throttlekit
· ReleaseHistory

Every release, from the start

The complete release history of ThrottleKit: every version of the core library, the gRPC server + Lens, and the Python client, and what each one shipped, from the first release to today.

By Ameya Borkar

This is the full record: every version ThrottleKit has shipped across its three packages, and what each one added. The core library (throttlekit) went from a single-process rate limiter to a provably-bounded distributed fleet system with LLM cost governance in about two weeks of releases; the gRPC server and the Python client followed to reach that same verified core from any language. The skimmable version of this lives on the changelog and the status board. This is the narrated long form.

throttlekit: the core library

Foundations (0.1–0.3)

  • 0.1.0 (May 26). Initial release. Seven algorithms (GCRA, token bucket, fixed & sliding window, sliding-window log, leaky bucket, adaptive concurrency), the rateLimit engine over one Store.apply primitive, Memory + Redis stores, the two-tier engine (strict / cached-deny / leased), multi-dimensional limits, Express + fetch adapters, standards headers, proxy-correct IP keying, OpenTelemetry, and a store-conformance testkit. Every strategy shipped a pure JS transition and an atomic Redis Lua form, proven bit-identical by a dual-path suite.
  • 0.2.0 (May 26). A fixed-memory Count-Min DDoS sketch (sketchRateLimit), in-process analytics with top-K heavy hitters (withAnalytics), Google-SRE adaptive load-shedding + fair-share, Redis client adapters (node-redis / Upstash REST / ioredis), Hono / Next / Fastify / Koa adapters, the comparative benchmark, and the first TLA⁺ verification of the leased overshoot bound.
  • 0.3.0 (May 26). The PostgreSQL store (same transform, no Redis required), batch checks (checkMany), and a mergeable Count-Min sketch for exact cluster-wide heavy-hitter detection.

The two engines take shape (0.4–0.7)

  • 0.4.1 (May 26). Window-coupled leasing: the GALE refinement that collapses worst-case global overshoot to exactly Limit, independent of node count (machine-checked). (0.4.0 was tagged but a CI outage blocked its publish.)
  • 0.5.0 (May 26). Weighted-fair-escrow batch primitives (weightedMaxMin / weightedFairShare), GALE Pillar 4.
  • 0.5.1 (May 26). README/Wiki restructure around provability.
  • 0.6.0 (May 27). tokenBudget: the streaming LLM token-budget meter, TALE Layer 1, with overshoot bounded by debit granularity and independent of max_tokens.
  • 0.6.1 (May 27). The trilemma’s dynamic coordination bound, proven.
  • 0.7.0 (May 27). The learned layers: learnedReservation / predictiveReservation (TALE 2/3) and leaseSizer / predictiveLeaseSizer (GALE 2/3), each cross-checked byte-for-byte against its research kernel.

Full reach & federation (0.8.x)

  • 0.8.0 (May 28). Four more exact backends (Cloudflare Durable Objects / D1, DynamoDB, Deno KV), distributedTokenBudget, the transport-agnostic createEnforcer, seven framework adapters (NestJS, AWS Lambda, gRPC, tRPC, SvelteKit, Remix, Elysia), and a security/perf hardening pass.
  • 0.8.1 (May 28). Calendar quota() billing, non-consuming peek / forecast, the NestJS @RateLimit decorator, tapDecisions, a frozen OpenTelemetry contract, .throttlekit.yaml rate-limit-as-code, and the throttlekit CLI.
  • 0.8.2 (May 28). Property-based fuzzing of the Lua dual-path and a benchmark regression gate.
  • 0.8.3 (May 28). federate(): cross-cluster federation with a region-count-independent overshoot bound, backed by RedisCoordinator.
  • 0.8.4 (May 28). PostgresCoordinator for federation.
  • 0.8.5 (May 28). Multi-process regional escrow + the regional-only outage mode.

Unified admission & distributed concurrency (0.9–0.13)

  • 0.9.0 (May 29). unifiedAdmission: rate × concurrency × cost in one decision, with a four-law pure algebra (combineDecisions) and a sequential or Lua-fused backend, plus the binding-axis OTel attribute.
  • 0.9.1 (May 29). weightedFairEscrow graduates to a production primitive (L1 + multi-process L2).
  • 0.9.2 (May 29). Middleware integration: 22 exports across 11 frameworks that wire the exactly-once release() lifecycle.
  • 0.10.0 (May 29). distributedAdaptiveConcurrency: one cooperatively-inferred concurrency ceiling across a fleet (closing the N× over-admission of independent adaptive limiters).
  • 0.10.1 (May 29). Acknowledged handoff: a hard Σ inflight ≤ L_global bound, machine-checked in TLA⁺.
  • 0.11.0 (May 29). Eager handoff + self-fencing: the complete instantaneous hard concurrency bound, end to end.
  • 0.11.1 (May 29). The joint-LP admission policy: a bid-price filter for cost-bound gateways.
  • 0.11.2 (May 30). A Postgres concurrency coordinator, demand-proportional allocation, and the STABILITY charter.
  • 0.11.3 (May 30). Online dual refinement and a 3-axis joint-LP (a concurrency shadow price via Little’s law).
  • 0.12.0 (May 30). federatedWeightedFairEscrow: Pillar 4 lifted across regions into a global weighted-max-min guarantee.
  • 0.13.0 (May 31). Adaptive lease sizing wired directly into twoTier, concurrency recalibration, and a blocking, machine-independent bench gate.

