rateLimiterDO.ts

mcp-server/src/rateLimiterDO.ts

1. import { DurableObject } from "cloudflare:workers";
2. import { PLINTH_RATE_LIMIT, reserveSlot, sleep, type RateLimiter } from "./lib/rateLimit.js";
4. /**
5. * Shared rate-limiter Durable Object (Workers only).
6. *
7. * Every Plinth request across ALL McpAgent sessions and isolates routes through
8. * ONE instance, `idFromName("plinth-global")`, so the global 10/10s budget holds
9. * no matter how many users or parallel tool calls are in flight. A per-isolate
10. * limiter would let each session spend the full budget independently and blow
11. * the API limit.
12. *
13. * State is in-memory: a rate limiter needs no durability. Worst case, an
14. * eviction resets the window and permits one small burst, which is harmless.
15. * The reserve computation is synchronous (no await), so it is atomic even when
16. * the DO handles concurrent RPC calls.
17. */
18. export class RateLimiterDO extends DurableObject {
19. private slots: number[] = [];
21. /** Reserve one slot; returns the ms the caller must wait before its request. */
22. reserve(): number {
23. const { delayMs, slots } = reserveSlot(
24. this.slots,
25. Date.now(),
26. PLINTH_RATE_LIMIT.max,
27. PLINTH_RATE_LIMIT.windowMs,
28. );
29. this.slots = slots;
30. return delayMs;
31. }
32. }
34. /** Workers RateLimiter: delegates scheduling to the one shared limiter DO. */
35. export class WorkerRateLimiter implements RateLimiter {
36. constructor(private readonly ns: DurableObjectNamespace<RateLimiterDO>) {}
38. async acquire(): Promise<void> {
39. const stub = this.ns.get(this.ns.idFromName("plinth-global"));
40. const delayMs = await stub.reserve();
41. if (delayMs > 0) await sleep(delayMs);
42. }
43. }