What’s new in Halt

Sliding-window precision is now a first-class policy option: Policy.slidingPrecision (TypeScript) / Policy.sliding_precision (Python), default 10. Higher = more accurate rolling window with more memory; lower = coarser approximation with less state

slidingPrecision is validated (must be a positive integer) and participates in the in-process algorithm cache key, so changing precision at runtime never reuses a stale sliding-window instance

Python and TypeScript SDKs kept in parity — identical default, validation, and behavior for the new precision control

TypeScript algorithms demo now correctly awaits limiter.check(...)

Dynamic limits: PolicyRegistry in both SDKs — register/update/remove named policies and use registry.resolver(selector) as the limiter policy. update() takes effect immediately, no restart

cachedPolicyResolver / cached_policy_resolver: wrap a (possibly async) loader that reads Redis/DB/config with a per-key TTL cache so limits propagate across the fleet

Python: acheck() now awaits async policy resolvers (e.g. one reading Redis); sync check() raises a clear error if handed an async resolver

New TypeScript adapters: halt-rate/hono (Node + edge runtimes) and halt-rate/fastify; existing GraphQL adapter now published as halt-rate/graphql

Edge-safe TypeScript core: limiter, algorithms, InMemoryStore, extractors, presets, OTel adapter use zero Node built-ins — runs on Cloudflare Workers, Deno, Bun, Vercel Edge. RedisStore stays Node-only; inject a RedisClientLike for edge distributed limits

Dual ESM + CJS TypeScript builds with per-condition types (covers all five adapters)

exports map pointed require at a non-existent *.cjs path and import at the CJS build — corrected to *.mjs (ESM) / *.js (CJS) so require() now resolves

TypeScript in-memory algorithm cache was keyed by policy name only, so a changed limit was ignored on the InMemoryStore path. Now keyed by name+algorithm+limit+window+burst (Redis was already correct)

Observability: pass a `telemetry` hook to the limiter, QuotaManager, and PenaltyManager — Halt reports every rate-limited check with rich metadata (policy, algorithm, endpoint, cost, plan)

StatsCollector: zero-dependency in-process aggregator (blocked/allowed totals, per-policy and per-endpoint breakdowns, top-N limited keys, per-plan cost). snapshot() / reset() — drop into a /halt/stats endpoint

OpenTelemetryMetrics: OTel adapter emitting halt.requests, halt.blocked, halt.cost, halt.quota.exceeded, halt.penalty.applied via an injected meter (no hard OTel dependency)

Compose hooks with CompositeTelemetry (e.g. StatsCollector + OpenTelemetryMetrics); request spans remain separate via the limiter's otelTracer / otel_tracer

Optional Policy.plan label propagated through telemetry — PLAN_FREE/STARTER/PRO/BUSINESS/ENTERPRISE presets now set it for per-plan metrics

First-class root exports: QuotaManager, PenaltyManager, StatsCollector, OpenTelemetryMetrics, TelemetryHooks, LoggingTelemetry, CompositeTelemetry, plus QUOTA_* and PENALTY_* presets (previously only deep-importable)

Optional OTel dep: npm install @opentelemetry/api or pip install "halt-rate[otel]"

REDIS_URL-gated distributed correctness suites in both SDKs — 100+ concurrent across all four algorithms, multi-process workers, token/leaky races, sliding-window boundary, and window reset

Production Redis support — atomic Lua-scripted limits (all four algorithms), cluster-safe single-key operations, and fail-open by default (configurable). TS: npm install ioredis; Python: pip install halt-rate[redis]

Python async path: AsyncRedisStore, limiter.acheck(), and create_async_limiter_dependency() for FastAPI — the FastAPI middleware now awaits acheck() so async stores work end-to-end

New public exports: RedisStore (both SDKs), AsyncRedisStore (Python), and the atomic-store types AtomicStore, EvaluateInput, RedisClientLike, isAtomicStore (TypeScript)

Python SaaS plan presets now match TypeScript: PLAN_FREE, PLAN_STARTER, PLAN_PRO, PLAN_BUSINESS, PLAN_ENTERPRISE, PLAN_TIERS, and get_plan_policy()

Python token-bucket RateLimit-Limit now reports the configured limit (e.g. 100, not the burst capacity), matching the TypeScript SDK

Python per-request policy resolvers now work reliably when a resolver callable is supplied instead of a static policy

Published to npm and PyPI as halt-rate — install with npm install halt-rate or pip install halt-rate

Express and Next.js adapters exposed as halt-rate/express and halt-rate/next subpath exports

Standard RateLimit-* and Retry-After headers emitted consistently across adapters

Initial release of Halt for Python and TypeScript

Support for Token Bucket, Fixed Window, Sliding Window, and Leaky Bucket algorithms

Storage backends: In-Memory, Redis, PostgreSQL, MongoDB, DynamoDB, Memcached

SaaS features: Quotas, Plans, Penalties, and Telemetry

Fixed type definitions for TypeScript SDK