Throtto: Rate Limiting Library

Overview

A modern rate limiting library designed to be the “all-in-one” solution. Instead of cobbling together multiple packages for different algorithms and frameworks, throtto provides everything in one composable package.

Features

7 Algorithms:

• Fixed Window, Sliding Window (counter + log)
• Token Bucket, Leaky Bucket
• GCRA, Concurrency

6 Storage Adapters:

• Memory, Redis, Upstash, PostgreSQL, MySQL, SQLite

18 Framework Adapters:

• Express, Fastify, Hono, Next.js, SvelteKit, Remix, Astro, NestJS, Elysia, H3, tRPC, WebSocket, Koa, Lambda, Cloudflare Workers, Bun, Deno, generic HTTP

Design Principles

• Composable — pipe() API for combining limiters, wrappers, and patterns
• Zero runtime dependencies — core has no deps, storage backends are optional peer deps
• TypeScript-first — strict types, full inference
• Testing-first — controllable clocks, mock stores, assertion helpers
• Standards-compliant — RFC 9309 rate-limit headers, RFC 7807 error bodies

Production Features

• Allowlists and overrides
• Dry-run / shadow mode
• Backpressure and penalty box
• Prometheus metrics export
• Graceful shutdown

Architecture

import { pipe, fixedWindow, memory, withHeaders } from '@tzezar/throtto'

const limiter = pipe(
  fixedWindow({ max: 100, window: '1m' }),
  memory(),
  withHeaders(),
)