first commit

examples/basic-app/app/middleware/ratelimit.ts

@@ -0,0 +1,16 @@
+import { rateLimit, type Context, type Next } from "@wrnexus/core";
+
+// Scoped rate limiting: throttle POST /api/login to blunt brute-force attempts.
+// The limiter keeps per-IP counters; other routes pass straight through.
+const loginLimiter = rateLimit({
+  max: 5,
+  windowMs: 60_000,
+  message: "Too many login attempts. Please wait a minute and try again.",
+});
+
+export default async function ratelimit(ctx: Context, next: Next) {
+  if (ctx.url.pathname === "/api/login" && ctx.req.method === "POST") {
+    return loginLimiter(ctx, next);
+  }
+  return next();
+}