@tensorcost/sdk 1.0.0 → 1.1.1

package/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 ## Unreleased
 
+## 1.1.1 — 2026-09-19
+
+Enterprise architect-hour fixes: fail-open correctness, honest streaming stance,
+observation flush for Lambda.
+
+### Fixed
+
+**Circuit HALF_OPEN probe** — successful probe no longer triggers a second direct
+provider call (`proxyFailed || circuitWasOpen` → `proxyFailed` only).
+
+**Buffered JSON headers timeout** — non-streaming steer/route waits up to
+`timeoutMs` for proxy headers (avoids fail-open double-bill while proxy buffers
+upstream).
+
+**Single-flight HALF_OPEN probe** — concurrent OPEN callers bypass until the
+probe completes.
+
+### Added
+
+**`flushObservations()`** — best-effort drain of fire-and-forget observation POSTs
+before Lambda freeze.
+
+**`stream: true` through steer proxy** — refused (direct provider when fail-open
+enabled; `TensorCostConfigError` when fail-open disabled).
+
+## 1.1.0 — 2026-09-19
+
+Agent hot-path hardening: fail-open faster on wedged proxy connections, optional
+cold-start warmup, and non-blocking sdk-layer refresh.
+
+### Added
+
+**`prewarm()`** — prefetch JWT + console published layer at Lambda/container
+init. Shares the same process-wide runtime cache as `wrap()`.
+
+**`headersTimeoutMs`** (default 2s) — separate deadline for proxy response
+headers vs body read (`timeoutMs`, default 60s). Missing headers within the
+budget fail-open to the direct provider without retry.
+
+### Changed
+
+**Sdk-layer fetch** — 250ms cap on cold `GET /sdk-layer`; stale-while-revalidate
+after the 30s TTL so refresh never blocks a model call.
+
+**Admit** — HTTP timeout tightened to 500ms (still fail-open on errors).
+
+**`wrap()`** — background-warms the shared runtime on first use.
+
+### Fixed
+
+Body JSON parse no longer leaves an unhandled rejection when the body-read
+deadline fires before `response.json()` settles.
+
 ## 1.0.0 — 2026-09-13
 
 Major release: control-layer ceilings replace the `appliedMode` boolean.

package/README.md

@@ -1,6 +1,8 @@
 # @tensorcost/sdk
 
-One-line wrapper SDK for TensorCost — fire-and-forget LLM observability and optional inference control for OpenAI, Anthropic, AWS Bedrock, and Google Vertex AI clients in Node.js.
+One-line wrapper for TensorCost — fire-and-forget LLM observability and optional inference control for OpenAI, Anthropic, AWS Bedrock, and Google Vertex AI clients in Node.js.
+
+**Current version:** 1.1.1 — fail-open correctness (no probe double-bill), buffered-json headers contract, `stream: true` refusal through steer proxy, `flushObservations()`. See [CHANGELOG](./CHANGELOG.md), [Architect hour Q&A](https://github.com/vaadhlabs/tensorcost/blob/main/docs/demo/architect-hour.md), and [Migrating from 0.x](#migrating-from-0x).
 
 ## Install
 
@@ -10,18 +12,20 @@ npm install @tensorcost/sdk
 pnpm add @tensorcost/sdk
 ```
 
-Requires Node.js 18+ (uses native `fetch`).
+Requires Node.js 18+ (native `fetch`).
+
+## Quick start (observe)
 
-## Use
+The default layer is **`observe`**: telemetry only, provider call unchanged.
 
 ```ts
 import OpenAI from "openai";
 import { wrap } from "@tensorcost/sdk";
 
-const client = wrap(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }));
+const client = wrap(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }), {
+  apiKey: process.env.TENSORCOST_API_KEY,
+});
 
-// Use the client exactly as before — TensorCost observes every call
-// and ships fire-and-forget observations to the platform.
 const resp = await client.chat.completions.create({
   model: "gpt-4o-mini",
   messages: [{ role: "user", content: "hi" }],
@@ -34,7 +38,9 @@ Anthropic works the same way:
 import Anthropic from "@anthropic-ai/sdk";
 import { wrap } from "@tensorcost/sdk";
 
