fix(ratelimit-next): double-count in withRateLimit and broken default rule in middleware

[sathergate]

Summary

• withRateLimit double-count: withRateLimit was calling floodgate.check() twice per successful request — once inside rateLimit() and again to compute response headers. Since check runs the algorithm and mutates store counters, every allowed request consumed 2 tokens, effectively halving configured limits.
• Middleware default rule always "default": createRateLimitMiddleware computed the fallback rule name with Object.keys({} as Record<string, unknown>)[0], which always returns undefined (empty object), always falling back to the literal string "default". If no rule named "default" was configured, floodgate would throw on every request.

Changes

• floodgate.ts: Added readonly rules: FloodgateConfig["rules"] to the Floodgate interface and returns it from createFloodgate, so callers can inspect configured rules without casting.
• next.ts: Inlined check + header logic inside withRateLimit (one call, one result, used for both the 429 and success header paths). Fixed middleware rule selection to use Object.keys(floodgate.rules)[0] and use the pre-computed ruleName variable consistently inside the handler.

Test plan

• npx turbo run typecheck --filter=ratelimit-next passes
• npm test — all 302 tests pass, 0 failures

🤖 Generated with Claude Code