🥮 mooncakes.io

    moonbitstack/moonzero/limit does not have a README file

    MaxConns

    source
    pub struct MaxConns {
      gate : 
    Gate
    }

    A permit pool of max concurrent slots (← go-zero's syncx.Limit), moonward's Gate under go-zero's names. A max of zero or less admits everything, as go-zero's server does when MaxConns is unset.

    MaxConns::in_flight

    source
    fn MaxConns::in_flight(self : MaxConns) -> Int

    The number of requests currently holding a permit.

    MaxConns::new

    source
    fn MaxConns::new(max : Int) -> MaxConns

    A pool admitting at most max requests at once.

    MaxConns::release

    source
    fn MaxConns::release(self : MaxConns) -> Unit

    Return a permit taken by try_acquire (Return).

    MaxConns::try_acquire

    source
    fn MaxConns::try_acquire(self : MaxConns) -> Bool

    Take a permit if one is free (TryBorrow), returning whether it was taken.

    PeriodLimit

    source
    pub struct PeriodLimit {
      period : 
    Span
      quota : Int
      align : Bool
      windows : Map[String, 
    Period    ]
    }

    A fixed-window rate limiter kept in this process: each key may make up to quota requests per period, counted by one moonward Period per key. A key's window opens on its first request, or with align on a multiple of the period (← go-zero's Align()), and starts again once the period has passed.

    The window is local, so N replicas admit N quotas. RedisPeriodLimit is the same limiter with its window in redis and is what a fleet should run; this one is for a single process, and for the fallback a caller wants when redis is unreachable.

    PeriodLimit::new

    source
    fn PeriodLimit::new(period_secs~ : Int, quota~ : Int, align? : Bool) -> PeriodLimit

    A limiter admitting quota requests per period_secs seconds, per key.

    PeriodLimit::take

    source
    fn PeriodLimit::take(self : PeriodLimit, key : String, now : Int64) -> PeriodResult

    Account for one request under key at now, in milliseconds, and report its outcome: PeriodAllowed below quota, PeriodHitQuota at exactly the quota (the last admitted request), and PeriodOverQuota beyond it.

    PeriodResult

    source
    pub(all) enum PeriodResult {
      PeriodAllowed
      PeriodHitQuota
      PeriodOverQuota
    } derive(Eq, 
    Debug    )

    The outcome of a PeriodLimit.take (← go-zero's period-limit result codes): a request within quota, the one that reaches it exactly (still admitted), or one beyond it (rejected).

    PeriodResult::equal

    source

    PeriodResult::not_equal

    source
    fn PeriodResult::not_equal(x : PeriodResult, y : PeriodResult) -> Bool

    PeriodResult::to_repr

    source

    RedisPeriodLimit

    source
    pub struct RedisPeriodLimit {
      client : 
    Client
      script : 
    Script
      period_secs : Int
      quota : Int
      prefix : String
    }

    A fixed-window rate limiter whose window lives in redis (← go-zero's limit.PeriodLimit). One INCRBY-ed counter per key, given a period-second expiry the first time it appears, so every replica pointed at the same redis and key draws on one quota instead of each getting its own.

    RedisPeriodLimit::new

    source
    fn RedisPeriodLimit::new(client : 
    Client    , period_secs~ : Int, quota~ : Int, prefix? : String) -> RedisPeriodLimit

    A limiter admitting quota requests per period_secs seconds per key, counting in client's redis under prefix-prefixed keys.

    RedisPeriodLimit::take

    source

    Account for one request under key and report its outcome, in the same three states the local limiter reports. A code the script cannot have returned, or a reply that is not an integer at all, raises — go-zero answers Unknown with ErrUnknownCode there, and a caller has to decide what an undecided limiter means.

    RedisTokenLimit

    source
    pub struct RedisTokenLimit {
      client : 
    Client
      script : 
    Script
      rate : Int
      burst : Int
      token_key : String
      ts_key : String
      rescue : TokenBucket
      alive : Bool
      probing : Bool
    }

    A token-bucket rate limiter whose bucket lives in redis (← go-zero's limit.TokenLimiter). The token count and the second it was last refilled sit under {key}.tokens and {key}.ts, so every replica pointed at the same redis and key spends from one bucket. When redis cannot be reached the limiter keeps limiting from rescue, its process-local TokenBucket, the way go-zero drops to its in-process rescueLimiter rather than letting an outage open the gate.

    RedisTokenLimit::allow

    source
    async fn RedisTokenLimit::allow(self : RedisTokenLimit, now_ms : Int64) -> Bool

    Try to admit one request at now_ms.

    RedisTokenLimit::allow_n

    source
    async fn RedisTokenLimit::allow_n(self : RedisTokenLimit, n : Int, now_ms : Int64) -> Bool

    Try to admit a request costing n tokens at now_ms. The script is handed whole seconds because go-zero hands it now.Unix(): the shared bucket refills at one-second granularity however finely the clock is read. Lua's false arrives as a null reply and its true as 1; anything else, and any redis failure, is served by the local bucket instead.

