@tensorcost/sdk 1.3.3 → 1.5.0

package/CHANGELOG.md

@@ -1,6 +1,231 @@
 # Changelog
 
-## Unreleased
+## 1.5.0 — 2026-10-26
+
+**1.4.0 could route around a hard spend cap when fail-open was on (the
+default); upgrade.** When a money budget's hard cap refused a call (403
+with `code: "BUDGET_HARD_CAP"`), 1.4.0 read the refusal as a provider error,
+and with `failOpenEnabled` on it sent the call to the provider anyway. The
+cap was enforced by the proxy and then skipped by the SDK.
+
+This is a minor release, not a patch: it adds public error classes and
+makes `wrap()` throw at startup without a tenant id. Read the upgrade notes.
+
+### Upgrading from 1.4.x
+
+- **`wrap()` requires a tenant id at `govern`, `steer` and `route`.** The
+  token exchange needs it, so without one the SDK never talked to TensorCost
+  at all: no `/v1/admit`, no proxy call, no observation, and every call went
+  straight to the provider while the README called the variable optional.
+  `wrap()` now throws `MissingConfigError` at those layers when neither
+  `tenantId` nor `TENSORCOST_TENANT_ID` is set, whatever `failOpenEnabled` says (1.4.0 skipped
+  TensorCost silently, or with `failOpenEnabled: false` in route threw
+  `TensorCostProxyError` on every call). Find the id in the TensorCost
+  console under **Developers › SDK setup**, in the `TENSORCOST_TENANT_ID`
+  line of the env block. `observe` without one keeps working and logs one
+  warning that nothing is being sent.
+- **Unknown refusals are terminal.** A refusal code this version doesn't
+  know stops the call as `TensorCostRefusedError`; it no longer falls back
+  to the provider. Details below.
+- **A revoked key fails closed.** A TensorCost key the token exchange,
+  `/v1/admit` or the proxy rejects is `TensorCostKeyRejectedError`, and the
+  call isn't sent. 1.4.0 let the call through to the provider when fail-open
+  was on (in steer/route with an openai@4 client it crashed instead, see
+  Fixed).
+- **Route-mode embeddings, responses and legacy completions now go straight
+  to the provider.** Only `chat.completions` is proxied. 1.4.0 pointed the
+  whole client's `baseURL` at the proxy, so those calls went there too,
+  carrying the provider key as the bearer. Now they go to the provider and
+  are not proxied; legacy completions are observed, embeddings and
+  responses aren't wrapped at all.
+
+### Changed: an unknown refusal is now terminal
+
+1.4.0 decided whether a failed proxy call could go straight to the provider
+with a list of refusals that must not. Any refusal missing from that list,
+including ones added on the server later, fell back. 1.5.0 turns the rule
+around: a call goes around TensorCost only when TensorCost is unavailable.
+
+- Falls back (with `failOpenEnabled` on): network errors and connection
+  refused (`TensorCostNetworkError`), timeouts (`TensorCostTimeoutError`),
+  5xx from the proxy or an open circuit (`TensorCostProxyError`), and a 429
+  or 402 from the proxy with no refusal body (`TensorCostQuotaError`; the
+  429 is TensorCost's rate limit, the 402 the plan's monthly request
+  ceiling). The same outages on the token exchange count too.
+- Never falls back: any 4xx carrying a TensorCost refusal, whatever the
+  code. A code this version doesn't know arrives as `TensorCostRefusedError`
+  with `code`, `reason` and the server's message intact. A refusal is never
+  retried, even on a 429.
+- A provider's own 4xx relayed by the proxy (an OpenAI 400, say) doesn't
+  fall back either. It is thrown as the provider SDK's own error, built by
+  the client itself with `client.makeStatusError(...)`, the factory the
+  client uses for a direct call (`BadRequestError`, `AuthenticationError` and
+  the rest), with the original `TensorCostProviderError` on its `tensorcost`
+  property. The headers go in as a plain object first, which openai@4 reads,
+  then as a `Headers` instance, which current Stainless clients read with
+  `headers.get(...)`. Tested against openai@4.104.0 and @anthropic-ai/sdk
+  0.65.0, and against a stub of the openai v5/v6 `headers.get` contract;
+  openai v5/v6 itself wasn't run. A client that can't build one gets the
+  `TensorCostProviderError` (`status`, `body`, `headers`).
