this.token = options.token\n    const f = options.fetch ?? globalThis.fetch\n    if (typeof f !== 'function') {\n      throw new Error('ratefall: no global fetch available; pass a `fetch` implementation to UpstashRestStore.')\n    }\n    this.fetchImpl = f\n  }\n\n  private async command(args: (string | number)[]): Promise<unknown> {\n    const res = await this.fetchImpl(this.url, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.token}`,\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(args.map(String)),\n    })\n    if (!res.ok) {\n      const detail = await res.text().catch(() => '')\n      throw new Error(`ratefall: Upstash REST error ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ''}`)\n    }\n    const body = (await res.json()) as { result?: unknown; error?: string }\n    if (body.error) {\n      throw new Error(`ratefall: Upstash command failed - ${body.error}`)\n    }\n    return body.result\n  }\n\n  async incr(key: string): Promise<number> {\n    return Number(await this.command(['INCR', key]))\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.command(['PEXPIRE', key, ms])\n  }\n\n  async get(key: string): Promise<number> {\n    const result = await this.command(['GET', key])\n    if (result == null) return 0\n    const n = Number(result)\n    return Number.isFinite(n) ? n : 0\n  }\n}\n","import type { RateLimitOptions, Store } from './types.js'\nimport { MemoryStore } from './stores/memory.js'\nimport { RedisStore } from './stores/redis.js'\nimport { UpstashRestStore } from './stores/upstash-rest.js'\n\nexport interface ResolvedStore {\n  store: Store\n  /** Whether the store is shared across processes (Redis) vs per-instance (memory). */\n  distributed: boolean\n  /** Human-readable source, for the dev warning. */\n  source: string\n}\n\nfunction readEnv(key: string): string | undefined {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env\n  return env?.[key]\n}\n\n/**\n * Decide which store to use, in priority order:\n * 1. an explicit `store`\n * 2. an explicit `redis` client\n * 3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment\n * 4. in-memory fallback\n */\nexport function resolveStore(options: RateLimitOptions): ResolvedStore {\n  if (options.store) {\n    return { store: options.store, distributed: true, source: 'custom store' }\n  }\n\n  if (options.redis) {\n    return { store: new RedisStore(options.redis), distributed: true, source: 'redis client' }\n  }\n\n  const url = readEnv('UPSTASH_REDIS_REST_URL')\n  const token = readEnv('UPSTASH_REDIS_REST_TOKEN')\n  if (url && token) {\n    return { store: new UpstashRestStore({ url, token }), distributed: true, source: 'Upstash REST (env)' }\n  }\n\n  return { store: new MemoryStore(), distributed: false, source: 'in-memory' }\n}\n\n/** True when the runtime looks like a production deployment. */\nexport function isProduction(): boolean {\n  return readEnv('NODE_ENV') === 'production'\n}\n","const UNITS: Record<string, number> = {\n  ms: 1,\n  s: 1000,\n  m: 60_000,\n  h: 3_600_000,\n  d: 86_400_000,\n}\n\nconst PATTERN = /^(\\d+(?:\\.\\d+)?)\\s*(ms|s|m|h|d)$/\n\n/**\n * Normalize a window into milliseconds. Accepts a raw millisecond number or a\n * duration string like `'500ms'`, `'10s'`, `'1m'`, `'2h'`, `'1d'`.\n */\nexport function parseWindow(window: string | number): number {\n  if (typeof window === 'number') {\n    if (!Number.isFinite(window) || window <= 0) {\n      throw new RangeError(`ratefall: window must be a positive number of milliseconds, got ${window}`)\n    }\n    return Math.floor(window)\n  }\n\n  const match = PATTERN.exec(window.trim())\n  if (!match) {\n    throw new TypeError(`ratefall: invalid window \"${window}\". Use a number of ms or a string like \"10s\", \"1m\", \"2h\".`)\n  }\n\n  const value = Number(match[1])\n  const unit = UNITS[match[2] as string] as number\n  const ms = Math.floor(value * unit)\n  if (ms <= 0) {\n    throw new RangeError(`ratefall: window must be greater than 0, got \"${window}\".`)\n  }\n  return ms\n}\n","import type { AlgorithmContext, AlgorithmFn } from './algorithms/index.js'\nimport { fixedWindow } from './algorithms/fixed-window.js'\nimport { slidingWindow } from './algorithms/sliding-window.js'\nimport { isProduction, resolveStore } from './resolve-store.js'\nimport type { RateLimiter, RateLimitOptions } from './types.js'\nimport { parseWindow } from './window.js'\n\nconst ALGORITHMS: Record<string, AlgorithmFn> = {\n  'fixed-window': fixedWindow,\n  'sliding-window': slidingWindow,\n}\n\n/**\n * Create a rate limiter. With no store configured it uses an in-memory counter\n * (great for local dev); set `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN`,\n * or pass a `redis` client, and the exact same code becomes distributed.