1.0: the frozen core

  • 1.0.0 (May 31). The API is frozen under SemVer and mechanically enforced (type-surface tests + publint / attw on every push). Ships STABILITY.md and BENCH.md; adds bindingAxis on the unified result and a frozen error-code discriminant. From here the core only grows additively.
  • 1.0.1 (May 31). A header-builder crash fix.

The product era (1.1–1.7)

  • 1.1.0 (Jun 4). In-process telemetry (admissionTap / withAdmissionAnalytics): the binding-axis signal that powers ThrottleKit Lens.
  • 1.2.0 (Jun 5). A stable denies_by_axis{lane} OpenTelemetry metric for Grafana.
  • 1.3.0 (Jun 9). The What-If Replay testkit: record a limiter’s decisions, replay a candidate, read the flip ledger.
  • 1.4.0 (Jun 10). Policy Plans (a terraform plan for limits) and store-backed cross-region fair escrow.
  • 1.5.0 (Jun 10). Tier-2 fleet leasing (LeaseSpender) and a store-authoritative lease window.
  • 1.6.0 (Jun 23). A correctness + security audit sweep: coordinator over-eviction, two window-roll over-admits, and a multiRateLimit prefix fix, plus opt-in safety valves (ttlFloorMs, useServerTime, sketch seed).
  • 1.6.1 (Jun 30). A performance sweep: multiRateLimit.checkSync ~40% faster on composite dimensions (skips a structuredClone when a dimension’s state is an immutable primitive), weightedFairEscrow grant ~15% faster (an O(1) running aggregate gated on integer weights/costs), plus smaller Redis/Postgres round-trip cuts. Every decision stays byte-identical.
  • 1.7.0 (Jul 1). A hardening sweep from a new fuzz + mutation-testing layer (mutation score on the core decision math: 65.4% → 77.5%): every strategy now rejects a construction parameter that would emit a non-finite decision field, closes a YAML config-parser stack-overflow DoS (nesting capped at 64), a cost-overflow vector, an unbounded slidingWindow.buckets, and a poisoned-sketch-snapshot vector. Minor, not patch: a handful of previously-garbage-returning absurd option values now throw; no valid input’s behavior changed.

throttlekit-server: the service door & Lens

The server lets any language reach the same verified core over gRPC, and carries ThrottleKit Lens, the built-in terminal dashboard.

  • 0.1.0-experimental.4 (Jun 4). A pluggable store resolver: Postgres and DynamoDB store doors alongside memory and Redis.
  • 0.1.0-experimental.5 (Jun 4). A built-in (web) Lens dashboard served alongside gRPC.
  • 0.1.0-experimental.6 (Jun 5). Monitoring moved to a built-in, zero-dependency terminal dashboard (--tui): Lens as it ships today; the web Lens was removed.
  • 0.1.0-experimental.7 (Jun 5). Tabbed views (Latency / Fairness / Capacity / Guarantee) and the fairEscrow policy block.
  • 0.1.0 (Jun 9). Graduated from experimental: the gRPC wire is frozen and conformance-tested against the golden vectors, plus opt-in, AES-256-GCM-encrypted, redacted decision capture with a fail-closed audited CLI.
  • 0.2.0 (Jun 9). The deterministic What-If Replay tab.
  • 0.3.0 (Jun 10). Four fleet features over the existing RPCs (federated / federatedFairEscrow / fleetBudget / distributedConcurrency), the read-only Monitor door, Prometheus /metrics, gRPC health, and the Policy Plans CLI + --tui Plan tab.
  • 0.4.0 (Jun 10). The Tier-2 Fleet lease door (Fleet.Reserve) and a store-authoritative lease window.
  • 0.4.1 – 0.4.3 (Jun 13–23). The audit sweep: replay-classifier accuracy, 128-bit random lease ids (a slot-hijacking fix), Monitor-door resilience, honest mTLS labelling, and capture fixes.
  • 0.4.4 (Jun 30). A performance sweep: the RateLimiter.Check handler ~25% faster (builds the enforcer with emit:false so the discarded header set is never computed), plus capture and Cost Room efficiency fixes.

throttlekit-py: the Python client

The reference client: every axis, bit-for-bit against the Node oracle.

  • 0.1.0 (May 31). Initial release: the ServiceBackend (gRPC) and direct RedisBackend doors, the rate strategies, the frozen Decision / Forecast types, and the cross-language conformance suite.
  • 0.2.0 (May 31). debit() for the cost axis (windowed token budgets over the service door).
  • 0.2.1 (May 31). Packaging fix: ship the generated gRPC stubs inside the wheel.
  • 0.3.0 (May 31). admit() for the concurrency / unified axis.
  • 0.4.0 (Jun 4). Async backends (AsyncServiceBackend / AsyncRedisBackend), the @rate_limit decorator + decision_headers, and FastAPI / Starlette / Django / Flask adapters.
  • 0.5.0 (Jun 10). Tier-2 fleet leasing (FleetBackend / LeasedLimiter), a MonitorBackend snapshot client, and a full runnable examples set.
  • 0.5.1 (Jun 30). A performance sweep: slots=True on the per-call frozen dataclasses (roughly halving a transported decision’s footprint), a precomputed Redis ARGV template, and smaller inlining cleanups.

That’s everything, from the first commit to today. For the canonical per-release detail, each package links to its full CHANGELOG.md from the changelog page; for what’s current and how it’s verified, see the status board.