Rent Lookup worker

Backend for the Market-Rate Rent Lookup tool. It is the only place the HUD and RentCast API keys live. Deployed separately from the website via Wrangler; nothing here ever goes into a Divi Code Module. Source of truth: workers/rent-lookup/README.md.

What it does

GET /rent?source=official|market&zip=NNNNN&beds=0-4[&address=...]

source=official → HUD Fair Market Rent (free, government, yearly updates).
source=market → RentCast estimate (near-live; free tier 50 calls/month).

Returns one stable JSON shape regardless of provider. Errors are clean codes (ZIP_NOT_FOUND, UPSTREAM_ERROR, RATE_LIMITED, BAD_INPUT), never a stack trace and never an echoed token.

Why it will not surprise-bill

Identical lookups are cached (official ~30 days, market ~10 days); repeat visitors cost zero API calls.
A monthly counter in Cloudflare KV stops calling RentCast at 45 (free tier is 50). When capped it returns RATE_LIMITED and the page keeps showing the free official figure.

Deploy and secrets

Deploy: npx wrangler deploy from workers/rent-lookup/.
Secrets (encrypted, never in git): HUD_API_TOKEN, RENTCAST_API_KEY, set via npx wrangler secret put ....
KV namespace RENT_KV holds the monthly quota counter; its id is in wrangler.toml.
CORS is locked to https://tiltanalytics.com and the www host.
The deployed worker URL is wired into pages/resources/market-rate-rent-lookup/02-tool.html at WORKER_BASE.

Secret rotation

If a key leaks: regenerate it at the provider, re-run npx wrangler secret put HUD_API_TOKEN / RENTCAST_API_KEY, then npx wrangler deploy. No website change needed.

First-live-call check

HUD’s API docs could not be machine-read, so src/providers/hud.js parses defensively. On the first real source=official call, check the returned rent against huduser.gov for that ZIP; if a field name differs, adjust BED_FIELDS / primaryCounty in hud.js only.