\n *\n * @example\n * const limiter = rateLimit({ limit: 10, window: '10s' })\n * const { success } = await limiter.limit(userId)\n * if (!success) return new Response('slow down', { status: 429 })\n */\nexport function rateLimit(options: RateLimitOptions): RateLimiter {\n  const { limit, algorithm = 'fixed-window', prefix = 'ratefall', silent = false } = options\n\n  if (!Number.isInteger(limit) || limit <= 0) {\n    throw new RangeError(`ratefall: limit must be a positive integer, got ${limit}`)\n  }\n\n  const run = ALGORITHMS[algorithm]\n  if (!run) {\n    throw new TypeError(`ratefall: unknown algorithm \"${algorithm}\". Use \"fixed-window\" or \"sliding-window\".`)\n  }\n\n  const windowMs = parseWindow(options.window)\n  const { store, distributed, source } = resolveStore(options)\n\n  if (!distributed && !silent && isProduction()) {\n    // Not an error: single-instance prod is legitimate. But un-shared limits in a\n    // multi-instance deploy are a footgun, so make it loud exactly once.\n    console.warn(\n      `ratefall: running with an in-memory store in production. Limits are per-instance and NOT shared. ` +\n        `Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN or pass a \\`redis\\` client. Pass \\`silent: true\\` to hide this.`,\n    )\n  }\n\n  const ctx: AlgorithmContext = { limit, windowMs, prefix }\n\n  return {\n    async limit(identifier: string) {\n      if (!identifier) {\n        throw new TypeError('ratefall: identifier must be a non-empty string.')\n      }\n      return run(store, ctx, identifier, Date.now())\n    },\n  }\n}\n\n/** The resolved store source, exposed for debugging/tests. */\nexport { resolveStore } from './resolve-store.js'\n"]}
+{"version":3,"sources":["../src/algorithms/fixed-window.ts","../src/algorithms/sliding-window.ts","../src/stores/memory.ts","../src/lua.ts","../src/stores/redis.ts","../src/stores/upstash-rest.ts","../src/resolve-store.ts","../src/window.ts","../src/rate-limit.ts"],"names":["step","toCount"],"mappings":";AAQA,eAAe,IAAA,CAAK,KAAA,EAAc,GAAA,EAAa,KAAA,EAAgC;AAC7E,EAAA,IAAI,MAAM,eAAA,EAAiB,OAAO,KAAA,CAAM,eAAA,CAAgB,KAAK,KAAK,CAAA;AAElE,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAClC,EAAA,IAAI,UAAU,CAAA,EAAG,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,KAAK,CAAA;AAC/C,EAAA,OAAO,KAAA;AACT;AAOO,IAAM,WAAA,GAA2B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC7E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AACjD,EAAA,MAAM,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,WAAW,CAAA,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,KAAA,EAAO,KAAK,QAAQ,CAAA;AAE7C,EAAA,MAAM,QAAQ,WAAA,GAAc,QAAA;AAC5B,EAAA,MAAM,UAAU,KAAA,IAAS,KAAA;AACzB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,QAAQ,KAAK,CAAA;AAAA,IACpC,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;ACvBA,eAAeA,KAAAA,CACb,KAAA,EACA,UAAA,EACA,WAAA,EACA,KAAA,EAC2B;AAC3B,EAAA,IAAI,MAAM,iBAAA,EAAmB,OAAO,MAAM,iBAAA,CAAkB,UAAA,EAAY,aAAa,KAAK,CAAA;AAE1F,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,YAAY,CAAA,EAAG,MAAM,KAAA,CAAM,OAAA,CAAQ,YAAY,KAAK,CAAA;AACxD,EAAA,OAAO,CAAC,UAAU,OAAO,CAAA;AAC3B;AAOO,IAAM,aAAA,GAA6B,OAAO,KAAA,EAAO,GAAA,EAAK,YAAY,GAAA,KAAQ;AAC/E,EAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO,GAAI,GAAA;AACpC,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,QAAA;AAClD,EAAA,MAAM,gBAAgB,YAAA,GAAe,QAAA;AACrC,EAAA,MAAM,QAAA,GAAA,CAAY,MAAM,YAAA,IAAgB,QAAA;AAExC,EAAA,MAAM,aAAa,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,YAAY,CAAA,CAAA;AAC1D,EAAA,MAAM,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,IAAI,aAAa,CAAA,CAAA;AAI5D,EAAA,MAAM,CAAC,aAAA,EAAe,YAAY,CAAA,GAAI,MAAMA,MAAK,KAAA,EAAO,UAAA,EAAY,WAAA,EAAa,QAAA,GAAW,CAAC,CAAA;AAE7F,EAAA,MAAM,QAAA,GAAW,aAAA,IAAiB,CAAA,GAAI,QAAA,CAAA,GAAY,YAAA;AAClD,EAAA,MAAM,QAAQ,YAAA,GAAe,QAAA;AAC7B,EAAA,MAAM,UAAU,QAAA,IAAY,KAAA;AAC5B,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,KAAA,GAAQ,QAAQ,CAAC,CAAA;AAAA,IACnD,KAAA;AAAA,IACA,UAAA,EAAY,OAAA,GAAU,CAAA,GAAI,KAAA,GAAQ;AAAA,GACpC;AACF,CAAA;;;AC3CO,IAAM,cAAN,MAAmC;AAAA,EACvB,GAAA,uBAAU,GAAA,EAAmB;AAAA,EAC7B,OAAA;AAAA;AAAA,EAGjB,WAAA,CAAY,UAAU,GAAA,EAAQ;AAC5B,IAAA,IAAI,OAAA,GAAU,CAAA,IAAK,OAAO,WAAA,KAAgB,UAAA,EAAY;AACpD,MAAA,IAAA,CAAK,UAAU,WAAA,CAAY,MAAM,IAAA,CAAK,KAAA,IAAS,OAAO,CAAA;AAEtD,MAAA,IAAA,CAAK,QAAQ,KAAA,IAAQ;AAAA,IACvB;AAAA,EACF;AAAA,EAEQ,KAAK,GAAA,EAAgC;AAC3C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC9B,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,EAAG;AACjC,MAAA,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AACnB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO;AAEV,MAAA,IAAA,CAAK,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,OAAO,CAAA,EAAG,SAAA,EAAW,MAAA,CAAO,iBAAA,EAAmB,CAAA;AACnE,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,KAAA,EAAO,KAAA,CAAM,SAAA,GAAY,IAAA,CAAK,KAAI,GAAI,EAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAG,KAAA,IAAS,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAA,CAAgB,GAAA,EAAa,KAAA,EAAgC;AACjE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,EAAE,KAAA,EAAO,CAAA,EAAG,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,EAAO,CAAA;AAC7D,MAAA,OAAO,CAAA;AAAA,IACT;AACA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,OAAO,KAAA,CAAM,KAAA;AAAA,EACf;AAAA;AAAA,EAGA,MAAM,iBAAA,CACJ,UAAA,EACA,WAAA,EACA,KAAA,EAC2B;AAC3B