# Tasks — add-api-plugin-rate-limit

## 1. Spec authoring

- [x] 1.1 Read `../suaveplan/enterprise/api-plugin-rate-limit.md`
- [x] 1.2 Read `openspec/AGENTS.md` §13 + §14
- [x] 1.3 Author `proposal.md` from template, fill `## Source mapping`
- [x] 1.4 Author `specs/api-plugin-rate-limit/spec.md` from template with `**Verified by:**` on every requirement

## 2. Implementation

- [x] 2.1 `src/error-codes/error-codes.{ts,md,index.ts}` — 5 codes + `RateLimitPluginError`
- [x] 2.2 `src/types/types.{ts,md,index.ts}` — public type surface
- [x] 2.3 `src/schemas/options.{ts,md,index.ts}` — `RateLimitPluginOptionsSchema`
- [x] 2.4 `src/path-matcher/path-matcher.{ts,md,index.ts}` — `compilePathPattern` / `matchPath` / `isPathMatch`
- [x] 2.5 `src/headers/headers.{ts,md,index.ts}` — `buildRateLimitHeaders` + `buildRateLimitProblem`
- [x] 2.6 `src/otel/instruments.{ts,md,index.ts}` — counters + histogram bundle + `getRateLimitInstruments` / `resetRateLimitInstruments`
- [x] 2.7 `src/services/rate-limit-service.{ts,md,index.ts}` — `RateLimitService` factory + `createDefaultStorage`
- [x] 2.8 `src/services/registry-augmentation.{ts,md}` — `ServiceRegistry` module augmentation + `registerRateLimitServiceSlot`
- [x] 2.9 `src/middleware/rate-limit.{ts,md,index.ts}` — `rateLimit` factory + `rateLimitExceeded`
- [x] 2.10 `src/middleware/context-augmentation.{ts,md}` — Hono `ContextVariableMap` augmentation
- [x] 2.11 `src/plugin/plugin.{ts,md,index.ts}` — `createRateLimitPlugin` factory; canonical 6-step `onInit`
- [x] 2.12 `src/index.ts` — named re-exports only

## 3. Tests

- [x] 3.1 Co-located `*.test.ts` per implementation file
- [x] 3.2 `src/api-plugin-rate-limit.spec-conformance.test.ts` — every code reachable + `expectTypeOf` on `RateLimitService` / `RateLimitDecision` / `ContextVariableMap` augmentation
- [x] 3.3 `tests/integration/full-app.test.ts` — real Hono app + plugin + multiple routes; 429 emission, Retry-After, per-tenant isolation, headers on allowed AND denied responses
- [x] 3.4 `tests/dep-graph.test.ts` — deps + 10 subpaths + sibling `.md` per feature
- [x] 3.5 All tests via `@suaveplan/testing/runner`, `{ timeout: 5000 }` (30000 for integration)

## 4. Documentation

- [x] 4.1 Sibling `.md` per impl (≥200 words, basic + advanced examples)
- [x] 4.2 `README.md` — quick start + manual `service.check(...)` recipe + module index

## 5. Pre-archive gates (in order)

- [x] 5.1 `cd /home/paul/web/genesis && bun run check`
- [x] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/api-plugin-rate-limit --force`
- [x] 5.3 `bunx turbo test:coverage --filter=@suaveplan/api-plugin-rate-limit` → 100/100/100/100
- [x] 5.4 `bun scripts/openspec-conformance.ts @suaveplan/api-plugin-rate-limit` → exit 0
- [x] 5.5 `bunx turbo build --filter=@suaveplan/api-plugin-rate-limit --force`
- [x] 5.6 `bun scripts/lint/check-test-runner-imports.ts`

## 6. Pre-archive 9-row checklist

- [x] 6.1 Generics threaded; `expectTypeOf` assertions on every literal-type claim
- [x] 6.2 Zod schemas wired at every declared boundary
- [x] 6.3 Every error code in `error-codes.ts` thrown / surfaced by ≥1 production code path
- [x] 6.4 OTel instruments emitted from production paths and asserted with real `MeterProvider`
- [x] 6.5 Lifecycle dedup — `onInit` idempotent; lazy limiter cache rebound per `(route, tenant)` pair
- [x] 6.6 No retroactive tick — every box above reflects work done in this change
- [x] 6.7 No `export *` in feature barrels (verified by grep)
- [x] 6.8 No direct `vitest` / `bun:test` imports (verified by grep)
- [x] 6.9 No banned patterns (`TODO`, `FIXME`, `.skip`, `.only`, `any`) in src

## 7. Archive

- [x] 7.1 Fold spec → `openspec/specs/api-plugin-rate-limit/spec.md`
- [x] 7.2 mv change → `openspec/archive/2026-05-18-add-api-plugin-rate-limit/`
- [x] 7.3 DO NOT refresh MANIFEST or STATUS — orchestrator consolidates after the 4-package batch