+- A 4xx that isn't JSON (a firewall's HTML page, an empty body) is
+  `TensorCostGatewayRejectedError`: the request was turned away before it
+  reached TensorCost or the provider. Terminal.
+- The proxy's own NestJS error body (`{ statusCode, message }`) is
+  TensorCost's, not the provider's: a 401 there is
+  `TensorCostKeyRejectedError`, anything else a `TensorCostRefusedError`
+  with the message.
+
+A refusal is any 4xx whose body has an upper-case code at `error.code` or a
+top-level `code` (`{"error": {"code": "SOME_CODE", ...}}` or
+`{"code": "SOME_CODE", ...}`), or whose `x-tc-decision` header says
+`action=refuse`. Lower-case codes (OpenAI's `invalid_api_key` and the like)
+belong to the provider.
+
+The govern layer follows the same rule: `/v1/admit` fails open only on an
+outage, and only while `failOpenEnabled` is on. Before, admit failed open on
+everything except a 403, whatever `failOpenEnabled` said.
+
+### Added
+
+**`TensorCostRefusedError`**, the base class of every refusal:
+`TensorCostRunBudgetExceededError`, `TensorCostRunStoppedError`,
+`TensorCostPeriodBudgetExceededError`, `TensorCostModelGovernanceDeniedError`,
+`TensorCostGuardrailHardStopError`, `TensorCostComplianceDeniedError` and
+`TensorCostComplianceTeamMismatchError` all extend it now, and all carry
+`code`, `reason` and `detail` (the refusal object the server sent). Catch
+`TensorCostRefusedError` to handle every refusal, current and future.
+
+**`TensorCostBudgetHardCapError`** for a money budget's hard cap. It extends
+`TensorCostPeriodBudgetExceededError`, so a `catch` written against 1.4.0 for
+the current wire shape still matches. Fields: `budgetId`, `budgetName`,
+`burnPct`, `scope`, `period`, `capCents`, `spentCents`, `reason`,
+`budgetCode` (always `"BUDGET_HARD_CAP"`), `retryable` and
+`retryAfterSeconds`. `retryable` is true when the budget's spend hasn't been
+counted yet (`reason: "spend_not_known_yet"` or `retryable: true` on the
+wire), usually for a few seconds after a budget is created or its scope
+changes, and the message then says "the budget's spend hasn't been counted
+yet; retry in 5 s". Otherwise it says "the budget's hard cap is reached". The
+SDK doesn't retry for you. The shapes it accepts, on the chat path and on
+`/v1/admit`:
+
+```json
+{ "error": { "code": "PERIOD_BUDGET_EXCEEDED", "budget_code": "BUDGET_HARD_CAP",
+             "budget_id": "b-1", "budget_name": "Prod AI", "burn_pct": 1.02,
+             "scope": "budget:b-1", "period": "monthly",
+             "cap_cents": 10000, "spent_cents": 10200, "retryable": false,
+             "message": "..." } }
+
+{ "error": { "code": "PERIOD_BUDGET_EXCEEDED", "budget_code": "BUDGET_HARD_CAP",
+             "reason": "spend_not_known_yet", "retryable": true,
+             "retry_after_seconds": 5, "budget_id": "b-2", ... } }
+  + header  Retry-After: 5
+
+{ "error": { "code": "BUDGET_HARD_CAP", "budget_id": "b1", "burn_pct": 0,
+             "reason": "spend_not_known_yet", "message": "..." } }   (older servers)
+```
+
+`retryAfterSeconds` reads the `Retry-After` header (seconds or an HTTP date)
+first, then `retry_after_seconds` or `retry_after` in the body. A
+`PERIOD_BUDGET_EXCEEDED` without `budget_code` is still a plain
+`TensorCostPeriodBudgetExceededError`.
+
+**`TensorCostGatewayRejectedError`** (non-JSON 4xx, above) and
+**`TensorCostKeyRejectedError`** (the token exchange, `/v1/admit` or the
+proxy rejected the TensorCost key: "the TensorCost key was rejected; check
+it's current"). Both are terminal. 1.4.0 threw a plain `Error` for a revoked
+key, and with fail-open on, the call then went to the provider.
+
+### Fixed
+
+**steer/route with a real openai@4 client.** 1.4.0 rewrote the client's
+`baseURL` to the proxy and replaced its `defaultHeaders()` method with a
+plain object. Every call that reached the client's own request path died
+with `TypeError: this.defaultHeaders is not a function`: every fail-open
+fallback (proxy 5xx, 429, 402, network error, token-exchange outage), and
+every call when a route-configured client ran below steer (published layer
+govern or observe, TensorCost unreachable for more than 5 minutes). Had the
+fallback run, it would have gone to the proxy URL, not the provider. 1.5.0
+doesn't modify the client at all: the SDK sends the proxied call itself and
