Module rate_limit 

Fixed-window rate limiting for the Derive adapter.

Derive refills every request allowance in discrete five-second windows, not one token at a time. A Trader can spend a full burst of tps * 5 matching requests inside one window. The next request must then wait for the window boundary; nothing refills before it.

The buckets and their allowances:

• Matching writes draw on two independent allowances: account-wide matching and per-instrument matching.
• private/cancel_all and unscoped private/cancel_by_label have custom quotas.
• REST non-matching requests use a flat per-IP allowance; authenticated WebSocket non-matching requests use a separate one.

See https://docs.derive.xyz/reference/rate-limits.

FixedWindowLimiter keeps one packed atomic word per bucket key holding the window index and the count consumed from it, so a check-and-consume is a single compare-and-swap. Windows align to limiter creation because the venue’s own window phase cannot be observed from the client. A wait is therefore at most one full window, and the long-run average rate stays at the venue allowance. A burst can still straddle a venue window boundary; the venue then rejects the request outright. That rejection is definitive (surfaced as an OrderRejected), not ambiguous.

The limiter is generic over the nautilus_network clocks: tests drive it deterministically with FakeRelativeClock, production uses [MonotonicClock].

Constants

DERIVE_CANCEL_ALL_RATE_KEY

Rate-limit bucket key for private/cancel_all requests.

DERIVE_CANCEL_ALL_TPS

Custom allowance for private/cancel_all (requests per second).

DERIVE_CANCEL_BY_LABEL_RATE_KEY

Rate-limit bucket key for unscoped private/cancel_by_label requests.

DERIVE_CANCEL_BY_LABEL_TPS

Custom allowance for unscoped private/cancel_by_label (requests per second).

DERIVE_DEFAULT_MATCHING_TPS

Default matching-engine allowance for a Trader-tier account, in requests per second. Market Maker accounts negotiate higher limits via crate::config::DeriveExecutionClientConfig’s max_matching_requests_per_second field.

DERIVE_DEFAULT_PER_INSTRUMENT_MATCHING_TPS

Default per-instrument matching allowance for a Trader-tier account, in requests per second. Market Maker accounts negotiate higher limits via crate::config::DeriveExecutionClientConfig’s max_per_instrument_matching_requests_per_second field. The account-wide override never inflates this bucket.

DERIVE_MATCHING_RATE_KEY

Rate-limit bucket key for matching-engine requests (order create/cancel/replace).

DERIVE_NON_MATCHING_RATE_KEY

Rate-limit bucket key for non-matching requests (reads, subscriptions, login).

DERIVE_NON_MATCHING_TPS

Flat REST non-matching allowance per IP (requests per second).

DERIVE_RATE_BURST_MULTIPLIER

Burst multiplier: each window admits five seconds’ worth of requests.

DERIVE_RATE_WINDOW_SECS

Fixed-window length: Derive refills every allowance discretely at window boundaries spaced five seconds apart.

DERIVE_WEBSOCKET_NON_MATCHING_TPS

Default authenticated WebSocket non-matching allowance for a Trader account.