lambder 12.0.1 → 14.0.1

package/dist/shared/LambderI18n.js

@@ -112,6 +112,38 @@ const interpolate = (text, params) => {
         return text;
     return text.replace(/\{([^{}]+)\}/g, (token, name) => Object.prototype.hasOwnProperty.call(params, name) ? String(params[name]) : token);
 };
+/** The `{name}` tokens a text carries, as interpolate reads them. */
+const placeholdersOf = (text) => new Set([...text.matchAll(/\{([^{}]+)\}/g)].map((match) => match[1]));
+/** A set of placeholders as a message shows it: `{count}, {name}`, or "none". */
+const describePlaceholders = (placeholders) => placeholders.size ? [...placeholders].sort().map((name) => `{${name}}`).join(", ") : "none";
+/** How many mismatched translations an error lists before it only counts the rest. */
+const PLACEHOLDER_MISMATCH_LIMIT = 20;
+/**
+ * Refuses translations that do not carry the placeholders of the text they
+ * translate. The default language's text is the contract the translator's
+ * type takes its parameters from, so a translation that drops one loses the
+ * value a caller passed, and one that adds one shows its `{token}` as it
+ * is. `lookupDefault` answers the default language's text for a key, and a
+ * key it has none for is left to the other checks.
+ */
+const assertPlaceholdersKept = (lookupDefault, lang, dict, label) => {
+    const mismatches = [];
+    for (const [key, text] of Object.entries(dict)) {
+        const original = lookupDefault(key);
+        if (original === undefined || typeof text !== "string")
+            continue;
+        const expected = placeholdersOf(original);
+        const found = placeholdersOf(text);
+        if (expected.size === found.size && [...expected].every((name) => found.has(name)))
+            continue;
+        mismatches.push(`"${key}" has ${describePlaceholders(found)} where the default language has ${describePlaceholders(expected)}`);
+    }
+    if (mismatches.length === 0)
+        return;
+    const listed = mismatches.slice(0, PLACEHOLDER_MISMATCH_LIMIT).map((line) => `  ${line}`);
+    const more = mismatches.length > PLACEHOLDER_MISMATCH_LIMIT ? [`  ... and ${mismatches.length - PLACEHOLDER_MISMATCH_LIMIT} more`] : [];
+    throw new Error([`LambderI18n: in ${label}, these "${lang}" translations carry other placeholders than the default language's text:`, ...listed, ...more].join("\n"));
+};
 const layerLookup = (layer, lang, key) => {
     for (let node = layer; node; node = node.parent) {
         const value = node.dicts[lang]?.[key];
@@ -133,7 +165,12 @@ const assertInlineDefaultBlock = (dict, defaultLanguage, label) => {
         throw new Error(`LambderI18n: ${label} must give the default language "${defaultLanguage}" inline, not as a loader.`);
     }
 };
-const createLayer = (core, sources, parent) => {
+/**
+ * A layer over its parent, from a dictionary set as configured. The inline
+ * blocks' placeholders are checked here, against the default language's
+ * texts the layer reaches; a loader's are checked when it has run.
+ */
+const createLayer = (core, sources, parent, label) => {
     const layer = { dicts: {}, loaders: new Map(), inFlight: new Map(), parent };
     for (const [lang, source] of Object.entries(sources)) {
         if (typeof source === "function")
@@ -141,6 +178,10 @@ const createLayer = (core, sources, parent) => {
         else if (source)
             layer.dicts[lang] = source;
     }
+    for (const [lang, dict] of Object.entries(layer.dicts)) {
+        if (lang !== core.defaultLanguage && dict)
+            assertPlaceholdersKept((key) => layerLookup(layer, core.defaultLanguage, key), lang, dict, label);
+    }
     if (layer.loaders.size > 0)
         core.lazyLayers.add(layer);
     return layer;
@@ -172,6 +213,7 @@ const startLayerLoad = (core, layer, lang, loader) => {
         const dict = dictionaryFromLoaded(loaded, lang);
         if (layer.parent)
             assertNoRedeclaredKeys(layer.parent, core.defaultLanguage, dict, `the "${lang}" loader`);
+        assertPlaceholdersKept((key) => layerLookup(layer, core.defaultLanguage, key), lang, dict, `the "${lang}" loader`);
         // Translations registered while the loader ran override what it brought.
         layer.dicts[lang] = { ...dict, ...layer.dicts[lang] };
     })
@@ -254,11 +296,11 @@ const buildInstance = (core, layer) => {
         },
         extend(dict) {
             validateExtension(dict, core.languageList, "extend() dictionary");
-            return buildInstance(core, createLayer(core, dict, layer));
+            return buildInstance(core, createLayer(core, dict, layer, "extend() dictionary"));
         },
         extendPartial(dict) {
             validateExtension(dict, core.enforced, "extendPartial() dictionary");
-            return buildInstance(core, createLayer(core, dict, layer));
+            return buildInstance(core, createLayer(core, dict, layer, "extendPartial() dictionary"));
         },
         loadLanguage(code) {
             const lang = code ?? core.state.resolve();
@@ -269,6 +311,9 @@ const buildInstance = (core, layer) => {
         registerDictionary(code, dict) {
             if (!core.isCode(code))
                 throw new Error(`LambderI18n: unsupported language code "${code}".`);
+            if (code !== core.defaultLanguage) {
+                assertPlaceholdersKept((key) => layerLookup(layer, core.defaultLanguage, key), code, dict, `registerDictionary("${code}")`);
+            }
             layer.dicts[code] = { ...layer.dicts[code], ...dict };
             core.state.emitChange();
         },
@@ -350,5 +395,5 @@ export const createLambderI18n = (config) => {
         isCode,
         lazyLayers: new Set(),
     };
-    return buildInstance(core, createLayer(core, config.base, null));
+    return buildInstance(core, createLayer(core, config.base, null, "base dictionary"));
 };