+reads the provider URL and key from the client per call, and the fallback
+goes to the client's own `baseURL`.
+
+**Real Anthropic clients are detected as Anthropic.** The @anthropic-ai/sdk
+client also has a legacy `completions.create`, so 1.4.0 detected it as an
+OpenAI client and never wrapped `messages.create`: Claude calls were not
+observed, admitted or stopped.
+
+**Anthropic clients run in govern mode.** The proxy has no Anthropic Messages
+route yet, so steer/route for an Anthropic client could only fail open around
+TensorCost. `maxLayer: "steer"` or `"route"` (or `appliedMode: true`) on an
+Anthropic client now runs as `"govern"`: every call is checked with
+`/v1/admit` before it goes to Anthropic. One warning per process says so;
+set `maxLayer: "govern"` to silence it.
+
+**Bedrock and Vertex say govern isn't enforced.** There is no `/v1/admit`
+check for them yet, so `maxLayer: "govern"` only observes. The SDK now logs
+one warning per process saying so, and the README no longer lists govern as
+supported for them.
+
+**Govern-layer refusals are typed by their code.** 1.4.0 threw
+`TensorCostModelGovernanceDeniedError` ("request refused at govern layer")
+for every `/v1/admit` refusal except a run stop, budget caps included.
+
+**Streaming proxy errors.** After retries ran out, a 5xx or 429 on the
+streaming path was reported as `TensorCostProviderError`; it is
+`TensorCostProxyError` / `TensorCostQuotaError` now.
+
+### Not in 1.5.0: `application` and `tags` on observations
+
+The server's observation endpoint reads `application` and `tags`, and the
+SDK sends them only as `x-tc-application` / `x-tc-tags` on proxied calls.
+Adding them to observations is built but switched off: byoc-v0.1.40
+validates observations strictly and doesn't know the fields, so it would
+reject every observation that carried them. They come in a later release, alongside the server release that accepts
+them.
+
+### Compatibility
+
+- Server: no minimum version. 1.5.0 reads both the money-budget shape the
+  proxy sends since the change that added `budget_code` and the older
+  `code: "BUDGET_HARD_CAP"` shape. Nothing new is sent to the server, so
+  byoc-v0.1.40 keeps accepting every request and observation.
+- `wrap()` at `govern`, `steer` or `route` without a tenant id throws
+  `MissingConfigError` (see above). Set `TENSORCOST_TENANT_ID`.
+- `shouldFallBackToProvider()` returns false for `TensorCostProviderError`
+  and for errors that aren't `TensorCost*` outages (1.4.0 returned true).
+- A relayed provider 4xx with an openai@4 client: in 1.4.0 the fail-open
+  retry crashed with the `defaultHeaders` TypeError above, so callers never
+  got `openai.BadRequestError` from it; with fail-open off they got
+  `TensorCostProxyError`. 1.5.0 throws the openai error type the client
+  builds, after one call.
+- A TensorCost 4xx that isn't an outage (a rejected key, a refusal with an
+  unknown code, a firewall page) now stops the call instead of going around
+  it.
+- `failOpenEnabled: false` now also fails the call when `/v1/admit` is down.
+- `AdmitResult.refusal` is set on every refusal, not only `RUN_STOPPED`, and
+  can be a `TensorCostGatewayRejectedError` or `TensorCostKeyRejectedError`.
+- Anthropic clients configured for steer/route make one `/v1/admit` call per
+  request instead of a proxy call.
+- `wrap()` no longer sets `baseURL`, `defaultHeaders`, `x-tc-provider-url` or
+  `x-tc-provider-auth` on the client. If you read those back, read your own
+  config instead.
+
+## 1.4.0 — 2026-10-25
+
+### Added
+
+**`TensorCostRunStoppedError`** — maps proxy `403` / `RUN_STOPPED` (an operator
+stopped the agent run). Carries `workflowId`, `stoppedBy`, `stoppedAt` and
+`reason`. Terminal: it never falls back to the provider, so a stopped run
+stays stopped. Before this, a stop surfaced as a generic provider error and
+applied mode's fail-open path would call the provider directly.
+
+### Fixed
+
+**Govern layer: a stopped run throws `TensorCostRunStoppedError`.** The proxy
+now refuses a stopped run on `/v1/admit` too. The OpenAI and Anthropic
+wrappers throw the stop with its detail instead of a generic "refused at
+govern layer" governance error, and never call the provider.
 