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,WAAW,GAAG,KAAA,IAAS,CAAA;AAClD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,eAAA,CAAgB,YAAY,KAAK,CAAA;AAC5D,IAAA,OAAO,CAAC,UAAU,OAAO,CAAA;AAAA,EAC3B;AAAA,EAEQ,KAAA,GAAc;AACpB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAK,GAAA,EAAK;AACnC,MAAA,IAAI,MAAM,SAAA,IAAa,GAAA,EAAK,IAAA,CAAK,GAAA,CAAI,OAAO,GAAG,CAAA;AAAA,IACjD;AAAA,EACF;AAAA;AAAA,EAGA,OAAA,GAAgB;AACd,IAAA,IAAI,IAAA,CAAK,OAAA,EAAS,aAAA,CAAc,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9C;AACF;;;AChEO,IAAM,mBAAA,GAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAMjC,IAAA;AAYK,IAAM,qBAAA,GAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAWnC,IAAA;;;AChDF,SAAS,QAAQ,KAAA,EAAwB;AACvC,EAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,KAAU,KAAA,EAAO,OAAO,CAAA;AAC7C,EAAA,MAAM,IAAI,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAK,CAAA;AAC1D,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAClC;AASO,SAAS,gBAAgB,MAAA,EAA+C;AAC7E,EAAA,IAAI,OAAO,MAAA,CAAO,IAAA,KAAS,UAAA,EAAY,OAAO,MAAA;AAC9C,EAAA,IAAI,OAAQ,MAAA,CAAuC,aAAA,KAAkB,UAAA,EAAY,OAAO,SAAA;AACxF,EAAA,OAAO,SAAA;AACT;AAUO,IAAM,aAAN,MAAkC;AAAA,EACtB,MAAA;AAAA,EACT,KAAA;AAAA,EAER,WAAA,CAAY,MAAA,EAAmB,OAAA,GAA6B,EAAC,EAAG;AAC9D,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,MAAA;AACvC,IAAA,IAAA,CAAK,KAAA,GAAQ,SAAA,KAAc,MAAA,GAAS,eAAA,CAAgB,MAAM,CAAA,GAAI,SAAA;AAC9D,IAAA,IAAI,KAAK,KAAA,KAAU,MAAA,IAAU,OAAO,MAAA,CAAO,SAAS,UAAA,EAAY;AAE9D,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,IACf;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAAkB;AACpB,IAAA,OAAO,KAAK,KAAA,KAAU,MAAA;AAAA,EACxB;AAAA,EAEA,MAAc,SAAA,CAAU,MAAA,EAAgB,IAAA,EAAgB,IAAA,EAA6C;AACnG,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,IAAA;AAC3B,IAAA,IAAI,IAAA,CAAK,UAAU,SAAA,EAAW;AAC5B,MAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,MAAA,EAAQ,KAAK,MAAA,EAAQ,GAAG,IAAA,EAAM,GAAG,IAAI,CAAA;AAAA,IACvE;AACA,IAAA,OAAO,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,SAAA,CACZ,MAAA,EACA,IAAA,EACA,MACA,KAAA,EACwB;AACxB,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAQ,OAAO,MAAA;AAClC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AACb,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AAAA,EACnC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAO,QAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAM,eAAA,CAAgB,GAAA,EAAa,KAAA,EAAgC;AACjE,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,SAAA,CAAU,mBAAA,EAAqB,CAAC,GAAG,CAAA,EAAG,CAAC,KAAK,CAAA,EAAG,OAAO,CAAA;AACnF,IAAA,IAAI,SAAA,KAAc,QAAW,OAAO,SAAA;AAEpC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AACjC,IAAA,IAAI,UAAU,CAAA,EAAG,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAK,KAAK,CAAA;AAC9C,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,iBAAA,CACJ,UAAA,EACA,WAAA,EACA,KAAA,EAC2B;AAC3B,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,SAAA;AAAA,MAC3B,qBAAA;AAAA,MACA,CAAC,YAAY,WAAW,CAAA;AAAA,MACxB,CAAC,KAAK,CAAA;AAAA,MACN,CAAC,GAAA,KAA0B;AACzB,QAAA,MAAM,IAAA,GAAO,GAAA;AACb,QAAA,OAAO,CAAC,OAAA,CAAQ,IAAA,GAAO,CAAC,CAAC,GAAG,OAAA,CAAQ,IAAA,GAAO,CAAC,CAAC,CAAC,CAAA;AAAA,MAChD;AAAA,KACF;AACA,IAAA,IAAI,SAAA,KAAc,QAAW,OAAO,SAAA;AAEpC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAAI,WAAW,CAAA;AAC3C,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA;AAC1C,IAAA,IAAI,YAAY,CAAA,EAAG,MAAM,IAAA,CAAK,OAAA,CAAQ,YAAY,KAAK,CAAA;AACvD,IAAA,OAAO,CAAC,UAAU,OAAO,CAAA;AAAA,EAC3B;AACF;;;ACnHA,SAASC,SAAQ,KAAA,EAAwB;AACvC,EAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,KAAU,KAAA,EAAO,OAAO,CAAA;AAC7C,EAAA,MAAM,CAAA,GAAI,OAAO,KAAK,CAAA;AACtB,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA,GAAI,CAAA;AAClC;AAOO,IAAM,mBAAN,MAAwC;AAAA,EAC5B,GAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EAEjB,YAAY,OAAA,EAA6B;AACvC,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxC,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AACrB,IAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AACtC,IAAA,IAAI,OAAO,MAAM,UAAA,EAAY;AAC3B,MAAA,MAAM,IAAI,MAAM,yFAAyF,CAAA;AAAA,IAC3G;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AAAA,EACnB;AAAA,EAEA,MAAc,QAAQ,IAAA,EAA6C;AACjE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,GAAA,EAAK;AAAA,MACzC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,QACnC,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAC;AAAA,KACtC,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,SAAS,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC9C,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,EAAG,MAAA,GAAS,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,IAC/G;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,OAAO,MAAA,CAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAC,CAAA;AAAA,EACjD;AAAA,EAEA,MAAM,OAAA,CAAQ,GAAA,EAAa,EAAA,EAA2B;AACpD,IAAA,MAAM,KAAK,OAAA,CAAQ,CAAC,SAAA,EAAW,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,IAAI,GAAA,EAA8B;AACtC,IAAA,OAAOA,QAAAA,CAAQ,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAG,CAAC,CAAC,CAAA;AAAA,EACjD;AAAA;AAAA,EAGA,MAAc,UAAA,CACZ,MAAA,EACA,IAAA,EACA,IAAA,EACkB;AAClB