Skip to content← All dispatches◆releasecurrentAugust 27, 2026
v0.2.0
Brume Limit: the rate-limiting gateway
Brume pivots from realtime infrastructure to a hosted rate-limiting gateway. Four algorithms, flat-rate pricing, and a privacy-by-architecture core.
+
Added
10- Rate-limiting gateway with four algorithms (token bucket, fixed window, sliding window log, sliding window counter)
- limit (consume) and check (read-only) evaluation endpoints
- Multi-rule evaluation in one call
- Per-identifier overrides
- Long-window quotas with billing-cycle-aware resets
- Block & allow lists evaluated before any rule runs
- Per-identifier analytics
- @brume/limit: typed TypeScript SDK with ephemeral cache and timeout fallbacks
- Flat-rate pricing — four tiers, nothing metered
- Outbound webhooks signed with HMAC-SHA256
↑
Improved
03- API keys now carry explicit scopes (rate_limit, manage_project, read_stats)
- Fail-open behavior is visible via degraded flag and X-Brume-RateLimit-Degraded header
- OpenAPI document regenerated for the rate-limiting surface
−
Removed
04- Realtime stack — WebSocket channels, presence, transport fallback, message acknowledgements
- @brume/client, @brume/react, @brume/protocol, @brume/testing, @brume/server SDK packages
- JWT authentication (rate limiting uses API keys directly)
- Realtime tier axes (max_channels, max_messages_per_sec)
Latest dispatch
First dispatch
Subscribe
Follow the log.
One email per release. No marketing, no cross-promotion. The same way the changelog is written.
Cadencetarget: monthly / pre-1.0
Brume is now a rate-limiting gateway. This release removes the realtime stack entirely and ships the product we are actually building: a hosted service that answers "is this request allowed?" with a verdict and standard headers, in one HTTP call.
Why the pivot
The realtime market is crowded with well-funded incumbents, and competing on channels and presence meant competing on scale we do not have. Rate limiting is the same engineering problem — atomic counter state, fail-open tradeoffs, per-identifier policy — pointed at a market where a small, honest, flat-rate service can win.
What shipped
- Four algorithms. Token bucket, fixed window, sliding window log, sliding window counter. Pick per rule.
- limit and check.
limit consumes capacity; check is read-only so a UI can gate a button without burning the user's quota.
- Multi-rule evaluation. Burst rule plus budget rule in one round trip.
- Overrides, quotas, blocklists. Per-identifier exceptions, long-window budgets, and block/allow lists — all first-class objects, all enforced inside the same atomic Lua evaluation.
- Analytics. Per-identifier allowed/denied breakdowns in the dashboard and over the API.
- @brume/limit. A small typed SDK with an ephemeral cache for blocked identifiers and explicit timeout/error fallbacks.
- Flat-rate pricing. Free / Starter $19 / Pro $49 / Business $99. Nothing metered. Exceeding a cap rejects, never invoices.
What was removed
The entire realtime stack: WebSocket channels, presence, transport fallback, message acknowledgements, JWT auth, and the five realtime SDK packages. If you were evaluating Brume for realtime, this release is not for you, and we would rather tell you that plainly than keep a half-alive realtime surface around.
Migration
If you are coming from Unkey or Upstash, see the migration guides: from Unkey, from Upstash.