[chrnx-dev]

Draft: blocked on the core release. On Deno and Bun this test fails against the pinned @green-tea/core@26.9.0-beta.2, on purpose. Merge it together with the core pin bump to the first release that carries core #116 (merged in core #117), and not before. Until then, red runtimes (deno) and runtimes (bun) checks are expected. They are the regression being caught, not a broken test.

What this changes

The default keyOf buckets callers by ctx.ip. Until core #116, serveDeno and serveBun left ctx.ip as '', so every caller on those runtimes landed in the one 'unknown' bucket, and the first client to reach max locked out everyone else. Node's listen() always filled it from the socket.

packages/rate-limit/test/peer-ip.test.ts drives the plugin's default keyOf over a real socket, on whichever runtime runs it:

• one dual-stack listener on ::, via serveDeno, serveBun, or app.listen() on Node
• max: 1; client A connects over 127.0.0.1 and client B over ::1
• A's second request must be 429, B's first must be 200, and the two ctx.ip values must be non-empty and different

Node is the control: it passes on any core. A host with no IPv6 loopback falls back to 127.0.0.1 and 127.0.0.2, which only Linux routes, and the test logs a diagnostic when it does.

Test only. There is no plugin-contract change, no src/ change and no engines change. Nothing in this PR bumps the core pin. That belongs to the release cut.

Why a draft rather than a skip

CI installs core with npm ci from the lockfile: @green-tea/core@26.9.0-beta.2 from npmjs.org, and Deno resolves that same tree through nodeModulesDir: "manual". No mechanism points CI at an unreleased core, and the repo has no convention for tests that wait on one. Skipping on old core, or marking the test todo, would let it pass silently on exactly the core it exists to reject. So the test stays strict, and this PR waits for the pin.

Which runtimes you ran

Against the pinned 26.9.0-beta.2 (what CI will see):

• npm test (Node): 61 pass, 0 fail
• npm run test:deno: 31 pass, 1 fail (ctx.ip was empty for client A on this serving path: "")
• npm run test:bun: 31 pass, 1 fail (same assertion)
• npm run test:edge: rate-limit does not declare workerd

Against a candidate core built from core develop at 4d1639f and swapped into node_modules/@green-tea/core locally:

• npm test: 61 pass, 0 fail
• npm run test:deno: 32 pass, 0 fail
• npm run test:bun: 32 pass, 0 fail

Checklist

• The base branch above is contrib
• Commits are signed off (git commit -s)
• lint, format:check, typecheck, complexity:check and deno publish --dry-run pass locally
• New behaviour has a test
• Core is still imported as import type only in src/. The test imports it as a value, as the other tests do
• engines unchanged
• Not a breaking change

npm audit --audit-level=moderate: 0 vulnerabilities. No open Dependabot alerts.

[chrnx-dev]

Moved to the primary forge, where this repository's pull requests are reviewed. This mirror is synced from there.