 ## 1.3.0 — 2026-09-26
 

package/README.md

@@ -2,7 +2,7 @@
 
 One-line wrapper for TensorCost — fire-and-forget LLM observability and optional inference control for OpenAI, Anthropic, AWS Bedrock, and Google Vertex AI clients in Node.js.
 
-**Current version:** 1.3.0 — period budgets + agent-run span linking (upgrade from 1.2.x if you use daily/monthly caps or Router · Agent runs). See [CHANGELOG](./CHANGELOG.md), [SDK compliance](https://github.com/vaadhlabs/tensorcost/blob/main/docs/features/sdk-compliance.md), and [Migrating from 0.x](#migrating-from-0x).
+**Current version:** 1.5.0 — fixes 1.4.0 routing around a money budget's hard cap when fail-open was on (the default); upgrade. See [CHANGELOG](./CHANGELOG.md), [SDK compliance](https://github.com/vaadhlabs/tensorcost/blob/main/docs/features/sdk-compliance.md), and [Migrating from 0.x](#migrating-from-0x).
 
 ## Install
 
@@ -32,6 +32,7 @@ import { wrap } from "@tensorcost/sdk";
 
 const client = wrap(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }), {
   apiKey: process.env.TENSORCOST_API_KEY,
+  tenantId: process.env.TENSORCOST_TENANT_ID,
 });
 
 const resp = await client.chat.completions.create({
@@ -48,6 +49,7 @@ import { wrap } from "@tensorcost/sdk";
 
 const client = wrap(new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY }), {
   apiKey: process.env.TENSORCOST_API_KEY,
+  tenantId: process.env.TENSORCOST_TENANT_ID,
 });
 
 await client.messages.create({
@@ -84,6 +86,7 @@ When routing is paused in the console, the published ceiling is capped at `gover
 ```ts
 const client = wrap(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }), {
   apiKey: process.env.TENSORCOST_API_KEY,
+  tenantId: process.env.TENSORCOST_TENANT_ID,
   maxLayer: "route",
   proxyUrl: process.env.TENSORCOST_PROXY_URL, // required for steer | route
 });
@@ -109,7 +112,7 @@ At `govern` and above, the SDK calls `POST /api/inference-proxy/v1/admit` with m
 - **204** + `x-tc-decision: layer=govern; action=allow` → proceed to the provider
 - **403** + `x-tc-decision: layer=govern; action=refuse; reason=…` → call blocked (budget, model governance, etc.)
 
-Admit is **fail-open** on transport errors: the provider call proceeds and an `admit_unavailable` observation is emitted when transport recovers. The admit HTTP call is capped at **500ms**.
+Admit is **fail-open** on outages only (network error, timeout, 5xx, or a 429 with no refusal body), and only while `failOpenEnabled` is on: the provider call proceeds and an `admit_unavailable` observation is emitted. Any other non-2xx refuses the call with a typed `TensorCostRefusedError`. The admit HTTP call is capped at **500ms**.
 
 ### Compliance profiles (1.2.0+)
 
@@ -144,12 +147,14 @@ import { prewarm, wrap } from "@tensorcost/sdk";
 
 await prewarm({
   apiKey: process.env.TENSORCOST_API_KEY,
+  tenantId: process.env.TENSORCOST_TENANT_ID,
   baseUrl: process.env.TENSORCOST_BASE_URL,
   maxLayer: "route",
 });
 
 export const client = wrap(new OpenAI({ apiKey: process.env.OPENAI_API_KEY }), {
   apiKey: process.env.TENSORCOST_API_KEY,
+  tenantId: process.env.TENSORCOST_TENANT_ID,
   maxLayer: "route",
   proxyUrl: process.env.TENSORCOST_PROXY_URL,
 });
@@ -184,7 +189,7 @@ Recommended rollout: **`observe` → `govern` → `route`**, raising the console
 | `TENSORCOST_API_KEY` | Long-lived SDK key from **Setup → Keys** | Yes |
 | `TENSORCOST_BASE_URL` | Backend base URL (admit, sdk-layer, token exchange) | No (default `https://api.tensorcost.com`) |
 | `TENSORCOST_PROXY_URL` | Inference-proxy base URL | Required when `maxLayer` is `steer` or `route` |
-| `TENSORCOST_TENANT_ID` | Explicit tenant id (multi-tenant tests) | No |
+| `TENSORCOST_TENANT_ID` | Your tenant id, shown in the console under **Developers › SDK setup**. The token exchange needs it: without it the SDK never reaches TensorCost | **Yes** (`wrap()` throws `MissingConfigError` at `govern` and above without it; `observe` warns once and sends nothing) |
 | `TENSORCOST_ENVIRONMENT` | Environment tag on every observation | No |
 | `TENSORCOST_CONNECTION_ID` | Provider-connection id for environment resolution | No |
 | `TENSORCOST_AGENT_ID` / `TENSORCOST_WORKFLOW_ID` | Agent-run attribution defaults | No |
@@ -240,13 +245,13 @@ const client = wrap(new OpenAI(...), {
 
 | Option | Default | `TensorCostTimeoutError.kind` | On timeout (steer/route) |
 |---|---|---|---|
-| `headersTimeoutMs` | 2s | `"headers"` | Streaming only (when SSE client ships); **not used for buffered JSON** |
+| `headersTimeoutMs` | 2s | `"headers"` | Streaming (`stream: true`) proxy calls; **not used for buffered JSON** |
 | `timeoutMs` | 60s | `"total"` | TTFB + body for non-streaming proxy calls; fail-open when `failOpenEnabled: true` |
-| `idleTimeoutMs` | 30s | `"idle"` | Reserved for future steer SSE client |
+| `idleTimeoutMs` | 30s | `"idle"` | Streaming proxy calls: no bytes for this long ends the stream |
 
 For **non-streaming** steer/route, the SDK waits up to **`timeoutMs` for response headers** because the proxy may buffer the full upstream response before sending headers — using a 2s headers cap would fail-open and **double-bill** while the proxy still completes.
 
-**Streaming (`stream: true`):** not implemented through the steer proxy client (1.1.1). With `failOpenEnabled: true` (default), calls go **direct** to the provider. With `failOpenEnabled: false`, `TensorCostConfigError` is thrown.
+**Streaming (`stream: true`):** OpenAI chat completions stream through the proxy at steer/route; the SDK reads the proxy's SSE and hands you the chunks. Before the stream starts, refusals and outages are handled like a buffered call (a refusal is terminal; an outage fails open when `failOpenEnabled` is on). Once bytes are flowing, an idle gap longer than `idleTimeoutMs` ends the stream with `TensorCostTimeoutError` (`"idle"`).
 
 ### Lifecycle hooks
 
@@ -283,6 +288,8 @@ import {
   TensorCostProxyError,
   TensorCostQuotaError,
   TensorCostProviderError,
+  TensorCostRefusedError, // base of every refusal below; unknown codes arrive as this
+  TensorCostBudgetHardCapError,
   TensorCostRunBudgetExceededError,
   TensorCostPeriodBudgetExceededError,
   TensorCostModelGovernanceDeniedError,
@@ -290,6 +297,10 @@ import {
 } from "@tensorcost/sdk";
 ```
 
