Package · MIT
limitkit
Rate limiting as a decision, not middleware. Bounded memory by construction, standard headers.
Why it exists
Public routes were growing one-off counters that forgot to bound themselves, and that told the client nothing when they said no. The failure mode is a process that remembers every IP forever.
How it works
Fixed and sliding windows over a store you pass in, with a bounded in-memory store as the default. The decision is separate from the framework. The response carries the standard rate-limit headers, and the client IP is read in one place.
Where it fits
It is what lets a small studio leave a door open — hire, pay links, public APIs — without one caller becoming the outage. Eight apps already depend on that being true.