@agenticprimitives/rate-control-cloudflare

The Cloudflare adapter for @agenticprimitives/rate-control (spec 290 §7-§8): the authoritative Stage-3 hard-budget store as a Durable Object + a HardBudgetStore client. The hard budget protects off-chain infra/sponsorship cost (KMS / paymaster / LLM / provider / edge); it is additive to on-chain enforcers, never the authority for value movement (§9 / ADR-0041).

API

• SmartAgentBudgetDO — the Durable Object class. Export it from your Worker + add a [[durable_objects.bindings]] entry + a migration. One DO instance per Smart Agent shard (eip155:<chainId>:<sponsorAgent>); reserve/commit/release run inside ctx.storage.transaction.
• createDurableObjectBudgetStore({ namespace, chainId, limitUnits }) — a HardBudgetStore the origin consumes after authority: reserve({ sponsorAgent, capabilityId, estimatedUnits, idempotencyKey }) → { allowed, reservationId? }; commit(reservationId, actualUnits); release(reservationId).
• Pure helpers (evaluateReserve/applyCommit/applyRelease/reservedTotal) for testing/custom hosts.

Usage (origin Worker, post-authority)

import { createDurableObjectBudgetStore } from '@agenticprimitives/rate-control-cloudflare';
const budget = createDurableObjectBudgetStore({ namespace: env.SA_BUDGET, chainId: 84532, limitUnits: 1000 });

const r = await budget.reserve({ sponsorAgent: verified.principal, capabilityId, estimatedUnits: 1, idempotencyKey: requestId });
if (!r.allowed) return new Response('budget exhausted', { status: 429 });
try { const out = await runOp(); await budget.commit(r.reservationId!, out.actualUnits); return out; }
catch (e) { await budget.release(r.reservationId!); throw e; }

wrangler.toml (the deployed Worker — app config, ADR-0021):

[[durable_objects.bindings]]
name = "SA_BUDGET"
class_name = "SmartAgentBudgetDO"
[[migrations]]
tag = "v1"
new_classes = ["SmartAgentBudgetDO"]

Reserve before spend, commit on success (charge actuals), release on failure (a 429/deny restores the budget). Idempotent by idempotencyKey — a retried reserve never double-charges.