-const client = wrap(new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY }));
+const client = wrap(new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY }), {
+  apiKey: process.env.TENSORCOST_API_KEY,
+});
 
 await client.messages.create({
   model: "claude-3-5-sonnet-20241022",
@@ -43,61 +49,142 @@ await client.messages.create({
 });
 ```
 
-## Configuration
+Create a long-lived SDK key in the TensorCost console (**Setup → Keys**). The SDK exchanges it for a short-lived JWT via `POST /api/inference-proxy/sdk-token/exchange` and refreshes ~60s before expiry.
 
-`wrap()` reads from the environment by default:
+## Control layers (`maxLayer`)
 
-| Variable | Purpose | Required |
-|---|---|---|
-| `TENSORCOST_API_KEY` | Long-lived API key from the TensorCost console | Yes |
-| `TENSORCOST_BASE_URL` | Backend base URL | No (default `https://api.tensorcost.com`) |
-| `TENSORCOST_TENANT_ID` | Optional explicit tenant id | No |
-| `TENSORCOST_PROXY_URL` | Inference-proxy base URL | Required when `maxLayer` is `steer` or `route` |
-| `TENSORCOST_ENVIRONMENT` | Environment tag stamped on every observation | No |
-| `TENSORCOST_CONNECTION_ID` | Provider-connection identifier | No |
-| `TENSORCOST_AGENT_ID` / `TENSORCOST_WORKFLOW_ID` | Agent-run attribution defaults | No |
-| `TENSORCOST_CUSTOMER` / `TENSORCOST_FEATURE` | Chargeback tag defaults | No |
+v1.0 uses a single ladder for how much TensorCost may intervene on a call:
+
+`off → observe → govern → steer → route`
+
+A layer is a **ceiling**, not a mode switch. The effective layer is always:
+
+```text
+min(your maxLayer, console published layer)
+```
+
+When routing is paused in the console, the published ceiling is capped at `govern`.
 
-Or pass explicitly:
+| Layer | Provider path | Behavior |
+|---|---|---|
+| `off` | Direct | No SDK wiring; client returned unchanged |
+| `observe` | Direct | Telemetry only (**default** when `maxLayer` is omitted) |
+| `govern` | Direct | Metadata-only `POST /v1/admit` before the provider call; may refuse unsafe calls |
+| `steer` | Via proxy | Proxy on the path; may steer without full live routing |
+| `route` | Via proxy | Full applied-mode routing through inference-proxy |
 
 ```ts
-const client = wrap(new OpenAI(...), {
-  apiKey: "tc_live_xxx",
-  baseUrl: "https://api.tensorcost.com",
+const client = wrap(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }), {
+  apiKey: process.env.TENSORCOST_API_KEY,
+  maxLayer: "route",
+  proxyUrl: process.env.TENSORCOST_PROXY_URL, // required for steer | route
 });
 ```
 
-## Control layers (`maxLayer`)
+`wrap()` throws `TensorCostConfigError` when `maxLayer` is `steer` or `route` and no `proxyUrl` / `TENSORCOST_PROXY_URL` is set. **`govern` does not require `proxyUrl`** — admit uses `baseUrl`.
 
-v1.0 replaces the old `appliedMode` boolean with a **control-layer ceiling**. A layer is a ceiling, not a mode — the effective layer is always `min(your maxLayer, console published layer)`.
+### Console-published ceiling
 
-| Layer | Behavior |
-|---|---|
-| `off` | No SDK wiring; client returned unchanged |
-| `observe` | Telemetry only (**default** when `maxLayer` is omitted) |
-| `govern` | Metadata-only `POST /admit` before the provider call; may refuse unsafe calls |
-| `steer` | Proxy on the path; proxy may steer without full live routing |
-| `route` | Full applied-mode routing through the inference-proxy |
+Operators set the tenant ceiling in the console (**Policy → Routing**) or via `PATCH /api/ai/router/layer` (`published_layer`, default `observe`). The SDK fetches the effective value from `GET /api/inference-proxy/v1/sdk-layer`:
+
+- **30s cache** while the endpoint is reachable
+- **250ms cap** on a cold fetch — a hung TensorCost cannot block the model call
+- **Stale-while-revalidate** after TTL: serve the last snapshot immediately and refresh in the background
+- **Decays to `govern`** after 5 minutes unreachable (fail-safe: still run admit, never silently upgrade to route)
+
+Publishing `steer` or `route` in the console requires a **content-retention data grant** (`retain_completions`, etc.). Steer/route without a grant returns **409**.
+
+### Govern admission
+
+At `govern` and above, the SDK calls `POST /api/inference-proxy/v1/admit` with metadata only — **no prompt or completion bodies**:
+
+- **204** + `x-tc-decision: layer=govern; action=allow` → proceed to the provider
+- **403** + `x-tc-decision: layer=govern; action=refuse; reason=…` → call blocked (budget, model governance, etc.)
+
+Admit is **fail-open** on transport errors: the provider call proceeds and an `admit_unavailable` observation is emitted when transport recovers. The admit HTTP call is capped at **500ms**.
+
+### Route layer prerequisites
+
+`maxLayer: "route"` is necessary but not sufficient for live provider swaps. ADR-0016 gates still apply on the proxy side: LaunchDarkly flag, `AI_ROUTING_LIVE_EXECUTION_PERMITTED`, non-`dry_run` policy with rollout, and routing not paused. When gated off, traffic pass-throughs to the original provider and the decision is recorded.
+
+See [ADR-0026](https://github.com/vaadhlabs/tensorcost/blob/main/docs/adr/0026-sdk-control-layer-ceilings.md) and [inference-proxy applied mode](https://github.com/vaadhlabs/tensorcost/blob/main/docs/features/inference-proxy-applied-mode.md).
+
+## Cold start (`prewarm`)
+
+At Lambda/container init, the first steer/route call can otherwise pay for JWT exchange and sdk-layer fetch on the hot path. Call `prewarm()` once at module scope — it shares the same process-wide runtime that `wrap()` uses, so a later `wrap()` hits a warm cache.
+
+`wrap()` also background-warms that shared runtime on first use; explicit `prewarm()` is recommended when you know traffic is about to arrive (e.g. before the handler is invoked).
 
