Rate Limiter

Ownership and transitions

The accepted interval is (now-window,now], so the exact left boundary expires. Accepted timestamps and observed time are distinct: denials record no accepted timestamp but still advance that client clock. Separate per-client clocks allow unrelated logical times. A deque can expire each timestamp once; retained history grows with accepted active events.

JavaScript boundaries

Use native classes with per-instance state and plain object/array snapshots. Object assignment shares a reference; copy retained inputs and every outward mutable container, including nested arrays. null means absence. Map handles arbitrary string keys safely, including "__proto__"; do not confuse a missing key with zero or an empty string. Domain validation uses RangeError. Numeric inputs must satisfy Number.isSafeInteger, so booleans, fractions, infinities, and NaN are invalid where an integer is required. All documented aggregate results and timestamp-plus-duration sums fit the safe-integer range. Strings use exact case-sensitive equality; lexical order compares JavaScript UTF-16 code units. Calls are serialized and synchronous.

const internal = ["initial"];
const snapshot = [...internal];
snapshot.length = 0;
console.assert(internal.length === 1);

A detached snapshot protects ownership; the service still has to validate and commit a coherent transition.