API Keys, Secrets, Rate Limits, and Cost Controls

// guard-lab.mjs
const maxInputChars = Number(process.env.MAX_INPUT_CHARS ?? 2000);
const maxAttempts = Number(process.env.MAX_ATTEMPTS ?? 4);
const dailyRequestBudget = Number(process.env.DAILY_REQUEST_BUDGET ?? 20);

function assertPositiveInteger(name, value) {
  if (!Number.isSafeInteger(value) || value < 1) {
    throw new Error(`${name} must be a positive integer`);
  }
}

assertPositiveInteger("MAX_INPUT_CHARS", maxInputChars);
assertPositiveInteger("MAX_ATTEMPTS", maxAttempts);
assertPositiveInteger("DAILY_REQUEST_BUDGET", dailyRequestBudget);
if (maxAttempts > 5) throw new Error("Lab attempts must be at most 5");
const maxElapsedMs = 5_000;
const startedMs = performance.now();

const input = "Classify this synthetic support message by urgency.";
if (input.length > maxInputChars) throw new Error("Input exceeds local size cap");

// In-memory lab counter: restarting resets it. A real daily cap needs durable,
// atomic per-account storage and an explicit date/timezone rollover.
let callsToday = 0;
async function simulatedRemoteCall(attempt) {
  if (callsToday >= dailyRequestBudget) throw new Error("Local run budget reached");
  callsToday += 1;
  if (attempt < 3) return { ok: false, status: 429 };
  return { ok: true, status: 200, data: { urgency: "normal" } };
}

for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
  if (performance.now() - startedMs >= maxElapsedMs) throw new Error("Elapsed budget reached");
  const result = await simulatedRemoteCall(attempt);
  console.log({ attempt, status: result.status }); // never log a key
  if (result.ok) {
    console.log(result.data);
    break;
  }
  if (result.status !== 429 || attempt === maxAttempts) {
    throw new Error(`Stopped after HTTP ${result.status}`);
  }
  const baseMs = 100 * 2 ** (attempt - 1);
  const jitterMs = Math.floor(Math.random() * 100);
  const delayMs = baseMs + jitterMs;
  if (performance.now() - startedMs + delayMs >= maxElapsedMs) {
    throw new Error("Retry would exceed elapsed budget");
  }
  await new Promise((resolve) => setTimeout(resolve, delayMs));
}

$env:MAX_INPUT_CHARS="2000"
$env:MAX_ATTEMPTS="4"
$env:DAILY_REQUEST_BUDGET="20"
node guard-lab.mjs

MAX_INPUT_CHARS=2000 MAX_ATTEMPTS=4 DAILY_REQUEST_BUDGET=20 node guard-lab.mjs

MAX_INPUT_CHARS=2000 MAX_ATTEMPTS=2 DAILY_REQUEST_BUDGET=20 node guard-lab.mjs
MAX_INPUT_CHARS=10 MAX_ATTEMPTS=4 DAILY_REQUEST_BUDGET=20 node guard-lab.mjs