 ```ts
-const client = wrap(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }), {
-  apiKey: "tc_live_xxx",
+import { prewarm, wrap } from "@tensorcost/sdk";
+
+await prewarm({
+  apiKey: process.env.TENSORCOST_API_KEY,
+  baseUrl: process.env.TENSORCOST_BASE_URL,
   maxLayer: "route",
-  proxyUrl: "https://api.my-instance.tensorcost.com", // or TENSORCOST_PROXY_URL
+});
+
+export const client = wrap(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }), {
+  apiKey: process.env.TENSORCOST_API_KEY,
+  maxLayer: "route",
+  proxyUrl: process.env.TENSORCOST_PROXY_URL,
 });
 ```
 
-`wrap()` throws `TensorCostConfigError` when `maxLayer` is `steer` or `route` and no `proxyUrl` / `TENSORCOST_PROXY_URL` is set.
+`prewarm()` is best-effort: failures are swallowed and the first real call retries the fetches.
 
-The SDK fetches the console-published ceiling from `GET /api/inference-proxy/v1/sdk-layer` (30s cache, decays to `govern` after 5 minutes unreachable). Govern refusals and proxy decisions surface in the `x-tc-decision` response header.
+## Migrating from 0.x
 
-`appliedMode: true` still works but is **deprecated** — it maps to `maxLayer: "route"` with a console warning. Prefer `maxLayer` in new code.
+| 0.x | 1.0 |
+|---|---|
+| `appliedMode: true` | `maxLayer: "route"` (deprecated alias still works with a console warning) |
+| Default `x-tc-max-layer: route` on proxy calls | Default is now `observe` |
+| Boolean on/off | Full layer ladder + console ceiling |
 
-See [ADR-0026](https://github.com/vaadhlabs/tensorcost/blob/main/docs/adr/0026-sdk-control-layer-ceilings.md) and [`docs/features/inference-proxy-applied-mode.md`](../../docs/features/inference-proxy-applied-mode.md).
+```ts
+// Before (0.6.x)
+wrap(client, { appliedMode: true, proxyUrl: "..." });
+
+// After (1.0)
+wrap(client, { maxLayer: "route", proxyUrl: "..." });
+```
+
+Recommended rollout: **`observe` → `govern` → `route`**, raising the console `published_layer` only after each stage is validated.
+
+## Configuration
+
+`wrap()` resolves options in order: explicit kwargs → environment variables → defaults.
+
+| Variable | Purpose | Required |
+|---|---|---|
+| `TENSORCOST_API_KEY` | Long-lived SDK key from **Setup → Keys** | Yes |
+| `TENSORCOST_BASE_URL` | Backend base URL (admit, sdk-layer, token exchange) | No (default `https://api.tensorcost.com`) |
+| `TENSORCOST_PROXY_URL` | Inference-proxy base URL | Required when `maxLayer` is `steer` or `route` |
+| `TENSORCOST_TENANT_ID` | Explicit tenant id (multi-tenant tests) | No |
+| `TENSORCOST_ENVIRONMENT` | Environment tag on every observation | No |
+| `TENSORCOST_CONNECTION_ID` | Provider-connection id for environment resolution | No |
+| `TENSORCOST_AGENT_ID` / `TENSORCOST_WORKFLOW_ID` | Agent-run attribution defaults | No |
+| `TENSORCOST_CUSTOMER` / `TENSORCOST_FEATURE` | Chargeback tag defaults | No |
+| `TENSORCOST_DEPLOYMENT` | Git SHA / release label (`metadata.deployment`) | No |
+| `TENSORCOST_PROMPT_TEMPLATE_ID` | Default prompt-template id | No |
+| `TC_APPLICATION` / `TENSORCOST_APPLICATION` | Routing-policy application scope (proxy) | No |
+| `TC_TAGS` / `TENSORCOST_TAGS` | Comma-separated routing tags (proxy) | No |
+
+```ts
+const client = wrap(new OpenAI(...), {
+  apiKey: "tc_live_xxx",
+  baseUrl: "https://api.tensorcost.com",
+  maxLayer: "govern",
+  deployment: process.env.GIT_SHA,
+  promptTemplateId: "support-chat-v2",
+  application: "customer-support",
+  tags: ["tier:enterprise"],
+});
+```
 
 ## Proxy hardening
 
-When `maxLayer` is `govern`, `steer`, or `route`, you can configure retries, timeouts, lifecycle hooks, and the fail-open circuit breaker.
+Applies when `maxLayer` is `govern`, `steer`, or `route` (admit + proxy paths).
 
 ### Retries
 
@@ -111,21 +198,33 @@ const client = wrap(new OpenAI(...), {
 });
 ```
 
