52Implement a sliding-window rate limiter

Implement createSlidingWindowLimiter({ limit, windowMs, now = Date.now }). It allows at most limit requests per key in any window of windowMs milliseconds, not just per fixed minute.

It returns:

• tryAcquire(key = "default"): record a request and return true if allowed; otherwise return false and record nothing.
• retryAfter(key = "default"): milliseconds until the next request for key would be allowed (0 if now).

const limiter = createSlidingWindowLimiter({ limit: 5, windowMs: 60_000 });
if (!limiter.tryAcquire(userId)) {
  showToast(`Too many attempts. Try again in ${Math.ceil(limiter.retryAfter(userId) / 1000)} s`);
}

Requirements

• A request made at time t stops counting at t + windowMs.
• Keys are independent.
• Forget timestamps that left the window, so memory stays bounded by limit per key, and drop keys that have no recent requests.
• now is injectable so tests can control time.