June 24, 2026

@envelop/rate-limiter@10.1.0

Minor Changes

• #4530
  62c2cd1
  Thanks @enisdenjo! - Field config now accepts an identifier
  template string as a lightweight alternative to identifyFn

  Supports {args.argName} and {context.propName} dot-path interpolation, equivalent to using
  @rateLimit(identityArgs: [...]) via the directive but available in programmatic config.

  useRateLimiter({
    identifyFn: ctx => ctx.ip,
    configByField: [
      {
        type: 'Query',
        field: 'getProduct',
        window: '1m',
        max: 10,
        identifier: '{args.id}'
      },
      {
        type: 'Query',
        field: 'search',
        window: '1m',
        max: 30,
        identifier: '{context.ip}'
      }
    ]
  })

• #4530
  62c2cd1
  Thanks @enisdenjo! - identifyFn now receives field argument
  values as a second parameter when used via configByField

  The per-field identifyFn on ConfigByField receives the resolved argument values, making it
  straightforward to rate limit unauthenticated requests by argument value without a directive.

  useRateLimiter({
    identifyFn: ctx => ctx.ip,
    configByField: [
      {
        type: 'Query',
        field: 'getProduct', // getProduct(id: ID!): Product!
        window: '1m',
        max: 10,
        identifyFn: (ctx, args) => String(args.id)
      }
    ]
  })

  Note: the root identifyFn also receives args as a second parameter when it acts as the fallback
  for a configByField entry, but args will be empty when it is invoked for directive-based rate
  limiting.