feat(platform): harden access scoping and delivery baseline

packages/api/src/middleware/rate-limit.ts

@@ -15,12 +15,17 @@ interface RateLimitResult {
   resetAt: Date;
 }
 
+export interface RateLimiter {
+  (key: string): RateLimitResult;
+  reset(): void;
+}
+
 /**
  * Creates a sliding-window rate limiter.
  * @param windowMs  - Time window in milliseconds
  * @param maxRequests - Maximum requests allowed within the window
  */
-export function createRateLimiter(windowMs: number, maxRequests: number) {
+export function createRateLimiter(windowMs: number, maxRequests: number): RateLimiter {
   const store = new Map<string, RateLimitEntry>();
 
   // Periodically clean up expired entries to prevent memory leaks
@@ -38,7 +43,7 @@ export function createRateLimiter(windowMs: number, maxRequests: number) {
     cleanupInterval.unref();
   }
 
-  return function check(key: string): RateLimitResult {
+  const check = function check(key: string): RateLimitResult {
     const now = Date.now();
     const existing = store.get(key);
 
@@ -61,7 +66,13 @@ export function createRateLimiter(windowMs: number, maxRequests: number) {
       remaining: Math.max(0, maxRequests - existing.count),
       resetAt: new Date(existing.resetAt),
     };
+  } as RateLimiter;
+
+  check.reset = () => {
+    store.clear();
   };
+
+  return check;
 }
 
 /** General API rate limiter: 100 requests per 15 minutes per key */