+`TensorCostBudgetHardCapError` carries `budgetId`, `reason`, `retryable` (true for
+`reason: "spend_not_known_yet"`, a budget whose spend hasn't been counted yet) and
+`retryAfterSeconds`. The SDK doesn't retry it for you.
+
 Govern refusals and proxy decisions are also reflected in the `x-tc-decision` header and attached to observations as `decision_action` / `decision_reason` metadata when present.
 
 ### Period budgets (1.3.0+)
@@ -314,6 +325,7 @@ try {
 ```
 
 Per-run caps still raise `TensorCostRunBudgetExceededError` (`RUN_BUDGET_EXCEEDED`).
+A run an operator has stopped raises `TensorCostRunStoppedError` (`RUN_STOPPED`) with `stoppedBy`, `stoppedAt` and `reason`; like the cap errors it never fails open to the provider.
 
 ## Data grants (`maxGrants`)
 
@@ -372,13 +384,16 @@ an agent link still attributes by `agentId` / `workflowId` alone.
 
 ## Fail-open guarantee
 
-If TensorCost is slow, down, or misconfigured, your customer call still succeeds. Internal errors are swallowed and logged via `console.warn` (or your lifecycle hook). Exceptions:
+If TensorCost is slow or down, your customer call still succeeds. Internal errors are swallowed and logged via `console.warn` (or your lifecycle hook).
+
+Since 1.5.0 "down" is an allow-list: a call goes around TensorCost only on a network error, a timeout, a 5xx, or a 429 or 402 without a refusal body, and only with `failOpenEnabled` on. Everything else is an answer and reaches your code:
 
 - Missing `TENSORCOST_API_KEY` → `MissingConfigError` at `wrap()` time
+- Missing `TENSORCOST_TENANT_ID` when `maxLayer` is `govern`, `steer` or `route` → `MissingConfigError` at `wrap()` time (1.5.0)
 - Missing `proxyUrl` when `maxLayer` is `steer` or `route` → `TensorCostConfigError` at `wrap()` time
-- Govern **refusals** (403 from `/admit`) → call blocked by design
-- Steer **run-budget** refusals → not fail-opened
-- Steer **period-budget** refusals (`PERIOD_BUDGET_EXCEEDED`) → not fail-opened
+- Any TensorCost refusal (budget, hard cap, run stop, governance, guardrail, compliance, or a code this SDK version doesn't know) → a `TensorCostRefusedError` subclass, never retried, never fail-opened
+- A provider's own 4xx relayed by the proxy → the provider SDK's own error (`openai.BadRequestError` and so on), built by your client; `TensorCostProviderError` with `status` and `body` when the client can't build one
+- A 4xx that isn't JSON (a firewall page) → `TensorCostGatewayRejectedError`; a rejected TensorCost key → `TensorCostKeyRejectedError`
 
 ### Duplicate spend (honest)
 
@@ -430,17 +445,19 @@ Proxied requests include `x-tc-sdk-version`, `x-tc-sdk-capabilities`, and `x-tc-
 
 | Provider | Package | Layers | Operations |
 |---|---|---|---|
-| OpenAI | `openai` ≥ 4.x | observe → route | chat, completions, embeddings, responses |
-| Anthropic | `@anthropic-ai/sdk` | observe → route | messages |
+| OpenAI | `openai` ≥ 4.x | observe → route | `chat.completions` (observe, govern, steer/route, streaming); legacy `completions` (observed only) |
+| Anthropic | `@anthropic-ai/sdk` | observe, govern (steer/route run as govern) | `messages` |
 | Azure OpenAI | `openai` (`AzureOpenAI`) | observe → route | same as OpenAI (`provider: "openai"`) |
-| AWS Bedrock | `@aws-sdk/client-bedrock-runtime` | observe, govern only | InvokeModel, Converse (token placeholders) |
-| Google Vertex | `@google/genai` (`vertexai: true`) | observe, govern only | generateContent (token placeholders) |
+| AWS Bedrock | `@aws-sdk/client-bedrock-runtime` | observe (govern accepted, not enforced yet) | InvokeModel, Converse (token placeholders) |
+| Google Vertex | `@google/genai` (`vertexai: true`) | observe (govern accepted, not enforced yet) | generateContent (token placeholders) |
+
+Nothing else on the client is wrapped: `embeddings`, `responses` and the rest go straight to the provider and are not observed.
 
-**Steer/route streaming:** SDK routes `stream: true` **direct** to the provider (or errors if fail-open off). Proxy server supports SSE; SDK SSE client not shipped yet.
+**Steer/route streaming:** OpenAI `stream: true` chat completions go through the proxy's SSE (see Timeouts above). Anthropic streams go to Anthropic after the `/admit` check.
 
 Full matrix: [`docs/demo/data-path-one-pager.md`](https://github.com/vaadhlabs/tensorcost/blob/main/docs/demo/data-path-one-pager.md).
 
-**Bedrock and Vertex:** SigV4 / Vertex signing happens inside the AWS / Google SDK before the proxy can intercept — **`steer` and `route` are not supported**. Use `maxLayer: "govern"` or lower.
+**Bedrock and Vertex:** SigV4 / Vertex signing happens inside the AWS / Google SDK before the proxy can intercept — **`steer` and `route` are not supported**. `govern` is accepted but there is no `/admit` check for Bedrock or Vertex yet, so calls are observed only and stops, caps and budgets are not enforced; the SDK warns once when you set it.
 
 Bedrock peer dependency is optional:
 
@@ -450,6 +467,7 @@ import { wrap } from "@tensorcost/sdk";
 
 const client = wrap(new BedrockRuntimeClient({ region: "us-east-1" }), {
   apiKey: process.env.TENSORCOST_API_KEY,
+  tenantId: process.env.TENSORCOST_TENANT_ID,
 });
 ```
 