-5xx responses, network errors, and 429 are retried with jittered exponential backoff. A `Retry-After` header on 429 is honoured. 4xx errors (except 429) are never retried.
+5xx, network errors, and 429 are retried with jittered exponential backoff. `Retry-After` on 429 is honoured. 4xx (except 429) are never retried.
 
 ### Timeouts
 
+Proxy timeouts are split so a wedged TCP connection fails open quickly while slow model bodies still get a full budget:
+
 ```ts
 const client = wrap(new OpenAI(...), {
   maxLayer: "route",
   proxyUrl: "...",
-  timeoutMs: 30_000, // default 60_000
+  headersTimeoutMs: 2_000, // wait for response headers (default 2_000)
+  timeoutMs: 60_000,       // non-streaming body read (default 60_000)
+  idleTimeoutMs: 30_000,   // streaming idle (default 30_000)
 });
 ```
 
-Surfaces as `TensorCostTimeoutError` (with `timeoutKind: "total"`) when exceeded.
+| Option | Default | `TensorCostTimeoutError.kind` | On timeout (steer/route) |
+|---|---|---|---|
+| `headersTimeoutMs` | 2s | `"headers"` | Streaming only (when SSE client ships); **not used for buffered JSON** |
+| `timeoutMs` | 60s | `"total"` | TTFB + body for non-streaming proxy calls; fail-open when `failOpenEnabled: true` |
+| `idleTimeoutMs` | 30s | `"idle"` | Reserved for future steer SSE client |
+
+For **non-streaming** steer/route, the SDK waits up to **`timeoutMs` for response headers** because the proxy may buffer the full upstream response before sending headers — using a 2s headers cap would fail-open and **double-bill** while the proxy still completes.
+
+**Streaming (`stream: true`):** not implemented through the steer proxy client (1.1.1). With `failOpenEnabled: true` (default), calls go **direct** to the provider. With `failOpenEnabled: false`, `TensorCostConfigError` is thrown.
 
