@sansavision/limitfuse

Optional Node client for the LimitFuse managed AI gateway and provider-neutral, metadata-only External Guard. External Guard can protect functions, queues, databases, storage operations, HTTP APIs, browser work, jobs, tools, and model calls.

Runtime and security boundary

This is a server-side SDK. It supports Node.js 18 or newer and server runtimes that provide compatible fetch, AbortController, TextEncoder, and btoa globals.

| Application | Supported use | | --- | --- | | Next.js, Remix, Express, Fastify, serverless functions | Use the SDK in server-only code. | | Browser React | Call your own backend. Never include a LimitFuse project key in the browser bundle. | | React Native | Call your own backend or serverless orchestration layer. Never embed a LimitFuse project key in the app binary. | | Electron or other packaged desktop apps | Use a remote backend. A key shipped in the renderer, main process, resources, or installer can be extracted. |

The public raw HTTP API and this SDK provide the same capabilities. Client applications should authenticate to a customer-controlled backend, and that backend should hold the LimitFuse key and invoke LimitFuse.

npm install @sansavision/limitfuse

import { LimitFuseClient } from "@sansavision/limitfuse";

const limitfuse = new LimitFuseClient({
  gatewayUrl: "https://gateway.limitfuse.com",
  projectKey: process.env.LIMITFUSE_PROJECT_KEY!
});

const response = await limitfuse.chatCompletions({
  model: "limitfuse-default",
  messages: [{ role: "user", content: "Summarize this incident." }],
  max_completion_tokens: 400
}, {
  metadata: {
    feature: "incident-summary",
    operation_id: crypto.randomUUID(),
    attempt: 1
  }
});

Keep the provider call in your infrastructure

External Guard gives any metered operation budget authority before execution. Use model, tool, queue, function, browser, database, storage, http, or job as the operation kind. LimitFuse receives operational metadata only. Your credentials, content, request body, and response stay in your infrastructure.

Use executeExternalSafely for the recommended lifecycle. It enforces the signed deadline, supplies a cooperative abort signal, preserves uncertain reservations, and can invoke a narrowly scoped provider or workflow termination callback.

const outcome = await limitfuse.executeExternalSafely({
  kind: "function",
  feature: "invoice-sync",
  runId,
  operationId,
  logicalOperationId: invoiceId,
  estimatedMaxCostUsd: 0.03,
  attempt: 1,
  maxOutputTokens: 800
}, {
  timeoutMs: 45_000,
  execute: async ({ signal, markStarted }) => {
    markStarted();
    const result = await callYourProvider({ invoiceId, signal, maxSteps: 6 });
    return { value: result, actualCostUsd: result.costUsd };
  },
  terminate: async ({ signal }) => {
    const stopped = await cancelProviderJob(jobId, { signal });
    return stopped.confirmed
      ? { status: "confirmed", actualCostUsd: stopped.costUsd }
      : { status: "uncertain" };
  }
});

if (outcome.status === "uncertain") {
  await enqueueProviderLogReconciliation(outcome.authorization.operation_id);
}

markStarted() must be called immediately before dispatch. Before that point, the helper can safely release unused authority. After that point, a timeout is not proof that no billable work occurred, so the helper never calls the LimitFuse cancellation endpoint. It either confirms provider termination and settles measured cost, or returns uncertain and retains the reservation for reconciliation.

An abort signal is cooperative. The provider SDK, HTTP client, function, or runtime must honor it. Also set provider-side maximum tokens, steps, duration, retry, and fanout limits. For asynchronous work, use a durable watchdog or provider cancel-job API because an in-process timer disappears when its process crashes.

The package is not required. See https://limitfuse.com/docs/api for raw HTTP, Fetch, External Guard, OpenAI-compatible client, envelope, and error documentation.

Keep every lf_live_ key in a server-side secret manager. Use a separate key and consumer label for each calling product.