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,GAAG,IAAA,EAAM,GAAG,IAAI,CAAC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,eAAA,CAAgB,GAAA,EAAa,KAAA,EAAgC;AACjE,IAAA,OAAOA,QAAAA,CAAQ,MAAM,IAAA,CAAK,UAAA,CAAW,mBAAA,EAAqB,CAAC,GAAG,CAAA,EAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAM,iBAAA,CACJ,UAAA,EACA,WAAA,EACA,KAAA,EAC2B;AAC3B,IAAA,MAAM,GAAA,GAAO,MAAM,IAAA,CAAK,UAAA,CAAW,qBAAA,EAAuB,CAAC,UAAA,EAAY,WAAW,CAAA,EAAG,CAAC,KAAK,CAAC,CAAA;AAC5F,IAAA,OAAO,CAACA,QAAAA,CAAQ,GAAA,GAAM,CAAC,CAAC,GAAGA,QAAAA,CAAQ,GAAA,GAAM,CAAC,CAAC,CAAC,CAAA;AAAA,EAC9C;AACF;;;AC7EA,SAAS,QAAQ,GAAA,EAAiC;AAChD,EAAA,MAAM,GAAA,GAAO,WAA0E,OAAA,EAAS,GAAA;AAChG,EAAA,OAAO,MAAM,GAAG,CAAA;AAClB;AASO,SAAS,aAAa,OAAA,EAA0C;AACrE,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,WAAA,EAAa,IAAA,EAAM,QAAQ,cAAA,EAAe;AAAA,EAC3E;AAEA,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,OAAA,CAAQ,OAAO,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAW,CAAA;AAC5E,IAAA,OAAO;AAAA,MACL,KAAA;AAAA,MACA,WAAA,EAAa,IAAA;AAAA,MACb,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,uBAAA,GAA0B;AAAA,KACnD;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAQ,0BAA0B,CAAA;AAChD,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAI,gBAAA,CAAiB,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA,EAAG,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,oBAAA,EAAqB;AAAA,EACxG;AAEA,EAAA,OAAO,EAAE,OAAO,IAAI,WAAA,IAAe,WAAA,EAAa,KAAA,EAAO,QAAQ,WAAA,EAAY;AAC7E;AAGO,SAAS,YAAA,GAAwB;AACtC,EAAA,OAAO,OAAA,CAAQ,UAAU,CAAA,KAAM,YAAA;AACjC;;;ACnDA,IAAM,KAAA,GAAgC;AAAA,EACpC,EAAA,EAAI,CAAA;AAAA,EACJ,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,GAAA;AAAA,EACH,CAAA,EAAG,IAAA;AAAA,EACH,CAAA,EAAG;AACL,CAAA;AAEA,IAAM,OAAA,GAAU,kCAAA;AAMT,SAAS,YAAY,MAAA,EAAiC;AAC3D,EAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,UAAU,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gEAAA,EAAmE,MAAM,CAAA,CAAE,CAAA;AAAA,IAClG;AACA,IAAA,OAAO,IAAA,CAAK,MAAM,MAAM,CAAA;AAAA,EAC1B;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,0BAAA,EAA6B,MAAM,CAAA,yDAAA,CAA2D,CAAA;AAAA,EACpH;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAC,CAAW,CAAA;AACrC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,IAAI,CAAA;AAClC,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,8CAAA,EAAiD,MAAM,CAAA,EAAA,CAAI,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,EAAA;AACT;;;AC3BA,IAAM,UAAA,GAA0C;AAAA,EAC9C,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB;AACpB,CAAA;AAYO,SAAS,UAAU,OAAA,EAAwC;AAChE,EAAA,MAAM,EAAE,OAAO,SAAA,GAAY,cAAA,EAAgB,SAAS,UAAA,EAAY,MAAA,GAAS,OAAM,GAAI,OAAA;AAEnF,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gDAAA,EAAmD,KAAK,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,GAAA,GAAM,WAAW,SAAS,CAAA;AAChC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,6BAAA,EAAgC,SAAS,CAAA,0CAAA,CAA4C,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,QAAA,GAAW,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AAC3C,EAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAa,MAAA,EAAO,GAAI,aAAa,OAAO,CAAA;AAE3D,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,MAAA,IAAU,cAAa,EAAG;AAG7C,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAA,sNAAA;AAAA,KAEF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAwB,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAO;AAExD,EAAA,OAAO;AAAA,IACL,MAAM,MAAM,UAAA,EAAoB;AAC9B,MAAA,IAAI,CAAC,UAAA,EAAY;AACf,QAAA,MAAM,IAAI,UAAU,kDAAkD,CAAA;AAAA,MACxE;AACA,MAAA,OAAO,IAAI,KAAA,EAAO,GAAA,EAAK,UAAA,EAAY,IAAA,CAAK,KAAK,CAAA;AAAA,IAC/C;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import type { AlgorithmFn } from './index.js'\nimport type { Store } from '../types.js'\n\n/**\n * Increment the window counter, preferring the store's atomic single-call path\n * and falling back to `incr` + a conditional `pexpire` for stores that only\n * implement the three required methods.\n */\nasync function step(store: Store, key: string, ttlMs: number): Promise<number> {\n  if (store.fixedWindowStep) return store.fixedWindowStep(key, ttlMs)\n\n  const count = await store.incr(key)\n  if (count === 1) await store.pexpire(key, ttlMs)\n  return count\n}\n\n/**\n * Fixed-window counter. Divides time into contiguous windows of `windowMs` and\n * counts requests per window. Simple and cheap (one counter per window), at the\n * cost of allowing up to 2x `limit` across a window boundary in the worst case.\n */\nexport const fixedWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const windowStart = Math.floor(now / windowMs) * windowMs\n  const key = `${prefix}:${identifier}:${windowStart}`\n\n  const count = await step(store, key, windowMs)\n\n  const reset = windowStart + windowMs\n  const success = count <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, limit - count),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { AlgorithmFn } from './index.js'\nimport type { Store } from '../types.js'\n\n/**\n * Read the previous window's counter and increment the current one, preferring\n * the store's atomic single-call path.