package/dist/shared/contracts/LambderRateLimiter.d.ts

@@ -9,8 +9,8 @@
  * dependency-free, so the mock runtime and the browser entry can resolve it.
  */
 /**
- * The fixed windows a policy may cap, smallest first (the evaluation order),
- * with their length. The policy type derives from this table, so the two can
+ * The fixed windows a policy may cap, smallest first (the order a refusal
+ * names the smallest window by), with their length. The policy type derives from this table, so the two can
  * never drift.
  */
 export declare const RATE_LIMIT_WINDOWS: readonly [{

package/dist/shared/contracts/LambderRateLimiter.js

@@ -9,8 +9,8 @@
  * dependency-free, so the mock runtime and the browser entry can resolve it.
  */
 /**
- * The fixed windows a policy may cap, smallest first (the evaluation order),
- * with their length. The policy type derives from this table, so the two can
+ * The fixed windows a policy may cap, smallest first (the order a refusal
+ * names the smallest window by), with their length. The policy type derives from this table, so the two can
  * never drift.
  */
 export const RATE_LIMIT_WINDOWS = [

package/dist/shared/util/LambderInvocationScope.d.ts

@@ -0,0 +1,10 @@
+import { AsyncLocalStorage } from "async_hooks";
+/** What any layer may ask of the invocation it runs under. */
+export type LambderInvocation = {
+    /** The invocation's own request id (the Lambda context's awsRequestId); null when the context has none. */
+    readonly requestId: string | null;
+};
+/** The async context the server's handler opens once per invocation. */
+export declare const invocationScope: AsyncLocalStorage<LambderInvocation>;
+/** The request id of the invocation the calling code runs under, or null outside one (a script, a test calling a library directly). */
+export declare const currentRequestId: () => string | null;

package/dist/shared/util/LambderInvocationScope.js

@@ -0,0 +1,5 @@
+import { AsyncLocalStorage } from "async_hooks";
+/** The async context the server's handler opens once per invocation. */
+export const invocationScope = new AsyncLocalStorage();
+/** The request id of the invocation the calling code runs under, or null outside one (a script, a test calling a library directly). */
+export const currentRequestId = () => invocationScope.getStore()?.requestId ?? null;