-### Lifecycle telemetry hooks
+### Lifecycle hooks
 
 ```ts
 import { wrap, LifecycleEvent } from "@tensorcost/sdk";
@@ -140,11 +239,17 @@ const client = wrap(new OpenAI(...), {
 });
 ```
 
-Events contain only request metadata — never prompt content, response bodies, or credentials.
+Payloads contain request metadata only — never prompt content, response bodies, or credentials.
 
-### Typed errors
+### Circuit breaker
+
+After consecutive proxy 5xx failures (default 3), the circuit opens and requests route directly to the provider (fail-open). After consecutive successful probe calls (default 5), the circuit closes.
+
+Set `failOpenEnabled: false` when direct provider access is unavailable (e.g. in-VPC sidecar-only). Proxy failures then surface as `TensorCostProxyError` instead of falling back.
 
-Every failure from the proxy path is a subclass of `TensorCostError`:
+HALF_OPEN recovery uses a **single-flight probe** (1.1.1) — a successful probe does **not** invoke the provider twice.
+
+### Typed errors
 
 ```ts
 import {
@@ -154,20 +259,53 @@ import {
   TensorCostProxyError,
   TensorCostQuotaError,
   TensorCostProviderError,
+  TensorCostRunBudgetExceededError,
+  TensorCostModelGovernanceDeniedError,
+  TensorCostGuardrailHardStopError,
 } from "@tensorcost/sdk";
 ```
 
-### Circuit breaker
+Govern refusals and proxy decisions are also reflected in the `x-tc-decision` header and attached to observations as `decision_action` / `decision_reason` metadata when present.
 
-After consecutive proxy failures the circuit opens and requests route directly to the provider (fail-open). Set `failOpenEnabled: false` when direct provider access is unavailable — proxy failures then surface as `TensorCostProxyError` instead of falling back.
+## Data grants (`maxGrants`)
 
-## Agent-run attribution
+Code can cap which console data grants apply:
 
-Tag spend so **Router · Agent runs** can roll up cost per workflow:
+```ts
+import { wrap, intersectGrants } from "@tensorcost/sdk";
+
+const client = wrap(new OpenAI(...), {
+  apiKey: "...",
+  maxGrants: ["telemetry", "retain_completions"],
+});
+```
+
+Effective grants = `intersect(maxGrants, console.data_grants)`. Omit `maxGrants` to allow all console grants. An empty array allows none. Grant vocabulary: `telemetry`, `retain_completions`, `retain_prompts`, `retain_tools`.
+
+## Trace metadata & attribution
+
+### Deployment & prompt templates
+
+Group traces in the dashboard by deploy or template:
 
 ```ts
 const client = wrap(new OpenAI(...), {
-  apiKey: "tc_live_xxx",
+  apiKey: "...",
+  deployment: process.env.GIT_SHA ?? "local",
+  promptTemplateId: "onboarding-email-v2",
+});
+
+// Per-call override (OpenAI + Anthropic)
+await client.withMeta({ promptTemplateId: "research-agent-v5" }).chat.completions.create({ ... });
+```
+
+### Agent runs
+
+Tag spend for **Router · Agent runs**:
+
+```ts
+const client = wrap(new OpenAI(...), {
+  apiKey: "...",
   agentId: "support-bot",
 });
 
@@ -175,57 +313,110 @@ const scoped = client.withMeta({ workflowId: crypto.randomUUID() });
 await scoped.chat.completions.create({ model: "gpt-4o-mini", messages: [...] });
 ```
 
-`customer` / `feature` are separate chargeback tags — not substitutes for `agentId` / `workflowId`.
+`customer` / `feature` are separate chargeback dimensions — not substitutes for `agentId` / `workflowId`. Bedrock and Vertex accept wrap-time defaults only (no `withMeta()`).
 