\n *\n * The fallback runs the read and the increment as two separate commands. That\n * costs an extra round trip, and it means the two observations are taken at\n * slightly different moments, so a request landing exactly on a window boundary\n * can weight a previous count that moved between the `GET` and the `INCR`. It\n * does not overshoot the limit under ordinary concurrency: the previous window\n * is complete and therefore stable, and `INCR` is atomic.\n */\nasync function step(\n  store: Store,\n  currentKey: string,\n  previousKey: string,\n  ttlMs: number,\n): Promise<[number, number]> {\n  if (store.slidingWindowStep) return store.slidingWindowStep(currentKey, previousKey, ttlMs)\n\n  const previous = await store.get(previousKey)\n  const current = await store.incr(currentKey)\n  if (current === 1) await store.pexpire(currentKey, ttlMs)\n  return [previous, current]\n}\n\n/**\n * Sliding-window counter. Weights the previous window's count by how far the\n * current window has elapsed and adds the current count, smoothing out the\n * boundary bursts that fixed-window allows. Uses two counters per identifier.\n */\nexport const slidingWindow: AlgorithmFn = async (store, ctx, identifier, now) => {\n  const { limit, windowMs, prefix } = ctx\n  const currentStart = Math.floor(now / windowMs) * windowMs\n  const previousStart = currentStart - windowMs\n  const fraction = (now - currentStart) / windowMs // 0..1 through the current window\n\n  const currentKey = `${prefix}:${identifier}:${currentStart}`\n  const previousKey = `${prefix}:${identifier}:${previousStart}`\n\n  // Keep the current counter alive long enough to still be read as \"previous\"\n  // during the next window.\n  const [previousCount, currentCount] = await step(store, currentKey, previousKey, windowMs * 2)\n\n  const weighted = previousCount * (1 - fraction) + currentCount\n  const reset = currentStart + windowMs\n  const success = weighted <= limit\n  return {\n    success,\n    limit,\n    remaining: Math.max(0, Math.floor(limit - weighted)),\n    reset,\n    retryAfter: success ? 0 : reset - now,\n  }\n}\n","import type { Store } from '../types.js'\n\ninterface Entry {\n  count: number\n  expiresAt: number\n}\n\n/**\n * In-process counter store. Used as the automatic fallback when no Redis is\n * configured. State is per-instance and not shared across processes, so it is\n * meant for local development and single-instance deployments, not distributed\n * production traffic.\n */\nexport class MemoryStore implements Store {\n  private readonly map = new Map<string, Entry>()\n  private readonly sweeper: ReturnType<typeof setInterval> | undefined\n\n  /** @param sweepMs How often to purge expired keys. Set to 0 to disable the timer (lazy expiry still applies). */\n  constructor(sweepMs = 30_000) {\n    if (sweepMs > 0 && typeof setInterval === 'function') {\n      this.sweeper = setInterval(() => this.sweep(), sweepMs)\n      // Never keep the event loop alive for cleanup alone.\n      this.sweeper.unref?.()\n    }\n  }\n\n  private live(key: string): Entry | undefined {\n    const entry = this.map.get(key)\n    if (!entry) return undefined\n    if (entry.expiresAt <= Date.now()) {\n      this.map.delete(key)\n      return undefined\n    }\n    return entry\n  }\n\n  async incr(key: string): Promise<number> {\n    const entry = this.live(key)\n    if (!entry) {\n      // Default to no expiry; pexpire is expected to follow on the first hit.\n      this.map.set(key, { count: 1, expiresAt: Number.POSITIVE_INFINITY })\n      return 1\n    }\n    entry.count += 1\n    return entry.count\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    const entry = this.live(key)\n    if (entry) entry.expiresAt = Date.now() + ms\n  }\n\n  async get(key: string): Promise<number> {\n    return this.live(key)?.count ?? 0\n  }\n\n  /**\n   * Atomic fixed-window step. JavaScript is single threaded and none of this\n   * awaits, so the increment and the TTL land together with no interleaving.\n   */\n  async fixedWindowStep(key: string, ttlMs: number): Promise<number> {\n    const entry = this.live(key)\n    if (!entry) {\n      this.map.set(key, { count: 1, expiresAt: Date.now() + ttlMs })\n      return 1\n    }\n    entry.count += 1\n    return entry.count\n  }\n\n  /** Atomic sliding-window step. Same reasoning as {@link fixedWindowStep}. */\n  async slidingWindowStep(\n    currentKey: string,\n    previousKey: string,\n    ttlMs: number,\n  ): Promise<[number, number]> {\n    const previous = this.live(previousKey)?.count ?? 0\n    const current = await this.fixedWindowStep(currentKey, ttlMs)\n    return [previous, current]\n  }\n\n  private sweep(): void {\n    const now = Date.now()\n    for (const [key, entry] of this.map) {\n      if (entry.expiresAt <= now) this.map.delete(key)\n    }\n  }\n\n  /** Stop the background sweeper. Optional; the timer is unref'd. */\n  dispose(): void {\n    if (this.sweeper) clearInterval(this.sweeper)\n  }\n}\n","/**\n * Lua scripts for the single-round-trip Redis path.