package/dist/shared/util/LambderNamedMaps.d.ts

@@ -0,0 +1,22 @@
+/**
+ * One map of named declarations, or a list of them. An app made of parts,
+ * each declaring its own guards, rate-limit policies or refusal codes beside
+ * its APIs, hands the list over, and every name in it is declared. A name two
+ * maps declare is refused rather than one quietly replacing the other.
+ */
+export type LambderNamedMapsOption<TMap> = TMap | readonly TMap[];
+/** The one map a named-maps option declares: a list's members intersected, a lone map as it is. */
+export type LambderMergedNamedMaps<T> = T extends readonly [] ? {} : T extends readonly [infer TFirst, ...infer TRest] ? TFirst & LambderMergedNamedMaps<TRest> : T extends readonly (infer TMember)[] ? TMember : T;
+/** The names a list declares in more than one of its maps: never for a lone map, or for a list whose members are not known one by one. */
+type LambderRepeatedNames<T, TSeen extends PropertyKey = never> = T extends readonly [infer TFirst, ...infer TRest] ? (keyof TFirst & TSeen) | LambderRepeatedNames<TRest, TSeen | keyof TFirst> : never;
+/** Intersected onto a list: a name declared in two of its maps is a compile error, and the property name is the message. */
+export type LambderNoRepeatedNames<T> = [LambderRepeatedNames<T>] extends [never] ? unknown : {
+    readonly "lambder: a name is declared in more than one of these maps. Declare each name once.": LambderRepeatedNames<T>;
+};
+/**
+ * A named-maps option as one map: a lone map as it is, a list merged in
+ * order. A name declared in two maps of the list is refused; `what` names a
+ * declaration and `where` the call that took the list, for that error.
+ */
+export declare const mergeNamedMaps: <TMap extends Record<string, unknown>>(option: LambderNamedMapsOption<TMap>, what: "guard" | "rate-limit policy" | "refusal code", where?: string) => TMap;
+export {};

package/dist/shared/util/LambderNamedMaps.js

@@ -0,0 +1,19 @@
+/**
+ * A named-maps option as one map: a lone map as it is, a list merged in
+ * order. A name declared in two maps of the list is refused; `what` names a
+ * declaration and `where` the call that took the list, for that error.
+ */
+export const mergeNamedMaps = (option, what, where = "create()") => {
+    if (!Array.isArray(option))
+        return option;
+    const merged = {};
+    for (const map of option) {
+        for (const [name, declaration] of Object.entries(map)) {
+            if (Object.prototype.hasOwnProperty.call(merged, name)) {
+                throw new Error(`Lambder: the ${what} "${name}" is declared in two of the maps given to ${where}. Declare each name once.`);
+            }
+            merged[name] = declaration;
+        }
+    }
+    return merged;
+};

package/dist/shared/wire/LambderApiOptionEntries.d.ts

@@ -153,3 +153,27 @@ export type LambderGuardParamOf<TEntry, N extends string> = TEntry extends {
  * reads instead of the source.
  */
 export declare const apiGuardParam: <TOptions extends Record<string, LambderApiOptionEntry>, K extends keyof TOptions & string, N extends string>(options: TOptions, name: K, guard: N) => LambderGuardParamOf<TOptions[K], N>;
+/**
+ * The identifier writeApiGuardParams exports an API's parameter under: its
+ * group, its action capitalized, then `GuardParam` (`orders.list` exports
+ * `ordersListGuardParam`). What code that reads a generated module by API
+ * name (a test comparing it with the server) looks each export up by.
+ */
+export declare const apiGuardParamExportName: (apiName: string) => string;
+/** The key a generated guard parameter's tag sits under: declared and never created, so it exists in types alone. */
+declare const API_GUARD_PARAM_TAG: unique symbol;
+/**
+ * One API's parameter for one guard, as writeApiGuardParams exports it: the
+ * value TParam as declared (`true` for a guard named without one), tagged
+ * with the API's name and the guard's. The tag exists in types alone, so the
+ * names reach no bundle. A function typed to a guard's tagged parameters
+ * takes only generated ones: a hand-written literal, which would restate the
+ * server's declaration and could drift from it, does not compile.
+ */
+export type LambderApiGuardParam<TApi extends string, TGuard extends string, TParam> = TParam & {
+    readonly [API_GUARD_PARAM_TAG]: {
+        readonly api: TApi;
+        readonly guard: TGuard;
+    };
+};
+export {};

