GeezerVison

Summary

rateLimit took a RateLimiterAbstract only. Its limiters count points per window, so a caller may spend them all at the window's start. rate-limiter-flexible already has the answer — BurstyRateLimiter, a steady limiter plus a burst one — but it isn't a RateLimiterAbstract, and it has no duration for the headers' window.

 export const rateLimit = (
-  rateLimiter: RateLimiterAbstract,
+  rateLimiter: RateLimiter, // RateLimiterAbstract | BurstyRateLimiter
   options?: RateLimitOptions<H>,
 ) => {
+  const steady = steadyOf(rateLimiter) // a BurstyRateLimiter's main limiter
   const infoFor = (res, limited) => ({
-    limit: rateLimiter.points,
-    window: rateLimiter.duration,
+    limit: steady.points,
+    window: steady.duration,

• The headers report the steady limit; a call drawing on the burst has none of it left (remaining: 0).
• The steady limiter is found by its shape (_rateLimiter), not instanceof: rate-limiter-flexible stays an optional peer, imported for types only, so loading the hooks without it keeps working.
• Docs: a "Bursts" section with an example.

Evidence

BurstyRateLimiter(1 point / 60 s, burst 2 points / 60 s), headers 'draft-7'
  1st call → steady:  RateLimit-Policy "1;w=60", RateLimit "limit=1, remaining=0, reset=60"
  2nd, 3rd → burst:   pass, remaining=0
  4th      → TooManyRequests, retryAfter 60

Without the change, the window reads w=undefined and the limiter doesn't type-check.

pnpm test: 158 files, 2010 passed, no lint errors, no type errors.

Merge Danger

Door: two-way

Additive: the parameter's type widens, a RateLimiterAbstract behaves as before.

Blast Radius: none

Relies on BurstyRateLimiter's _rateLimiter field, which it has had since it was added; if it were renamed, the headers would read the bursty limiter's points and an empty window, and the limiting itself would still work.

🤖 Generated with Claude Code