@acarmisc/backstage-plugin-litellm-backend 0.11.1 → 0.13.0

package/dist/index.d.ts

@@ -7,6 +7,8 @@ export { resolveUserId, resolveUserProfile, toLiteLLMUserId, getOrProvisionUser,
 export type { BackstageUserProfile } from './provisioning';
 export { readTeamAdminConfig, isTeamManagementEnabled, assertTeamAdmin, validateTeamWriteInput, validateTeamPatchInput, } from './teamAdmin';
 export type { TeamAdminConfig, TeamAdminCheck, TeamWriteInput, TeamWriteValidation, TeamPatchValidation } from './teamAdmin';
+export { readTeamBudgetVisibility, redactTeamBudget, redactTeamUsage, teamBudgetStatusFor, } from './teamBudgetVisibility';
+export type { TeamBudgetVisibility, TeamBudgetStatus } from './teamBudgetVisibility';
 export { KeycloakJWTVerifier, newDefaultVerifier, readBridgeConfig, resolveBridgeUserId, getOrProvisionUserFromClaims, bridgeListKeys, bridgeGenerateKey, } from './bridge';
 export type { BridgeClaims, TokenVerifier, BridgeConfig, KeycloakJWTVerifierOptions, } from './bridge';
 export { litellmPermissions, litellmKeyCreatePermission, litellmKeyRevokePermission, litellmKeyManagePermission, litellmAuditReadPermission, litellmTeamCreatePermission, litellmTeamManagePermission, litellmTeamMembersManagePermission, litellmTeamKnowledgebaseManagePermission, litellmTeamMcpManagePermission, litellmTeamDeletePermission, } from './permissions';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeGenerateKey = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
+exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeGenerateKey = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.teamBudgetStatusFor = exports.redactTeamUsage = exports.redactTeamBudget = exports.readTeamBudgetVisibility = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
 var plugin_1 = require("./plugin");
 Object.defineProperty(exports, "litellmPlugin", { enumerable: true, get: function () { return plugin_1.litellmPlugin; } });
 var plugin_2 = require("./plugin");
@@ -41,6 +41,11 @@ Object.defineProperty(exports, "isTeamManagementEnabled", { enumerable: true, ge
 Object.defineProperty(exports, "assertTeamAdmin", { enumerable: true, get: function () { return teamAdmin_1.assertTeamAdmin; } });
 Object.defineProperty(exports, "validateTeamWriteInput", { enumerable: true, get: function () { return teamAdmin_1.validateTeamWriteInput; } });
 Object.defineProperty(exports, "validateTeamPatchInput", { enumerable: true, get: function () { return teamAdmin_1.validateTeamPatchInput; } });
+var teamBudgetVisibility_1 = require("./teamBudgetVisibility");
+Object.defineProperty(exports, "readTeamBudgetVisibility", { enumerable: true, get: function () { return teamBudgetVisibility_1.readTeamBudgetVisibility; } });
+Object.defineProperty(exports, "redactTeamBudget", { enumerable: true, get: function () { return teamBudgetVisibility_1.redactTeamBudget; } });
+Object.defineProperty(exports, "redactTeamUsage", { enumerable: true, get: function () { return teamBudgetVisibility_1.redactTeamUsage; } });
+Object.defineProperty(exports, "teamBudgetStatusFor", { enumerable: true, get: function () { return teamBudgetVisibility_1.teamBudgetStatusFor; } });
 var bridge_1 = require("./bridge");
 Object.defineProperty(exports, "KeycloakJWTVerifier", { enumerable: true, get: function () { return bridge_1.KeycloakJWTVerifier; } });
 Object.defineProperty(exports, "newDefaultVerifier", { enumerable: true, get: function () { return bridge_1.newDefaultVerifier; } });