package/dist/shared/wire/LambderApiOptionEntries.js

@@ -15,6 +15,7 @@
  * (when a guard runs, what a budget spans, when a custom key is charged) are
  * declared here too and re-exported by the engines that read them.
  */
+import { splitApiName } from "./LambderApiNames.js";
 /**
  * The parameter an API's guards option gives guard N, read off a generated
  * `apiOptions` table with the type the table pins: the literal a permission
@@ -33,3 +34,15 @@ export const apiGuardParam = (options, name, guard) => {
         param = guards[guard];
     return param;
 };
+/**
+ * The identifier writeApiGuardParams exports an API's parameter under: its
+ * group, its action capitalized, then `GuardParam` (`orders.list` exports
+ * `ordersListGuardParam`). What code that reads a generated module by API
+ * name (a test comparing it with the server) looks each export up by.
+ */
+export const apiGuardParamExportName = (apiName) => {
+    const parts = splitApiName(apiName);
+    if (!parts)
+        throw new Error(`Lambder: "${apiName}" is not an endpoint name, so its guard parameter has no export name.`);
+    return `${parts.group}${parts.action[0].toUpperCase()}${parts.action.slice(1)}GuardParam`;
+};

package/dist/shared/wire/LambderCallOutcome.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What an API call ended in, as the server names it in the call's summary
+ * line: the reasons a caller reads the same answer by (resolveApiOutcome),
+ * with the server's side of a 5xx, a crash, and `other` for an answer that
+ * was not written as an API answer (a hook answering an API call with a page
+ * of its own).
+ */
+export type LambderCallOutcome = "success" | "refusal" | "notAuthorized" | "sessionExpired" | "versionExpired" | "validation" | "crash" | "other";
+/** An answer's outcome and refusal code, as the code that wrote the answer knows them. */
+export type LambderCallOutcomeHint = {
+    outcome: LambderCallOutcome;
+    /** The refusal's code, a framework code (`lambder/rate-limited`) or an app's; null when the answer carries none. */
+    code: string | null;
+};
+/**
+ * An envelope's outcome, read in the order a caller honours it: a 5xx is a
+ * crash whatever the envelope says, then the three flags, then a refusal,
+ * and anything else is the handler's answer.
+ */
+export declare const outcomeOfEnvelope: (written: object, statusCode: number) => LambderCallOutcomeHint;
+/**
+ * The outcome of an answer written as text, for an answer that arrived with
+ * no hint (a replayed one, which its store keeps as text): a 422 is a
+ * validation refusal, an envelope is read as outcomeOfEnvelope reads it, and
+ * anything else is known by its status alone.
+ */
+export declare const outcomeOfAnswerText: (statusCode: number, body: string) => LambderCallOutcomeHint;

package/dist/shared/wire/LambderCallOutcome.js

@@ -0,0 +1,47 @@
+const codeOf = (refusal) => {
+    if (refusal === null || typeof refusal !== "object")
+        return null;
+    const code = refusal.code;
+    return typeof code === "string" ? code : null;
+};
+/**
+ * An envelope's outcome, read in the order a caller honours it: a 5xx is a
+ * crash whatever the envelope says, then the three flags, then a refusal,
+ * and anything else is the handler's answer.
+ */
+export const outcomeOfEnvelope = (written, statusCode) => {
+    const envelope = written;
+    if (statusCode >= 500)
+        return { outcome: "crash", code: null };
+    if (envelope.versionExpired)
+        return { outcome: "versionExpired", code: null };
+    if (envelope.sessionExpired)
+        return { outcome: "sessionExpired", code: null };
+    if (envelope.notAuthorized)
+        return { outcome: "notAuthorized", code: codeOf(envelope.refusal) };
+    if (envelope.refusal !== undefined)
+        return { outcome: "refusal", code: codeOf(envelope.refusal) };
+    return { outcome: "success", code: null };
+};
+/**
+ * The outcome of an answer written as text, for an answer that arrived with
+ * no hint (a replayed one, which its store keeps as text): a 422 is a
+ * validation refusal, an envelope is read as outcomeOfEnvelope reads it, and
+ * anything else is known by its status alone.
+ */
+export const outcomeOfAnswerText = (statusCode, body) => {
+    if (statusCode >= 500)
+        return { outcome: "crash", code: null };
+    if (statusCode === 422)
+        return { outcome: "validation", code: null };
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return { outcome: "other", code: null };
+    }
+    if (parsed === null || typeof parsed !== "object" || !("payload" in parsed))
+        return { outcome: "other", code: null };
+    return outcomeOfEnvelope(parsed, statusCode);
+};