\n *\n * The fallback path (`INCR` then a conditional `PEXPIRE`) costs two round trips\n * on the first hit of every window, and is not atomic: a process that dies\n * between the two commands leaves a key with no TTL, which then leaks in Redis\n * forever. Verified against Redis 7.4: `INCR` on a fresh key reports `TTL -1`\n * until the `PEXPIRE` lands.\n *\n * Running the same work inside `EVAL` fixes both: one round trip, and a TTL\n * that cannot be orphaned.\n *\n * Note on what this does NOT fix. It is tempting to claim the fallback races\n * under concurrency. It does not, at least not in a way that overshoots the\n * limit: the previous window's counter is a completed window that nothing\n * increments any more, so every concurrent caller reads the same stable value,\n * and `INCR` on the current key is atomic, so each caller gets a distinct\n * count. Measured over 50 concurrent callers against a real Redis, both paths\n * allow exactly the same number through.\n */\n\n/**\n * Fixed window. Increments the counter and sets the TTL on first touch.\n *\n * KEYS[1] window counter\n * ARGV[1] window length in milliseconds\n * returns the new count\n */\nexport const FIXED_WINDOW_SCRIPT = `\nlocal count = redis.call('INCR', KEYS[1])\nif count == 1 then\n  redis.call('PEXPIRE', KEYS[1], ARGV[1])\nend\nreturn count\n`.trim()\n\n/**\n * Sliding window. Reads the previous window's counter and increments the\n * current one as a single atomic unit.\n *\n * KEYS[1] current window counter\n * KEYS[2] previous window counter\n * ARGV[1] retention in milliseconds (two windows, so the current counter is\n *         still readable as \"previous\" during the next window)\n * returns { previousCount, currentCount }\n */\nexport const SLIDING_WINDOW_SCRIPT = `\nlocal previous = redis.call('GET', KEYS[2])\nlocal previousCount = 0\nif previous then\n  previousCount = math.floor(tonumber(previous) or 0)\nend\nlocal current = redis.call('INCR', KEYS[1])\nif current == 1 then\n  redis.call('PEXPIRE', KEYS[1], ARGV[1])\nend\nreturn { previousCount, current }\n`.trim()\n","import { FIXED_WINDOW_SCRIPT, SLIDING_WINDOW_SCRIPT } from '../lua.js'\nimport type { EvalStyle, RedisLike, Store } from '../types.js'\n\nexport interface RedisStoreOptions {\n  /** How to call the client's `eval`. Defaults to `'auto'`. */\n  evalStyle?: EvalStyle\n}\n\n/** Coerce whatever a client returns for a counter into a non-negative number. */\nfunction toCount(value: unknown): number {\n  if (value == null || value === false) return 0\n  const n = typeof value === 'number' ? value : Number(value)\n  return Number.isFinite(n) ? n : 0\n}\n\n/**\n * Decide which `eval` calling convention a client uses.\n *\n * `ioredis` is the odd one out: it takes a key count followed by flat keys and\n * args, and it is the only one of the two that exposes `defineCommand`. Every\n * other client we support (`@upstash/redis`) takes two arrays.\n */\nexport function detectEvalStyle(client: RedisLike): Exclude<EvalStyle, 'auto'> {\n  if (typeof client.eval !== 'function') return 'none'\n  if (typeof (client as { defineCommand?: unknown }).defineCommand === 'function') return 'ioredis'\n  return 'upstash'\n}\n\n/**\n * Adapts any Redis client with `incr` / `pexpire` / `get` (both `@upstash/redis`\n * and `ioredis` qualify) to the {@link Store} interface.\n *\n * When the client also exposes `eval`, checks run as a single atomic Lua call\n * instead of two or three separate commands. If a server rejects scripting the\n * store degrades to the portable path once and stays there.\n */\nexport class RedisStore implements Store {\n  private readonly client: RedisLike\n  private style: Exclude<EvalStyle, 'auto'>\n\n  constructor(client: RedisLike, options: RedisStoreOptions = {}) {\n    this.client = client\n    const requested = options.evalStyle ?? 'auto'\n    this.style = requested === 'auto' ? detectEvalStyle(client) : requested\n    if (this.style !== 'none' && typeof client.eval !== 'function') {\n      // An explicit style cannot conjure a method that is not there.\n      this.style = 'none'\n    }\n  }\n\n  /** True when this store will take the atomic Lua path. */\n  get atomic(): boolean {\n    return this.style !== 'none'\n  }\n\n  private async runScript(script: string, keys: string[], args: (string | number)[]): Promise<unknown> {\n    const evalFn = this.client.eval as (...a: unknown[]) => Promise<unknown>\n    if (this.style === 'ioredis') {\n      return evalFn.call(this.client, script, keys.length, ...keys, ...args)\n    }\n    return evalFn.call(this.client, script, keys, args)\n  }\n\n  /**\n   * Run `script`, falling back to the portable path forever if the server or\n   * client cannot handle scripting. A single failure is enough to decide: a\n   * server either supports EVAL or it does not, so retrying every request would\n   * just double the cost of every check on that deployment.