 ## Fail-open guarantee
 
-If TensorCost is slow, down, or misconfigured, your customer call still succeeds. The SDK swallows internal errors and surfaces them via `console.warn`. The one exception: a missing API key throws `MissingConfigError` at `wrap()` time.
+If TensorCost is slow, down, or misconfigured, your customer call still succeeds. Internal errors are swallowed and logged via `console.warn` (or your lifecycle hook). Exceptions:
+
+- Missing `TENSORCOST_API_KEY` → `MissingConfigError` at `wrap()` time
+- Missing `proxyUrl` when `maxLayer` is `steer` or `route` → `TensorCostConfigError` at `wrap()` time
+- Govern **refusals** (403 from `/admit`) → call blocked by design
+- Steer **run-budget** refusals → not fail-opened
+
+### Duplicate spend (honest)
+
+Fail-open may call the provider **after** a failed proxy attempt. If the proxy already forwarded to the provider before failing, you can be billed twice. Mitigations:
+
+- **Sidecar / in-VPC steer:** set `failOpenEnabled: false` — no silent direct fallback
+- **Buffered JSON:** SDK 1.1.1+ waits `timeoutMs` for headers (not 2s) to avoid aborting a healthy slow proxy call
+
+Set `failOpen: false` only in tests to surface observation-pipeline errors.
+
+### Lambda: flush observations
+
+```ts
+import { flushObservations } from "@tensorcost/sdk";
+
+export const handler = async (event) => {
+  // ... model call via wrapped client ...
+  await flushObservations({ apiKey: process.env.TENSORCOST_API_KEY }, 3_000);
+};
+```
+
+## SDK version matrix (1.0.0 vs 1.1.x)
+
+| Feature | 1.0.0 | 1.1.0+ | 1.1.1+ |
+|---------|-------|--------|--------|
+| `prewarm()` | No | Yes | Yes |
+| `headersTimeoutMs` / split timeouts | No | Yes | Yes |
+| Admit 500ms cap | Partial | Yes | Yes |
+| Buffered JSON headers = `timeoutMs` | No | No | **Yes** |
+| Probe success no double-call | No | No | **Yes** |
+| `stream: true` steer refusal | No | No | **Yes** |
+| `flushObservations()` | No | No | **Yes** |
 
 ## What is captured
 
-Only metadata — never prompt or completion content:
+Metadata only — never prompt or completion content:
 
-- Provider + model + operation + modality
+- SDK version, provider, model, operation, modality
 - Request / response timestamps and token counts
 - Status (`success` / `error`) and error class/message on failure
 - Correlation UUID, environment, agent/workflow ids, chargeback tags
+- `decision_action` / `decision_reason` when `x-tc-decision` is present
 
-## AWS Bedrock (observe-only)
+Proxied requests include `x-tc-sdk-version`, `x-tc-sdk-capabilities`, and `x-tc-max-layer`.
 
-```ts
-import { BedrockRuntimeClient, InvokeModelCommand } from "@aws-sdk/client-bedrock-runtime";
-import { wrap } from "@tensorcost/sdk";
+## Supported providers & operations
 
-const client = wrap(
-  new BedrockRuntimeClient({ region: process.env.AWS_REGION ?? "us-east-1" }),
-);
-```
+| Provider | Package | Layers | Operations |
+|---|---|---|---|
+| OpenAI | `openai` ≥ 4.x | observe → route | chat, completions, embeddings, responses |
+| Anthropic | `@anthropic-ai/sdk` | observe → route | messages |
+| Azure OpenAI | `openai` (`AzureOpenAI`) | observe → route | same as OpenAI (`provider: "openai"`) |
+| AWS Bedrock | `@aws-sdk/client-bedrock-runtime` | observe, govern only | InvokeModel, Converse (token placeholders) |
+| Google Vertex | `@google/genai` (`vertexai: true`) | observe, govern only | generateContent (token placeholders) |
+
+**Steer/route streaming:** SDK routes `stream: true` **direct** to the provider (or errors if fail-open off). Proxy server supports SSE; SDK SSE client not shipped yet.
 
-Supported commands: `InvokeModelCommand`, `ConverseCommand`, and their streaming counterparts (streaming records latency/status; per-chunk token accounting is a follow-up).
+Full matrix: [`docs/demo/data-path-one-pager.md`](https://github.com/vaadhlabs/tensorcost/blob/main/docs/demo/data-path-one-pager.md).
 
-**Steer/route are not supported for Bedrock** — SigV4 signing happens inside the AWS SDK before the proxy can intercept. Use `maxLayer: "govern"` or lower for Bedrock telemetry.
+**Bedrock and Vertex:** SigV4 / Vertex signing happens inside the AWS / Google SDK before the proxy can intercept — **`steer` and `route` are not supported**. Use `maxLayer: "govern"` or lower.
 