package/dist/shared/wire/LambderInvokeApiId.d.ts

@@ -25,3 +25,13 @@ export declare const LAMBDER_INVOKE_API_ID = "lambder-invoke";
  * it.
  */
 export declare const LAMBDER_LOCAL_API_ID = "lambder-local";
+/**
+ * The request id of the invocation that made an invoke, when it runs under a
+ * Lambder handler: the invoke event builder writes it, and the callee's call
+ * summary records it as its parentRequestId, so a query over both functions'
+ * logs joins a call to the calls it made. The server reads it only from an
+ * invoke (LAMBDER_INVOKE_API_ID), whose event no gateway lets a client write.
+ * Declared here, beside the ids, because the builder writes it and the
+ * server reads it.
+ */
+export declare const LAMBDER_PARENT_REQUEST_HEADER = "x-lambder-parent-request-id";

package/dist/shared/wire/LambderInvokeApiId.js

@@ -25,3 +25,13 @@ export const LAMBDER_INVOKE_API_ID = "lambder-invoke";
  * it.
  */
 export const LAMBDER_LOCAL_API_ID = "lambder-local";
+/**
+ * The request id of the invocation that made an invoke, when it runs under a
+ * Lambder handler: the invoke event builder writes it, and the callee's call
+ * summary records it as its parentRequestId, so a query over both functions'
+ * logs joins a call to the calls it made. The server reads it only from an
+ * invoke (LAMBDER_INVOKE_API_ID), whose event no gateway lets a client write.
+ * Declared here, beside the ids, because the builder writes it and the
+ * server reads it.
+ */
+export const LAMBDER_PARENT_REQUEST_HEADER = "x-lambder-parent-request-id";

package/dist/stores/LambderDdbRateLimiter.d.ts

@@ -20,12 +20,21 @@ export interface LambderDdbRateLimiterOptions {
  * Fixed-window rate limiter backed by DynamoDB.
  *
  * Each window is one item counted with a conditional `ADD`, so the increment
- * and the limit check are one atomic request. Windows are evaluated smallest
- * first and evaluation stops at the first exceeded one, which keeps blocked
- * requests cheap and spares the larger counters. Attempts count, not
- * successes: a counter checked before the refusing one keeps its increment,
- * since a compensating decrement would give up the conditional-ADD
- * atomicity. Items carry an `expiresAt` attribute for DynamoDB TTL.
+ * and the limit check are one atomic request, and every window's request is
+ * sent at once: a policy capping three windows costs one round trip on the
+ * request's critical path, not three. Attempts count, not successes: a window
+ * under its limit counts an attempt another window refuses, since a
+ * compensating decrement would give up the conditional-ADD atomicity. The
+ * refusal names the smallest window that refused. Items carry an `expiresAt`
+ * attribute for DynamoDB TTL.
+ *
+ * A window the table refused an attempt in stays at its limit until it
+ * resets, since a count only rises within its window. So the process
+ * remembers it until then, and refuses the key's next attempts from memory
+ * without touching the table: a flood costs each process one round of
+ * writes per window it fills, and the counters of its other windows stop
+ * rising once it is refused. Another process asks the table once and then
+ * remembers too.
  *
  * The tracker key is caller data (an address, a session key, whatever a
  * policy handler returned), so a key whose partition key would pass
@@ -47,9 +56,9 @@ export interface LambderDdbRateLimiterOptions {
  * means the partition holding this counter is flooded. A partition holds a
  * range of keys, though, not one: a flood on one address, or a session or
  * cache spike on a shared table, throttles every counter on the same
- * partition. The key's own counts tell the flood from its neighbours: the
- * throttled window's and every capped window's after it, the ones this
- * attempt has not been counted against yet, each read with a consistent
+ * partition. The key's own counts tell the flood from its neighbours: those
+ * of the windows whose write was throttled, the ones this attempt has not
+ * been counted against, each read with a consistent
  * GetItem, in parallel (reads have their own throughput, which the throttled
  * writes leave alone). A key at or over the limit of any of them is the
  * flood: it is refused, since passed on as a failure `failOpen` would wave
@@ -87,8 +96,8 @@ export declare class LambderDdbRateLimiter implements LambderRateLimiter {
     private readonly ready;
     private readonly ttlWindowMultiplier;
     private readonly now;
-    /** The windows seen during key-range throttles, by (partition key, window, window start); see the class doc. */
-    private readonly throttledWindows;
+    /** The windows found at their limit, and those whose read a throttle refused, by (partition key, window, window start); see the class doc. */
+    private readonly rememberedWindows;
     constructor(options: LambderDdbRateLimiterOptions);
     /** The clock the windows are computed against, for the engine's Retry-After. */
     clockMilliseconds(): number;
@@ -107,11 +116,10 @@ export declare class LambderDdbRateLimiter implements LambderRateLimiter {
      */
     private incrementWindow;
     /**
-     * The answer to a key-range throttle on the first of `uncounted`: that
-     * window and every capped one after it, the windows this attempt has not
-     * been counted against. The windows before it counted this attempt and
-     * allowed it, so reading them could only turn the attempt that filled
-     * one into a refusal.
+     * The answer to a key-range throttle on `uncounted`, the windows whose
+     * write the throttle refused and which have not counted this attempt.
+     * The others counted it and allowed it, so reading them could only turn
+     * the attempt that filled one into a refusal.
      *
      * Each count is read strongly consistent: the count that decides is the
      * one the throttled writes were racing to raise, and a replica lagging