    RedisTokenLimit::is_alive

    source
    fn RedisTokenLimit::is_alive(self : RedisTokenLimit) -> Bool

    Whether this limiter is drawing on the shared bucket. false means it is on its local one, waiting for the probe to find redis again.

    RedisTokenLimit::mark_alive

    source
    fn RedisTokenLimit::mark_alive(self : RedisTokenLimit) -> Unit

    Mark redis as answering again. The shared bucket still holds whatever the last replica left in it, so the limiter picks up the fleet's quota rather than a fresh one.

    RedisTokenLimit::mark_down

    source
    fn RedisTokenLimit::mark_down(self : RedisTokenLimit) -> Unit

    Mark redis as unreachable without waiting for a call to fail — what a liveness probe does when it sees the connection drop.

    RedisTokenLimit::new

    source
    fn RedisTokenLimit::new(client : 
    Client    , rate~ : Int, burst~ : Int, key~ : String) -> RedisTokenLimit

    A limiter admitting rate requests per second with room for a burst of that many back-to-back, over the bucket key names in client's redis.

    RedisTokenLimit::probe

    source
    async fn RedisTokenLimit::probe(self : RedisTokenLimit) -> Bool

    Ping redis once and switch the limiter back to the shared bucket when it answers. The reading is the caller's: an unreachable redis is not an error here, it is the reason the local bucket exists.

    RedisTokenLimit::probe_forever

    source
    async fn RedisTokenLimit::probe_forever(self : RedisTokenLimit, interval_ms? : Int, report? : (Bool) -> Unit) -> Unit

    Probe every interval_ms until cancelled, and hand each reading to report.

    This is the background half of the liveness model: the limiter marks itself down the moment a call fails, and this loop is what brings it back. It is a function rather than a task the limiter starts for itself, so where the task belongs — which group, which lifetime — stays the caller's decision.

    RedisTokenLimit::probing

    source
    fn RedisTokenLimit::probing(self : RedisTokenLimit) -> Bool

    Whether a background probe is running.

    RedisTokenLimit::rescue

    source

    The process-local bucket this limiter falls back to, so a caller can inspect it.

    TokenBucket

    source
    pub struct TokenBucket {
      bucket : 
    Bucket
    }

    A token-bucket rate limiter kept in this process: the bucket holds up to burst tokens and refills continuously at rate a second, and each admitted request spends one. Every decision is a function of the state and now, so the limiter is testable without a real clock.

    The bucket is local, so N replicas admit N times the rate. RedisTokenLimit is the same limiter with its bucket in redis and is what a fleet should run; this one serves a single process, and is what RedisTokenLimit itself falls back to when redis is unreachable (← go-zero's rescueLimiter).

    TokenBucket::allow

    source
    fn TokenBucket::allow(self : TokenBucket, now : Int64) -> Bool

    Try to admit one request at time now. Returns true when admitted, false when the bucket is empty.

    TokenBucket::allow_n

    source
    fn TokenBucket::allow_n(self : TokenBucket, n : Double, now : Int64) -> Bool

    Try to admit a request costing n tokens at time now. Returns false (spending nothing) when fewer than n tokens are available.

    TokenBucket::available

    source
    fn TokenBucket::available(self : TokenBucket, now : Int64) -> Double

    The (fractional) number of tokens currently available at now. Useful for metrics and tests.

    TokenBucket::new

    source
    fn TokenBucket::new(rate : Double, burst? : Double, now? : Int64) -> TokenBucket

    Build a bucket admitting rate requests per second on average with room for a burst of that many back-to-back (default burst = rate). It starts full at time now, in milliseconds.

    The bucket is moonward's; this keeps go-zero's shape and its millisecond clock. A capacity below one token is raised to one, because a bucket that can never hold a whole token admits nothing at all — which is what a fractional rate with no burst used to give.

    period_script

    source
    let period_script : String

    go-zero's core/limit/periodscript.lua, verbatim: INCRBY the key, hang the window on it the first time it appears, and answer 1 below quota, 2 exactly at it, 0 past it. Public so a caller can pre-load it, and so a redis double can evaluate the very text the limiter ships.

    token_script

    source
    let token_script : String

    go-zero's core/limit/tokenscript.lua, verbatim: read the bucket and the second it was last touched, refill by the elapsed seconds capped at capacity, spend requested if that many are there, and write both back under a TTL of two fill times. Public so a caller can pre-load it, and so a redis double can evaluate the very text the limiter ships.

    Source Files

    Powered by MoonBit

    Site sourceReport issueModulesSkillsCLIBuild queueStatistics

    © 2026 mooncakes.io