@@ -463,6 +481,7 @@ import { wrapLangChain } from "@tensorcost/sdk";
 
 const llm = wrapLangChain(new ChatOpenAI({ model: "gpt-4o-mini" }), {
   apiKey: process.env.TENSORCOST_API_KEY,
+  tenantId: process.env.TENSORCOST_TENANT_ID,
   maxLayer: "observe",
 });
 ```

package/dist/admit-client.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Govern-layer admit — metadata-only POST /api/inference-proxy/v1/admit.
+ *
+ * Fail-open only on an outage: network error, timeout, 5xx, or a 429 / 402
+ * with no refusal body. The customer's call then proceeds to the provider and
+ * an `admit_unavailable` observation is emitted when transport is set.
+ *
+ * Every other non-2xx is an answer, and the result carries it as
+ * `refusal`, a TensorCostRefusedError subclass the wrapper throws as is:
+ * RUN_STOPPED with its who / when / why, BUDGET_HARD_CAP as the budget
+ * error, a code this SDK doesn't know as a plain TensorCostRefusedError.
+ * /admit only answers 403 when a gate refused, so a 403 with no readable
+ * code is still a refusal. A 401/400/404 means admission could not be
+ * checked for this call; that is not an outage either, so it refuses too.
+ */
+import type { ControlLayer } from "./layer.js";
+import type { Operation, Provider } from "./types.js";
+import type { ObservationTransport } from "./transport.js";
+import { TensorCostGatewayRejectedError, TensorCostKeyRejectedError, TensorCostRefusedError } from "./errors.js";
+export interface AdmitMetadata {
+    provider: Provider;
+    model: string;
+    operation: Operation;
+    correlation_id: string;
+    environment?: string | null;
+    connection_id?: string | null;
+    agent_id?: string;
+    workflow_id?: string;
+    customer?: string;
+    feature?: string;
+    application?: string | null;
+    tags?: string[];
+    team_id?: string | null;
+}
+export interface AdmitRequestOptions {
+    baseUrl: string;
+    bearerToken: string;
+    maxLayer: ControlLayer;
+    metadata: AdmitMetadata;
+    transport?: ObservationTransport;
+    failOpen?: boolean;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}
+export interface AdmitResult {
+    allowed: boolean;
+    decisionHeader: string | null;
+    /**
+     * Set whenever `allowed` is false: the refusal, typed by its code, or a
+     * TensorCostGatewayRejectedError when something in front of TensorCost
+     * answered with a non-JSON 4xx.
+     */
+    refusal?: TensorCostRefusedError | TensorCostGatewayRejectedError | TensorCostKeyRejectedError;
+}
+export declare function admitRequest(opts: AdmitRequestOptions): Promise<AdmitResult>;
+//# sourceMappingURL=admit-client.d.ts.map

package/dist/admit-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admit-client.d.ts","sourceRoot":"","sources":["../src/admit-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAI3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,WAAW,CAAC,CA+DtB"}
+{"version":3,"file":"admit-client.d.ts","sourceRoot":"","sources":["../src/admit-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAI1B,sBAAsB,EAEvB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,sBAAsB,GAAG,8BAA8B,GAAG,0BAA0B,CAAC;CAChG;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,WAAW,CAAC,CAwFtB"}

package/dist/admit-client.js

@@ -1,11 +1,24 @@
 /**
  * Govern-layer admit — metadata-only POST /api/inference-proxy/v1/admit.
  *
- * Fail-open on transport failure: the customer's call proceeds to the
- * provider and an error observation is emitted when transport is available.
+ * Fail-open only on an outage: network error, timeout, 5xx, or a 429 / 402
+ * with no refusal body. The customer's call then proceeds to the provider and
+ * an `admit_unavailable` observation is emitted when transport is set.
+ *
+ * Every other non-2xx is an answer, and the result carries it as
+ * `refusal`, a TensorCostRefusedError subclass the wrapper throws as is:
+ * RUN_STOPPED with its who / when / why, BUDGET_HARD_CAP as the budget
+ * error, a code this SDK doesn't know as a plain TensorCostRefusedError.
+ * /admit only answers 403 when a gate refused, so a 403 with no readable
+ * code is still a refusal. A 401/400/404 means admission could not be
+ * checked for this call; that is not an outage either, so it refuses too.
  */
 import { ADMIT_PATH, ADMIT_TIMEOUT_MS } from "./layer.js";