package/dist/stores/LambderDdbRateLimiter.js

@@ -6,12 +6,14 @@ import { RATE_LIMIT_WINDOWS, } from "../shared/contracts/LambderRateLimiter.js";
 /** How long a key refused during a throttle is told to wait: long enough to let the partition recover, short enough for a legitimate caller. */
 const THROTTLED_RETRY_SECONDS = 5;
 /**
- * Most (tracker key, window) pairs the limiter remembers from throttles at
- * once. Only a key seen during a key-range throttle is remembered, for
- * THROTTLED_RETRY_SECONDS, so this is reached only by a flood spread over
- * that many keys at once, where the ones closest to expiring go first.
+ * Most (tracker key, window) pairs the limiter remembers at once. Only a
+ * window found at its limit is remembered (until it resets, or for
+ * THROTTLED_RETRY_SECONDS when a throttle's read found it there), so this is
+ * reached only by refusals spread over that many keys at once, where the
+ * ones closest to expiring go first; a key forgotten early is asked of the
+ * table again, which answers the same.
  */
-const THROTTLED_WINDOW_MEMORY_ENTRIES = 10_000;
+const REMEMBERED_WINDOW_ENTRIES = 10_000;
 /** The table key of one window's counter. */
 const counterKeyOf = (partitionKey, window) => ({
     pk: { S: partitionKey },
@@ -23,12 +25,21 @@ const rememberedWindowKeyOf = (partitionKey, window) => joinKeyFields(partitionK
  * Fixed-window rate limiter backed by DynamoDB.
  *
  * Each window is one item counted with a conditional `ADD`, so the increment
- * and the limit check are one atomic request. Windows are evaluated smallest
- * first and evaluation stops at the first exceeded one, which keeps blocked
- * requests cheap and spares the larger counters. Attempts count, not
- * successes: a counter checked before the refusing one keeps its increment,
- * since a compensating decrement would give up the conditional-ADD
- * atomicity. Items carry an `expiresAt` attribute for DynamoDB TTL.
+ * and the limit check are one atomic request, and every window's request is
+ * sent at once: a policy capping three windows costs one round trip on the
+ * request's critical path, not three. Attempts count, not successes: a window
+ * under its limit counts an attempt another window refuses, since a
+ * compensating decrement would give up the conditional-ADD atomicity. The
+ * refusal names the smallest window that refused. Items carry an `expiresAt`
+ * attribute for DynamoDB TTL.
+ *
+ * A window the table refused an attempt in stays at its limit until it
+ * resets, since a count only rises within its window. So the process
+ * remembers it until then, and refuses the key's next attempts from memory
+ * without touching the table: a flood costs each process one round of
+ * writes per window it fills, and the counters of its other windows stop
+ * rising once it is refused. Another process asks the table once and then
+ * remembers too.
  *
  * The tracker key is caller data (an address, a session key, whatever a
  * policy handler returned), so a key whose partition key would pass
@@ -50,9 +61,9 @@ const rememberedWindowKeyOf = (partitionKey, window) => joinKeyFields(partitionK
  * means the partition holding this counter is flooded. A partition holds a
  * range of keys, though, not one: a flood on one address, or a session or
  * cache spike on a shared table, throttles every counter on the same
- * partition. The key's own counts tell the flood from its neighbours: the
- * throttled window's and every capped window's after it, the ones this
- * attempt has not been counted against yet, each read with a consistent
+ * partition. The key's own counts tell the flood from its neighbours: those
+ * of the windows whose write was throttled, the ones this attempt has not
+ * been counted against, each read with a consistent
  * GetItem, in parallel (reads have their own throughput, which the throttled
  * writes leave alone). A key at or over the limit of any of them is the
  * flood: it is refused, since passed on as a failure `failOpen` would wave
@@ -90,8 +101,8 @@ export class LambderDdbRateLimiter {
     ready;
     ttlWindowMultiplier;
     now;
-    /** The windows seen during key-range throttles, by (partition key, window, window start); see the class doc. */
-    throttledWindows;