package/dist/openapi.js

@@ -66,6 +66,10 @@ exports.openApiSpec = {
                                                 allowUnlimitedBudget: { type: 'boolean' },
                                                 teamRequired: { type: 'boolean' },
                                             } },
+                                        display: { type: 'object', properties: {
+                                                hideTeamBudgetForMembers: { type: 'boolean' },
+                                                hideTeamBudgetForManagers: { type: 'boolean' },
+                                            } },
                                     } } } },
                     },
                 },
@@ -169,6 +173,9 @@ exports.openApiSpec = {
             get: {
                 tags: ['Teams'],
                 summary: 'List teams the current user belongs to',
+                description: 'When litellm.display.hideTeamBudgetForMembers is set, max_budget/spend ' +
+                    'are stripped and budget_pct/budget_status/budget_hidden carry the ' +
+                    'consumption level instead.',
                 responses: { '200': { description: 'Array of teams' } },
             },
         },
@@ -176,6 +183,8 @@ exports.openApiSpec = {
             get: {
                 tags: ['Teams'],
                 summary: 'Usage metrics for a team',
+                description: 'Spend fields are zeroed when the caller is subject to team budget ' +
+                    'hiding (member or manager flag, whichever applies to them).',
                 parameters: [
                     { name: 'teamId', in: 'path', required: true, schema: { type: 'string' } },
                     { name: 'start_date', in: 'query', required: true, schema: { type: 'string' } },

package/dist/router.js

@@ -45,6 +45,7 @@ Object.defineProperty(exports, "ProvisioningError", { enumerable: true, get: fun
 const bridge_1 = require("./bridge");
 const permissions_1 = require("./permissions");
 const teamAdmin_1 = require("./teamAdmin");
+const teamBudgetVisibility_1 = require("./teamBudgetVisibility");
 const teamCreateInFlight = new Map();
 /** Backoff schedule for `withTeamFetchRetry` — 3 retries over ~1.3s total. */
 const TEAM_FETCH_RETRY_DELAYS_MS = [100, 300, 900];
@@ -102,6 +103,7 @@ async function createRouter(options) {
     const teamMgmtEnabled = (0, teamAdmin_1.isTeamManagementEnabled)(config);
     const objectPermsEnabled = (0, teamAdmin_1.isObjectPermissionsEnabled)(config);
     const teamAdminCfg = (0, teamAdmin_1.readTeamAdminConfig)(config);
+    const teamBudgetVisibility = (0, teamBudgetVisibility_1.readTeamBudgetVisibility)(config);
     const catalogClient = options.catalogClient ?? new catalog_client_1.CatalogClient({ discoveryApi: discovery });
     if (provisioningEnabled) {
         logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length
@@ -111,6 +113,10 @@ async function createRouter(options) {
     if (config.getOptional('litellm.teamAdmin') && !teamMgmtEnabled) {
         logger.warn('litellm.teamAdmin is configured but team management is disabled — set permission.enabled: true and litellm.teamAdmin.group to enable it.');
     }
+    if (teamBudgetVisibility.hideTeamBudgetForMembers ||
+        teamBudgetVisibility.hideTeamBudgetForManagers) {
+        logger.info(`LiteLLM team budget hiding enabled — members: ${teamBudgetVisibility.hideTeamBudgetForMembers}, managers: ${teamBudgetVisibility.hideTeamBudgetForManagers}`);
+    }
     const router = (0, express_1.Router)();
     // JSON body parser. Without this, every POST/PUT endpoint sees an empty
     // req.body. Backstage's httpRouter does not apply a body parser at the
@@ -131,6 +137,10 @@ async function createRouter(options) {
                 allowUnlimitedBudget: teamAdminCfg.allowUnlimitedBudget,
                 objectPermissionsEnabled: objectPermsEnabled,
             },
+            display: {
+                hideTeamBudgetForMembers: teamBudgetVisibility.hideTeamBudgetForMembers,
+                hideTeamBudgetForManagers: teamBudgetVisibility.hideTeamBudgetForManagers,
+            },
         });
     });
     // Self-hosted OpenAPI 3.1 contract — lets integrators read a spec instead
@@ -552,7 +562,12 @@ async function createRouter(options) {
                 logger.warn(`Failed to fetch team ${teamId} after retries: ${err.message}`);
                 return null;
             })));
-            res.json(teams.filter(Boolean));
+            const list = teams.filter(Boolean);
+            // Member surface: strip dollar amounts when the operator hides them
+            // from members. Managers who need the numbers use /teams/managed.
+            res.json(teamBudgetVisibility.hideTeamBudgetForMembers
+                ? list.map(teamBudgetVisibility_1.redactTeamBudget)
+                : list);
         }
         catch (error) {
             if (error instanceof provisioning_1.ProvisioningError) {
@@ -656,7 +671,10 @@ async function createRouter(options) {
         teamCreateInFlight.set(key, createPromise);
         try {
             const result = await createPromise;
-            res.json(result);
+            // Manager surface: redact dollars when hidden even from managers.
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(result)
+                : result);
         }
         catch (err) {
             sendTeamError(err, res);
@@ -704,7 +722,9 @@ async function createRouter(options) {
                 teamId,
                 owningGroup,
             });
-            res.json(r);
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(r)
+                : r);
         }
         catch (err) {
             sendTeamError(err, res);
@@ -772,7 +792,10 @@ async function createRouter(options) {
             // the caller's group set and filter with includes().
             const owned = all.filter(t => typeof t.metadata?.owning_group === 'string' &&
                 t.metadata.owning_group === teamAdminCfg.group);
-            res.json(owned);
+            // Manager surface: strip dollar amounts when hidden even from managers.
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? owned.map(teamBudgetVisibility_1.redactTeamBudget)
+                : owned);
         }
         catch (err) {
             sendTeamError(err, res);
@@ -924,7 +947,9 @@ async function createRouter(options) {
                 owningGroup,
             });
             const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-            res.json(updated);
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
+                : updated);
         }
         catch (err) {
             sendTeamError(err, res);
@@ -959,7 +984,9 @@ async function createRouter(options) {
                 owningGroup,
             });
             const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-            res.json(updated);
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
+                : updated);
         }
         catch (err) {
             sendTeamError(err, res);
@@ -1047,7 +1074,9 @@ async function createRouter(options) {
                 owningGroup,
                 vector_stores: requested,
             });
-            res.json(updated);
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
+                : updated);
         }
         catch (err) {
             sendTeamError(err, res);
@@ -1136,7 +1165,9 @@ async function createRouter(options) {
                 before,
                 after: requested,
             });
-            res.json(updated);
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
+                : updated);
         }
         catch (err) {
             sendTeamError(err, res);
@@ -1151,7 +1182,26 @@ async function createRouter(options) {
                 return;
             }
             const usage = await client.getTeamUsage(teamId, start_date, end_date);
-            res.json(usage);
+            // Spend figures would let a client derive a hidden budget
+            // (budget = spend / pct), so they follow the same hiding flags.
+            // Which flag applies depends on whether the caller is a team manager;
+            // catalog failures fail closed to the member rule.
+            let hide = teamBudgetVisibility.hideTeamBudgetForMembers;
+            if (teamAdminCfg.group) {
+                try {
+                    const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+                    const isManager = !!tokenEntityRef &&
+                        (await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, teamAdminCfg.group, catalogClient, auth, logger));
+                    hide = isManager
+                        ? teamBudgetVisibility.hideTeamBudgetForManagers
+                        : teamBudgetVisibility.hideTeamBudgetForMembers;
+                }
+                catch (err) {
+                    logger.warn(`Team-manager check failed, hiding team spend: ${err.message}`);
+                    hide = teamBudgetVisibility.hideTeamBudgetForMembers;
+                }
+            }
+            res.json(hide ? (0, teamBudgetVisibility_1.redactTeamUsage)(usage) : usage);
         }
         catch (error) {
             logger.error('Failed to fetch team usage', error);