-`@aws-sdk/client-bedrock-runtime` is an optional peer dependency.
+Bedrock peer dependency is optional:
 
-## Google Vertex AI (observe-only)
+```ts
+import { BedrockRuntimeClient, InvokeModelCommand } from "@aws-sdk/client-bedrock-runtime";
+import { wrap } from "@tensorcost/sdk";
 
-Wrap `@google/genai` clients constructed with `vertexai: true`. `models.generateContent` and streaming variants emit observations with `provider: "vertex"`. Steer/route are not supported (same signing constraint as Bedrock).
+const client = wrap(new BedrockRuntimeClient({ region: "us-east-1" }), {
+  apiKey: process.env.TENSORCOST_API_KEY,
+});
+```
 
 ## Framework adapters
 
-Optional helpers for common LLM frameworks (observe + proxy paths where supported):
+Thin passthroughs that call `wrap()` on the underlying LLM client:
 
 ```ts
-import { wrapLangChain, wrapLlamaIndex, wrapCrewAI, wrapVercelAi } from "@tensorcost/sdk";
+import { ChatOpenAI } from "@langchain/openai";
+import { wrapLangChain } from "@tensorcost/sdk";
+
+const llm = wrapLangChain(new ChatOpenAI({ model: "gpt-4o-mini" }), {
+  apiKey: process.env.TENSORCOST_API_KEY,
+  maxLayer: "observe",
+});
 ```
 
-## Currently supported
+Also exported: `wrapLlamaIndex`, `wrapCrewAI`, `wrapVercelAi`.
+
+## Further reading
 
-- OpenAI (`openai` >= 4.x) — chat, completions, embeddings, responses
-- Anthropic (`@anthropic-ai/sdk`) — messages
-- AWS Bedrock (`@aws-sdk/client-bedrock-runtime`) — invoke/converse (+ streaming placeholders)
-- Google Vertex AI (`@google/genai` with `vertexai: true`) — generateContent
-- Azure OpenAI — wrap the standard `AzureOpenAI` client (observations report `provider: "openai"`)
+- [ADR-0026 — SDK control-layer ceilings](https://github.com/vaadhlabs/tensorcost/blob/main/docs/adr/0026-sdk-control-layer-ceilings.md)
+- [Inference proxy SDK feature doc](https://github.com/vaadhlabs/tensorcost/blob/main/docs/features/inference-proxy-sdk.md)
+- [Applied mode / live routing](https://github.com/vaadhlabs/tensorcost/blob/main/docs/features/inference-proxy-applied-mode.md)
+- [CHANGELOG](./CHANGELOG.md)
 
 ## License
 

package/dist/admit-client.js

@@ -4,7 +4,7 @@
  * Fail-open on transport failure: the customer's call proceeds to the
  * provider and an error observation is emitted when transport is available.
  */
-import { ADMIT_PATH } from "./layer.js";
+import { ADMIT_PATH, ADMIT_TIMEOUT_MS } from "./layer.js";
 import { SDK_VERSION, sdkCapabilityHeader } from "./version.js";
 export async function admitRequest(opts) {
     const fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
@@ -33,7 +33,7 @@ export async function admitRequest(opts) {
             : {}),
     };
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 5_000);
+    const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? ADMIT_TIMEOUT_MS);
     try {
         const resp = await fetchImpl(url, {
             method: "POST",

package/dist/admit-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"admit-client.js","sourceRoot":"","sources":["../src/admit-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAiChE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;QAC3C,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,WAAW;QAC/B,uBAAuB,EAAE,mBAAmB,EAAE;QAC9C,gBAAgB,EAAE,IAAI,CAAC,QAAQ;KAChC,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,SAAS,IAAI,KAAK,CACxB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,2BAA2B,CAAC,IAAI,EAAE,GAAY,CAAC,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAyB,EACzB,GAAU;IAEV,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAClB,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;YAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,QAAQ,EAAE;gBACR,eAAe,EAAE,OAAO;gBACxB,eAAe,EAAE,mBAAmB;aACrC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"admit-client.js","sourceRoot":"","sources":["../src/admit-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAiChE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;QAC3C,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,WAAW;QAC/B,uBAAuB,EAAE,mBAAmB,EAAE;QAC9C,gBAAgB,EAAE,IAAI,CAAC,QAAQ;KAChC,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,SAAS,IAAI,gBAAgB,CACnC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,2BAA2B,CAAC,IAAI,EAAE,GAAY,CAAC,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAyB,EACzB,GAAU;IAEV,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAClB,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;YAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,QAAQ,EAAE;gBACR,eAAe,EAAE,OAAO;gBACxB,eAAe,EAAE,mBAAmB;aACrC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC"}