\n   */\n  private async tryScript<T>(\n    script: string,\n    keys: string[],\n    args: (string | number)[],\n    parse: (raw: unknown) => T,\n  ): Promise<T | undefined> {\n    if (this.style === 'none') return undefined\n    try {\n      return parse(await this.runScript(script, keys, args))\n    } catch {\n      this.style = 'none'\n      return undefined\n    }\n  }\n\n  async incr(key: string): Promise<number> {\n    return this.client.incr(key)\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.client.pexpire(key, ms)\n  }\n\n  async get(key: string): Promise<number> {\n    return toCount(await this.client.get(key))\n  }\n\n  async fixedWindowStep(key: string, ttlMs: number): Promise<number> {\n    const viaScript = await this.tryScript(FIXED_WINDOW_SCRIPT, [key], [ttlMs], toCount)\n    if (viaScript !== undefined) return viaScript\n\n    const count = await this.incr(key)\n    if (count === 1) await this.pexpire(key, ttlMs)\n    return count\n  }\n\n  async slidingWindowStep(\n    currentKey: string,\n    previousKey: string,\n    ttlMs: number,\n  ): Promise<[number, number]> {\n    const viaScript = await this.tryScript(\n      SLIDING_WINDOW_SCRIPT,\n      [currentKey, previousKey],\n      [ttlMs],\n      (raw): [number, number] => {\n        const pair = raw as unknown[]\n        return [toCount(pair?.[0]), toCount(pair?.[1])]\n      },\n    )\n    if (viaScript !== undefined) return viaScript\n\n    const previous = await this.get(previousKey)\n    const current = await this.incr(currentKey)\n    if (current === 1) await this.pexpire(currentKey, ttlMs)\n    return [previous, current]\n  }\n}\n","import { FIXED_WINDOW_SCRIPT, SLIDING_WINDOW_SCRIPT } from '../lua.js'\nimport type { Store } from '../types.js'\n\nexport interface UpstashRestOptions {\n  url: string\n  token: string\n  /** Custom fetch implementation. Defaults to the global `fetch`. */\n  fetch?: typeof fetch\n}\n\n/** Coerce a REST result into a non-negative counter value. */\nfunction toCount(value: unknown): number {\n  if (value == null || value === false) return 0\n  const n = Number(value)\n  return Number.isFinite(n) ? n : 0\n}\n\n/**\n * Zero-dependency store backed by the Upstash Redis REST API. Uses `fetch`, so\n * it runs anywhere the runtime provides one (Node 18+, edge, workers) without\n * pulling in a Redis client. This is what env auto-detection constructs.\n */\nexport class UpstashRestStore implements Store {\n  private readonly url: string\n  private readonly token: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: UpstashRestOptions) {\n    this.url = options.url.replace(/\\/$/, '')\n    this.token = options.token\n    const f = options.fetch ?? globalThis.fetch\n    if (typeof f !== 'function') {\n      throw new Error('ratefall: no global fetch available; pass a `fetch` implementation to UpstashRestStore.')\n    }\n    this.fetchImpl = f\n  }\n\n  private async command(args: (string | number)[]): Promise<unknown> {\n    const res = await this.fetchImpl(this.url, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${this.token}`,\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(args.map(String)),\n    })\n    if (!res.ok) {\n      const detail = await res.text().catch(() => '')\n      throw new Error(`ratefall: Upstash REST error ${res.status} ${res.statusText}${detail ? ` - ${detail}` : ''}`)\n    }\n    const body = (await res.json()) as { result?: unknown; error?: string }\n    if (body.error) {\n      throw new Error(`ratefall: Upstash command failed - ${body.error}`)\n    }\n    return body.result\n  }\n\n  async incr(key: string): Promise<number> {\n    return Number(await this.command(['INCR', key]))\n  }\n\n  async pexpire(key: string, ms: number): Promise<void> {\n    await this.command(['PEXPIRE', key, ms])\n  }\n\n  async get(key: string): Promise<number> {\n    return toCount(await this.command(['GET', key]))\n  }\n\n  /** Run a Lua script through the REST API. Keys come first, then args. */\n  private async evalScript(\n    script: string,\n    keys: string[],\n    args: (string | number)[],\n  ): Promise<unknown> {\n    return this.command(['EVAL', script, keys.length, ...keys, ...args])\n  }\n\n  async fixedWindowStep(key: string, ttlMs: number): Promise<number> {\n    return toCount(await this.evalScript(FIXED_WINDOW_SCRIPT, [key], [ttlMs]))\n  }\n\n  async slidingWindowStep(\n    currentKey: string,\n    previousKey: string,\n    ttlMs: number,\n  ): Promise<[number, number]> {\n    const raw = (await this.evalScript(SLIDING_WINDOW_SCRIPT, [currentKey, previousKey], [ttlMs])) as unknown[]\n    return [toCount(raw?.[0]), toCount(raw?.[1])]\n  }\n}\n","import type { RateLimitOptions, Store } from './types.js'\nimport { MemoryStore } from './stores/memory.js'\nimport { RedisStore } from './stores/redis.js'\nimport { UpstashRestStore } from './stores/upstash-rest.js'\n\nexport interface ResolvedStore {\n  store: Store\n  /** Whether the store is shared across processes (Redis) vs per-instance (memory). */\n  distributed: boolean\n  /** Human-readable source, for the dev warning. */\n  source: string\n}\n\nfunction readEnv(key: string): string | undefined {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env\n  return env?.