 import { SDK_VERSION, sdkCapabilityHeader } from "./version.js";
+import { TensorCostGatewayRejectedError, TensorCostKeyRejectedError, TensorCostNetworkError, TensorCostProxyError, TensorCostQuotaError, TensorCostRefusedError, TensorCostTimeoutError, } from "./errors.js";
+import { retryAfterMs } from "./retry.js";
+import { decisionSaysRefuse, parseRefusalBody, refusalError } from "./refusal.js";
+import { observationScope } from "./wrap-overhead.js";
 export async function admitRequest(opts) {
     const fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
     const url = `${opts.baseUrl.replace(/\/+$/, "")}${ADMIT_PATH}`;
@@ -36,18 +49,38 @@ export async function admitRequest(opts) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? ADMIT_TIMEOUT_MS);
     try {
-        const resp = await fetchImpl(url, {
-            method: "POST",
-            headers,
-            body: JSON.stringify(body),
-            signal: controller.signal,
-        });
+        let resp;
+        try {
+            resp = await fetchImpl(url, {
+                method: "POST",
+                headers,
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            const e = err;
+            throw e?.name === "AbortError" || e?.name === "TimeoutError"
+                ? new TensorCostTimeoutError(`tensorcost: admit timed out after ${opts.timeoutMs ?? ADMIT_TIMEOUT_MS}ms`, "total", { cause: e })
+                : new TensorCostNetworkError(`tensorcost: network error reaching admit: ${e?.message ?? String(err)}`, { cause: e });
+        }
         const decisionHeader = resp.headers.get("x-tc-decision");
-        if (resp.status === 403) {
-            return { allowed: false, decisionHeader };
+        const requestId = resp.headers.get("x-tc-request-id");
+        if (resp.status >= 400 && resp.status < 500) {
+            const refusal = await refusalFrom4xx(resp, decisionHeader);
+            if (refusal)
+                return { allowed: false, decisionHeader, refusal };
+            // Only a bare 429 or 402 gets here.
+            throw new TensorCostQuotaError(`admit POST failed status=${resp.status}`, retryAfterMs(resp) ?? null, {
+                status: resp.status,
+                requestId,
+            });
         }
         if (!resp.ok) {
-            throw new Error(`admit POST failed status=${resp.status}`);
+            throw new TensorCostProxyError(`admit POST failed status=${resp.status}`, {
+                status: resp.status,
+                requestId,
+            });
         }
         return { allowed: true, decisionHeader };
     }
@@ -62,6 +95,54 @@ export async function admitRequest(opts) {
         clearTimeout(timer);
     }
 }
+/**
+ * The refusal in a 4xx from /admit, or undefined for the one 4xx that is
+ * an outage: a 429 (the tenant throttler) or 402 (plan ceiling) with no
+ * refusal body.
+ */
+async function refusalFrom4xx(resp, decisionHeader) {
+    const text = await resp.text().catch(() => "");
+    const parsed = parseRefusalBody(text);
+    if (parsed === null &&
+        (resp.status === 429 || resp.status === 402) &&
+        !decisionSaysRefuse(decisionHeader)) {
+        return undefined;
+    }
+    const ctx = {
+        status: resp.status,
+        requestId: resp.headers.get("x-tc-request-id"),
+        attempt: 1,
+        retryAfterHeader: resp.headers.get("retry-after"),
+    };
+    if (parsed !== null)
+        return refusalError(parsed, ctx);
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        body = undefined;
+    }
+    if (body === undefined || body === null || typeof body !== "object") {
+        if (decisionSaysRefuse(decisionHeader))
+            return refusalError(null, ctx);
+        // HTML or nothing: something in front of TensorCost said no.
+        return new TensorCostGatewayRejectedError(resp.status, text ? text.slice(0, 500) : null, {
+            requestId: ctx.requestId,
+        });
+    }
+    if (resp.status === 403)
+        return refusalError(null, ctx);
+    if (resp.status === 401) {
+        // /admit rejected the TensorCost token.
+        return new TensorCostKeyRejectedError(401, { requestId: ctx.requestId });
+    }
+    const rec = body;
+    const message = typeof rec["message"] === "string" ? rec["message"] : null;