package/dist/teamBudgetVisibility.d.ts

@@ -0,0 +1,48 @@
+import { Config } from '@backstage/config';
+import { TeamInfo, UsageMetrics } from './types';
+/**
+ * Independent "hide team budget" switches for the two team audiences.
+ *
+ * - `hideTeamBudgetForMembers` redacts dollar amounts on the member surface:
+ *   `GET /teams`, the Teams cards, and the `TEAM` section of the budget widget.
+ *   Members still see the consumption level (percent of cap + ok/near/over
+ *   status + reset window).
+ * - `hideTeamBudgetForManagers` does the same on the manager surface:
+ *   `GET /teams/managed`, team write responses, and the ManageTeamDialog
+ *   budget field (which becomes write-only).
+ *
+ * Both default to false (current behavior: dollars visible). Splitting them
+ * lets an operator hide real budgets from regular members while team managers
+ * keep the numbers they need to govern — or hide from both.
+ */
+export interface TeamBudgetVisibility {
+    hideTeamBudgetForMembers: boolean;
+    hideTeamBudgetForManagers: boolean;
+}
+/**
+ * Consumption status derived from spend vs. cap. Mirrors the frontend
+ * `budgetTone` thresholds (80% near, 100% over) so both sides agree.
+ */
+export type TeamBudgetStatus = 'ok' | 'near' | 'over';
+export declare function teamBudgetStatusFor(spend: number, budget: number): TeamBudgetStatus;
+export declare function readTeamBudgetVisibility(config: Config): TeamBudgetVisibility;
+/**
+ * Strips dollar amounts from a team record while preserving the consumption
+ * signal. `max_budget` is dropped, `spend` is zeroed (the field is required
+ * downstream, so it cannot be omitted — `budget_hidden: true` marks the
+ * record as redacted), and `budget_pct` + `budget_status` carry the level of
+ * consumption. `budget_duration`, models, members, and rate limits are kept:
+ * none of them reveal dollars.
+ *
+ * Teams without a positive budget (unlimited) carry no dollars to hide and
+ * are returned untouched.
+ */
+export declare function redactTeamBudget(team: TeamInfo): TeamInfo;
+/**
+ * Strips dollar amounts from team usage metrics while keeping the
+ * non-monetary signal (tokens, requests). Returning zeroed spend (rather
+ * than omitting the fields) keeps the response shape stable for existing
+ * clients; the frontend hides spend charts whenever the owning team record
+ * is redacted.
+ */
+export declare function redactTeamUsage(usage: UsageMetrics): UsageMetrics;

