Ratelock

Engines

Local Engine

Zero-dependency, in-memory rate limiting for single-process apps.

The Local engine stores rate limit state in memory using JavaScript Map objects. It has zero external dependencies and provides sub-millisecond latency.

Installation

npm install @ratelock/local

Quick Start

import { fixedWindow, slidingWindow, tokenBucket, individualFixedWindow } from '@ratelock/local'

const limiter = await fixedWindow({
    limit: 100,
    windowMs: 60_000,
})

const result = await limiter.check('user:123')

All Strategies

FunctionStrategy
fixedWindowFixed Window
slidingWindowSliding Window
tokenBucketToken Bucket
individualFixedWindowIndividual Fixed Window

Configuration Options

All limiters in the Local engine accept these shared base options:

Prop

Type

Strategy-specific options are documented in the Strategies section.

Built-in Resilience Policies

All limiters accept optional resilience configurations at creation time:

const limiter = await fixedWindow({
    limit: 100,
    windowMs: 60_000,
    // Built-in resilience policies (configured at creation time)
    retry: { maxAttempts: 3 },
    fallback: 'allow', // fallback to allow if the limiter errors
})
OptionTypeDescription
retryRetryConfigRetry transient failures with exponential backoff
circuitBreakerCircuitBreakerConfigStop calling after consecutive failures
fallback'throw' | 'allow' | 'deny'Behavior when the limiter throws

Note

cache is not supported on the Local engine. There is no network latency to cache.

Standalone Policies (Advanced)

For advanced use cases, import standalone resilience wrappers directly:

import { withFallback, withRetry } from '@ratelock/local'

const limiter = await fixedWindow({ limit: 100, windowMs: 60_000 })
const withResilience = withFallback(withRetry(limiter, { maxAttempts: 3 }), 'allow')

See Resilience Policies for full documentation and when to use standalone vs built-in.

API Reference

The factory functions accept these configuration types:

FixedWindowLimiterConfig

Prop

Type

When to Use

  • Single-server or single-process deployments
  • Development and testing environments
  • When you want zero external dependencies
  • When sub-millisecond latency matters

Limitations

  • Not distributed: State is not shared across processes or servers
  • Volatile: Rate limit state is lost on process restart
  • Memory-bound: Large numbers of unique identifiers consume memory

Cleanup

await limiter.destroy() // Clears internal state

How is this guide?

Last updated on

On this page