+    return new TensorCostRefusedError(`tensorcost: admission check returned ${resp.status}` +
+        (message ? ` (${message})` : "") +
+        "; the call was not sent", { code: null }, { status: resp.status, requestId: ctx.requestId, attempt: 1 });
+}
 function postAdmitFailureObservation(opts, err) {
     if (!opts.transport)
         return;
@@ -81,6 +162,7 @@ function postAdmitFailureObservation(opts, err) {
             correlation_id: opts.metadata.correlation_id,
             ...(opts.metadata.environment ? { environment: opts.metadata.environment } : {}),
             ...(opts.metadata.connection_id ? { connection_id: opts.metadata.connection_id } : {}),
+            ...observationScope(opts.metadata.application, opts.metadata.tags),
             metadata: {
                 decision_action: "allow",
                 decision_reason: "admit_unavailable",

package/dist/admit-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"admit-client.js","sourceRoot":"","sources":["../src/admit-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAkChE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;QAC3C,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,WAAW;QAC/B,uBAAuB,EAAE,mBAAmB,EAAE;QAC9C,gBAAgB,EAAE,IAAI,CAAC,QAAQ;KAChC,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,SAAS,IAAI,gBAAgB,CACnC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,2BAA2B,CAAC,IAAI,EAAE,GAAY,CAAC,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAyB,EACzB,GAAU;IAEV,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAClB,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;YAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,QAAQ,EAAE;gBACR,eAAe,EAAE,OAAO;gBACxB,eAAe,EAAE,mBAAmB;aACrC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"admit-client.js","sourceRoot":"","sources":["../src/admit-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAwCtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;QAC3C,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,WAAW;QAC/B,uBAAuB,EAAE,mBAAmB,EAAE;QAC9C,gBAAgB,EAAE,IAAI,CAAC,QAAQ;KAChC,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,SAAS,IAAI,gBAAgB,CACnC,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBAC1B,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAY,CAAC;YACvB,MAAM,CAAC,EAAE,IAAI,KAAK,YAAY,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc;gBAC1D,CAAC,CAAC,IAAI,sBAAsB,CACxB,qCAAqC,IAAI,CAAC,SAAS,IAAI,gBAAgB,IAAI,EAC3E,OAAO,EACP,EAAE,KAAK,EAAE,CAAC,EAAE,CACb;gBACH,CAAC,CAAC,IAAI,sBAAsB,CACxB,6CAA6C,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EACxE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACR,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAEtD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC3D,IAAI,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;YAChE,oCAAoC;YACpC,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE;gBACpG,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,IAAI,CAAC,MAAM,EAAE,EAAE;gBACxE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,2BAA2B,CAAC,IAAI,EAAE,GAAY,CAAC,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAc,EACd,cAA6B;IAI7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IACE,MAAM,KAAK,IAAI;QACf,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;QAC5C,CAAC,kBAAkB,CAAC,cAAc,CAAC,EACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,OAAO,EAAE,CAAC;QACV,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;KAClD,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,IAAI,kBAAkB,CAAC,cAAc,CAAC;YAAE,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvE,6DAA6D;QAC7D,OAAO,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACvF,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,wCAAwC;QACxC,OAAO,IAAI,0BAA0B,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,OAAO,IAAI,sBAAsB,CAC/B,wCAAwC,IAAI,CAAC,MAAM,EAAE;QACnD,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,yBAAyB,EAC3B,EAAE,IAAI,EAAE,IAAI,EAAE,EACd,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAyB,EACzB,GAAU;IAEV,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAClB,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;YAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClE,QAAQ,EAAE;gBACR,eAAe,EAAE,OAAO;gBACxB,eAAe,EAAE,mBAAmB;aACrC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC"}