+    /** The windows found at their limit, and those whose read a throttle refused, by (partition key, window, window start); see the class doc. */
+    rememberedWindows;
     constructor(options) {
         if (!options.tableName.trim())
             throw new Error("tableName is required");
@@ -99,7 +110,7 @@ export class LambderDdbRateLimiter {
         this.keyPrefix = options.keyPrefix ?? "RL";
         this.ttlWindowMultiplier = assertNumberAtLeast(options.ttlWindowMultiplier ?? 2, 1, "ttlWindowMultiplier");
         this.now = options.now ?? (() => Date.now());
-        this.throttledWindows = new LambderExpiringMap({ now: this.now, maxEntries: THROTTLED_WINDOW_MEMORY_ENTRIES });
+        this.rememberedWindows = new LambderExpiringMap({ now: this.now, maxEntries: REMEMBERED_WINDOW_ENTRIES });
         this.ready = createDynamoClientLoader({ user: "LambderDdbRateLimiter", region: options.region, client: options.client });
     }
     /** The clock the windows are computed against, for the engine's Retry-After. */
@@ -121,28 +132,37 @@ export class LambderDdbRateLimiter {
         const windows = RATE_LIMIT_WINDOWS
             .filter(({ key }) => policy[key])
             .map(({ key, seconds }) => ({ key, seconds, limit: policy[key], start: Math.floor(nowSeconds / seconds) * seconds }));
-        // A window this process read at its limit during a throttle refuses
-        // without touching the table (see the class doc).
-        const rememberedAtLimit = windows.find((window) => {
-            const remembered = this.throttledWindows.get(rememberedWindowKeyOf(partitionKey, window));
-            return remembered !== undefined && "count" in remembered && remembered.count >= window.limit;
-        });
-        if (rememberedAtLimit)
-            return { window: rememberedAtLimit.key, limit: rememberedAtLimit.limit, resetAt: nowSeconds + THROTTLED_RETRY_SECONDS };
-        for (const [index, window] of windows.entries()) {
-            try {
-                if (await this.incrementWindow(partitionKey, window, nowSeconds))
-                    return { window: window.key, limit: window.limit, resetAt: window.start + window.seconds };
-            }
-            catch (error) {
-                // A key-range throttle may be the limiter's own answer (see
-                // the class doc); anything else is the table failing, which
-                // only the caller can decide what to do about.
-                if (!isKeyRangeThrottle(error))
-                    throw error;
-                return await this.answerKeyRangeThrottle(partitionKey, windows.slice(index), nowSeconds, error);
+        // A window this process has found at its limit refuses without
+        // touching the table (see the class doc).
+        for (const window of windows) {
+            const remembered = this.rememberedWindows.get(rememberedWindowKeyOf(partitionKey, window));
+            if (remembered !== undefined && "count" in remembered && remembered.count >= window.limit) {
+                return { window: window.key, limit: window.limit, resetAt: remembered.resetAt ?? nowSeconds + THROTTLED_RETRY_SECONDS };
             }
         }
+        const attempts = await Promise.allSettled(windows.map((window) => this.incrementWindow(partitionKey, window, nowSeconds)));
+        // A refusal is the answer whatever the other windows did: a window at
+        // its limit refuses the attempt whether the others counted it, failed
+        // or were throttled.
+        const refusedAt = attempts.findIndex((attempt) => attempt.status === "fulfilled" && attempt.value);
+        if (refusedAt !== -1) {
+            const refusing = windows[refusedAt];
+            const resetAt = refusing.start + refusing.seconds;
+            this.rememberedWindows.set(rememberedWindowKeyOf(partitionKey, refusing), { count: refusing.limit, resetAt }, resetAt);
+            return { window: refusing.key, limit: refusing.limit, resetAt };
+        }
+        // A failure that is not the key's range being throttled is the table
+        // failing, which only the caller can decide what to do about.
+        const failure = attempts.find((attempt) => attempt.status === "rejected" && !isKeyRangeThrottle(attempt.reason));
+        if (failure)
+            throw failure.reason;