[key]\n}\n\n/**\n * Decide which store to use, in priority order:\n * 1. an explicit `store`\n * 2. an explicit `redis` client\n * 3. `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN` in the environment\n * 4. in-memory fallback\n */\nexport function resolveStore(options: RateLimitOptions): ResolvedStore {\n  if (options.store) {\n    return { store: options.store, distributed: true, source: 'custom store' }\n  }\n\n  if (options.redis) {\n    const store = new RedisStore(options.redis, { evalStyle: options.evalStyle })\n    return {\n      store,\n      distributed: true,\n      source: store.atomic ? 'redis client (atomic)' : 'redis client',\n    }\n  }\n\n  const url = readEnv('UPSTASH_REDIS_REST_URL')\n  const token = readEnv('UPSTASH_REDIS_REST_TOKEN')\n  if (url && token) {\n    return { store: new UpstashRestStore({ url, token }), distributed: true, source: 'Upstash REST (env)' }\n  }\n\n  return { store: new MemoryStore(), distributed: false, source: 'in-memory' }\n}\n\n/** True when the runtime looks like a production deployment. */\nexport function isProduction(): boolean {\n  return readEnv('NODE_ENV') === 'production'\n}\n","const UNITS: Record<string, number> = {\n  ms: 1,\n  s: 1000,\n  m: 60_000,\n  h: 3_600_000,\n  d: 86_400_000,\n}\n\nconst PATTERN = /^(\\d+(?:\\.\\d+)?)\\s*(ms|s|m|h|d)$/\n\n/**\n * Normalize a window into milliseconds. Accepts a raw millisecond number or a\n * duration string like `'500ms'`, `'10s'`, `'1m'`, `'2h'`, `'1d'`.\n */\nexport function parseWindow(window: string | number): number {\n  if (typeof window === 'number') {\n    if (!Number.isFinite(window) || window <= 0) {\n      throw new RangeError(`ratefall: window must be a positive number of milliseconds, got ${window}`)\n    }\n    return Math.floor(window)\n  }\n\n  const match = PATTERN.exec(window.trim())\n  if (!match) {\n    throw new TypeError(`ratefall: invalid window \"${window}\". Use a number of ms or a string like \"10s\", \"1m\", \"2h\".`)\n  }\n\n  const value = Number(match[1])\n  const unit = UNITS[match[2] as string] as number\n  const ms = Math.floor(value * unit)\n  if (ms <= 0) {\n    throw new RangeError(`ratefall: window must be greater than 0, got \"${window}\".`)\n  }\n  return ms\n}\n","import type { AlgorithmContext, AlgorithmFn } from './algorithms/index.js'\nimport { fixedWindow } from './algorithms/fixed-window.js'\nimport { slidingWindow } from './algorithms/sliding-window.js'\nimport { isProduction, resolveStore } from './resolve-store.js'\nimport type { RateLimiter, RateLimitOptions } from './types.js'\nimport { parseWindow } from './window.js'\n\nconst ALGORITHMS: Record<string, AlgorithmFn> = {\n  'fixed-window': fixedWindow,\n  'sliding-window': slidingWindow,\n}\n\n/**\n * Create a rate limiter. With no store configured it uses an in-memory counter\n * (great for local dev); set `UPSTASH_REDIS_REST_URL` + `UPSTASH_REDIS_REST_TOKEN`,\n * or pass a `redis` client, and the exact same code becomes distributed.\n *\n * @example\n * const limiter = rateLimit({ limit: 10, window: '10s' })\n * const { success } = await limiter.limit(userId)\n * if (!success) return new Response('slow down', { status: 429 })\n */\nexport function rateLimit(options: RateLimitOptions): RateLimiter {\n  const { limit, algorithm = 'fixed-window', prefix = 'ratefall', silent = false } = options\n\n  if (!Number.isInteger(limit) || limit <= 0) {\n    throw new RangeError(`ratefall: limit must be a positive integer, got ${limit}`)\n  }\n\n  const run = ALGORITHMS[algorithm]\n  if (!run) {\n    throw new TypeError(`ratefall: unknown algorithm \"${algorithm}\". Use \"fixed-window\" or \"sliding-window\".`)\n  }\n\n  const windowMs = parseWindow(options.window)\n  const { store, distributed, source } = resolveStore(options)\n\n  if (!distributed && !silent && isProduction()) {\n    // Not an error: single-instance prod is legitimate. But un-shared limits in a\n    // multi-instance deploy are a footgun, so make it loud exactly once.\n    console.warn(\n      `ratefall: running with an in-memory store in production. Limits are per-instance and NOT shared. ` +\n        `Set UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN or pass a \\`redis\\` client. Pass \\`silent: true\\` to hide this.`,\n    )\n  }\n\n  const ctx: AlgorithmContext = { limit, windowMs, prefix }\n\n  return {\n    async limit(identifier: string) {\n      if (!identifier) {\n        throw new TypeError('ratefall: identifier must be a non-empty string.')\n      }\n      return run(store, ctx, identifier, Date.now())\n    },\n  }\n}\n\n/** The resolved store source, exposed for debugging/tests. */\nexport { resolveStore } from './resolve-store.js'\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ratefall",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A rate limiter that just works: distributed (Redis) in production, in-memory in development, same code, zero store wiring.",
   "keywords": [
     "rate-limit",