package/dist/circuit.d.ts

@@ -10,7 +10,7 @@
  * State machine:
  *
  *   CLOSED ──(failures >= openThreshold)──> OPEN
- *   OPEN   ──(next call, always probes)───> HALF_OPEN
+ *   OPEN   ──(single-flight probe)───────> HALF_OPEN
  *   HALF_OPEN ──(proxy 2xx)──────────────> probeSuccesses++
  *              ──(proxy 5xx/err)──────────> back to OPEN (resets probes)
  *   HALF_OPEN ──(probeSuccesses >= closeThreshold)──> CLOSED
@@ -31,6 +31,8 @@ export declare class CircuitBreaker {
     private state;
     private consecutiveFailures;
     private probeSuccesses;
+    /** True while a HALF_OPEN probe is in flight (single-flight). */
+    private probeInFlight;
     readonly config: CircuitBreakerConfig;
     private readonly onTransition?;
     constructor(config?: CircuitBreakerConfig, onTransition?: CircuitTransitionListener);
@@ -46,12 +48,18 @@ export declare class CircuitBreaker {
      */
     shouldBypass(): boolean;
     /**
-     * Returns true when the next call should be a probe (the circuit is
-     * OPEN and we are transitioning to HALF_OPEN to test the proxy).
+     * Returns true when this caller should run the single-flight HALF_OPEN
+     * probe (OPEN → HALF_OPEN). Concurrent OPEN callers get false and bypass.
      */
     shouldProbe(): boolean;
     /** Call after a proxy request succeeds. */
     recordSuccess(): void;
+    /**
+     * Clear a HALF_OPEN probe that never reached recordSuccess/recordFailure
+     * (e.g. token exchange threw before the HTTP call). Idempotent once the
+     * probe has settled.
+     */
+    releaseStuckProbe(): void;
     /** Call after a proxy request fails (5xx or network error). */
     recordFailure(): void;
     private reset;

package/dist/circuit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"circuit.d.ts","sourceRoot":"","sources":["../src/circuit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,sBAAsB,EAAE,oBAGpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,CACtC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,YAAY,KACb,IAAI,CAAC;AAEV,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,cAAc,CAAK;IAC3B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAA4B;gBAGxD,MAAM,GAAE,oBAA6C,EACrD,YAAY,CAAC,EAAE,yBAAyB;IAM1C,OAAO,CAAC,UAAU;IAOlB,6BAA6B;IAC7B,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,wDAAwD;IACxD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAIvB;;;OAGG;IACH,WAAW,IAAI,OAAO;IAQtB,2CAA2C;IAC3C,aAAa,IAAI,IAAI;IAWrB,+DAA+D;IAC/D,aAAa,IAAI,IAAI;IAarB,OAAO,CAAC,KAAK;CAKd"}
+{"version":3,"file":"circuit.d.ts","sourceRoot":"","sources":["../src/circuit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,sBAAsB,EAAE,oBAGpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,CACtC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,YAAY,KACb,IAAI,CAAC;AAEV,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,cAAc,CAAK;IAC3B,iEAAiE;IACjE,OAAO,CAAC,aAAa,CAAS;IAC9B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAA4B;gBAGxD,MAAM,GAAE,oBAA6C,EACrD,YAAY,CAAC,EAAE,yBAAyB;IAM1C,OAAO,CAAC,UAAU;IAOlB,6BAA6B;IAC7B,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,wDAAwD;IACxD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAOvB;;;OAGG;IACH,WAAW,IAAI,OAAO;IAStB,2CAA2C;IAC3C,aAAa,IAAI,IAAI;IAYrB;;;;OAIG;IACH,iBAAiB,IAAI,IAAI;IAQzB,+DAA+D;IAC/D,aAAa,IAAI,IAAI;IAcrB,OAAO,CAAC,KAAK;CAMd"}