Design & architecture
How it actually works — all 15 components.
Most limiters ask you to trust them. This is the other thing: the deep, component-by-component reference behind ThrottleKit — the real data structures, the math, and for every load-bearing choice, why it was built that way. The machine-checked bounds are an engineering verification technique, not a formality.
Foundations
The orthogonal core every other piece composes from.
01 Core model Decision / Strategy / Store / Clock / Limiter, determinism, the dual-path contract. → 02 Algorithms GCRA, token bucket, fixed & sliding window, leaky bucket, quota, multi-dimensional. → 03 Storage layer Memory, Redis (Lua/OCC), Postgres, DynamoDB, Deno KV, Cloudflare — one apply primitive. →
The engines
The four admission axes — and the two no other limiter has.
04 Two-tier & leasing — GALE L1/L2, the overshoot bound, window-coupling, EOQ lease sizing, weighted-fair escrow. → 05 Cost axis — TALE Streaming token meter, learned & predictive reservation, distributed token budget. → 06 Concurrency Adaptive concurrency, the distributed coordinator, occupancy cap, handoff, self-fencing. → 07 Unified admission The decision algebra, sequential vs Lua-fused, the joint-LP bid-price policy. →
Distribution & surfaces
One global limit, reached from any language.
08 Federation One global limit across regions, the coordinator abstraction, federated fair escrow. → 13 Wire protocol The single-sourced Lua, the manifest & drift-lock, golden vectors, the proto contract. → 14 gRPC server The service core, the Doors, crash-reclaim, mTLS. → 15 Python client One oracle, two doors; the contract drift-gate (throttlekit-py). →
Integration & operations
Framework glue, telemetry, and the honest edges.
09 Adapters & lifecycle The shared contract, createEnforcer, the exactly-once release() lifecycle. → 10 Observability The frozen OTel metric/attribute contract, the analytics tap. → 11 Overload & security Fixed-memory DDoS sketches, proxy-correct IP keying, PII-safe HMAC keys. → 12 Config & CLI .throttlekit.yaml rate-limit-as-code, the throttlekit CLI. →