+        // A key-range throttle may be the limiter's own answer (see the class
+        // doc), read from the windows the throttle kept the attempt from.
+        const throttled = windows.filter((_, index) => attempts[index].status === "rejected");
+        if (throttled.length) {
+            const throttle = attempts.find((attempt) => attempt.status === "rejected").reason;
+            return await this.answerKeyRangeThrottle(partitionKey, throttled, nowSeconds, throttle);
+        }
         return false;
     }
     /** The item's partition key, refused when the tracker key makes it one DynamoDB will not take. */
@@ -185,11 +205,10 @@ export class LambderDdbRateLimiter {
         }
     }
     /**
-     * The answer to a key-range throttle on the first of `uncounted`: that
-     * window and every capped one after it, the windows this attempt has not
-     * been counted against. The windows before it counted this attempt and
-     * allowed it, so reading them could only turn the attempt that filled
-     * one into a refusal.
+     * The answer to a key-range throttle on `uncounted`, the windows whose
+     * write the throttle refused and which have not counted this attempt.
+     * The others counted it and allowed it, so reading them could only turn
+     * the attempt that filled one into a refusal.
      *
      * Each count is read strongly consistent: the count that decides is the
      * one the throttled writes were racing to raise, and a replica lagging
@@ -201,7 +220,7 @@ export class LambderDdbRateLimiter {
      */
     async answerKeyRangeThrottle(partitionKey, uncounted, nowSeconds, throttle) {
         const throttledWindowKey = rememberedWindowKeyOf(partitionKey, uncounted[0]);
-        const remembered = this.throttledWindows.get(throttledWindowKey);
+        const remembered = this.rememberedWindows.get(throttledWindowKey);
         if (remembered !== undefined && "unreadable" in remembered)
             throw remembered.unreadable;
         const { client, sdk } = await this.ready();
@@ -214,14 +233,14 @@ export class LambderDdbRateLimiter {
         for (const [index, read] of reads.entries()) {
             const window = uncounted[index];
             if (read.status === "fulfilled" && read.value >= window.limit) {
-                this.throttledWindows.set(rememberedWindowKeyOf(partitionKey, window), { count: read.value }, rememberUntil);
+                this.rememberedWindows.set(rememberedWindowKeyOf(partitionKey, window), { count: read.value }, rememberUntil);
                 refusing ??= window;
             }
         }
         if (refusing)
             return { window: refusing.key, limit: refusing.limit, resetAt: rememberUntil };
         if (reads.some((read) => read.status === "rejected" && isKeyRangeThrottle(read.reason))) {
-            this.throttledWindows.set(throttledWindowKey, { unreadable: throttle }, rememberUntil);
+            this.rememberedWindows.set(throttledWindowKey, { unreadable: throttle }, rememberUntil);
         }
         throw throttle;
     }

package/dist/stores/LambderMemoryRateLimiter.d.ts

@@ -1,10 +1,15 @@
 import { type LambderRateLimiter, type LambderRateLimitPolicy, type LambderRateLimitResult, type LambderRateLimitWindow } from "../shared/contracts/LambderRateLimiter.js";
 /**
  * Fixed-window rate limiter held in memory: the same windows, the same
- * attempts-count semantics and the same evaluation order as
- * LambderDdbRateLimiter, with a Map in place of the table. For tests and
- * for the mock runtime; a single-process server could use it too, with the
- * caveat that its counters are per process and vanish with it.
+ * attempts-count semantics and the same refusals as LambderDdbRateLimiter,
+ * with a Map in place of the table. For tests and for the mock runtime; a
+ * single-process server could use it too, with the caveat that its counters
+ * are per process and vanish with it.
+ *
+ * Every counter is in hand, so an attempt a window refuses is counted in no
+ * window: what the DynamoDB limiter reaches once it remembers the refusing
+ * window, which the first refused attempt in each of its processes still
+ * counts in the others.
  *
  * `now` is injectable so a test can move time forward and watch a window
  * reset without waiting for it.