package/dist/teamBudgetVisibility.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.teamBudgetStatusFor = teamBudgetStatusFor;
+exports.readTeamBudgetVisibility = readTeamBudgetVisibility;
+exports.redactTeamBudget = redactTeamBudget;
+exports.redactTeamUsage = redactTeamUsage;
+function teamBudgetStatusFor(spend, budget) {
+    if (budget > 0 && spend >= budget)
+        return 'over';
+    if (budget > 0 && spend >= budget * 0.8)
+        return 'near';
+    return 'ok';
+}
+function readTeamBudgetVisibility(config) {
+    return {
+        hideTeamBudgetForMembers: config.getOptionalBoolean('litellm.display.hideTeamBudgetForMembers') ?? false,
+        hideTeamBudgetForManagers: config.getOptionalBoolean('litellm.display.hideTeamBudgetForManagers') ?? false,
+    };
+}
+/**
+ * Strips dollar amounts from a team record while preserving the consumption
+ * signal. `max_budget` is dropped, `spend` is zeroed (the field is required
+ * downstream, so it cannot be omitted — `budget_hidden: true` marks the
+ * record as redacted), and `budget_pct` + `budget_status` carry the level of
+ * consumption. `budget_duration`, models, members, and rate limits are kept:
+ * none of them reveal dollars.
+ *
+ * Teams without a positive budget (unlimited) carry no dollars to hide and
+ * are returned untouched.
+ */
+function redactTeamBudget(team) {
+    const budget = team.max_budget ?? 0;
+    if (budget <= 0)
+        return team;
+    const spend = team.spend ?? 0;
+    const pct = Math.min(100, Math.max(0, (spend / budget) * 100));
+    const { max_budget: _dropped, ...rest } = team;
+    return {
+        ...rest,
+        spend: 0,
+        budget_pct: pct,
+        budget_status: teamBudgetStatusFor(spend, budget),
+        budget_hidden: true,
+    };
+}
+/**
+ * Strips dollar amounts from team usage metrics while keeping the
+ * non-monetary signal (tokens, requests). Returning zeroed spend (rather
+ * than omitting the fields) keeps the response shape stable for existing
+ * clients; the frontend hides spend charts whenever the owning team record
+ * is redacted.
+ */
+function redactTeamUsage(usage) {
+    const zeroSpend = (p) => ({
+        ...p,
+        spend: 0,
+    });
+    const zeroTotalSpend = (p) => ({
+        ...p,
+        total_spend: 0,
+    });
+    return {
+        ...usage,
+        total_spend: 0,
+        usage_by_model: Object.fromEntries(Object.entries(usage.usage_by_model ?? {}).map(([k, v]) => [
+            k,
+            zeroTotalSpend(v),
+        ])),
+        usage_by_key: Object.fromEntries(Object.entries(usage.usage_by_key ?? {}).map(([k, v]) => [
+            k,
+            zeroTotalSpend(v),
+        ])),
+        daily_usage: (usage.daily_usage ?? []).map(zeroSpend),
+        daily_by_model: (usage.daily_by_model ?? []).map(zeroSpend),
+    };
+}

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  user_email?: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamObjectPermission {\n  /** Vector store ids/names attached to the team. */\n  vector_stores?: string[];\n  /** MCP server ids/names attached to the team. */\n  mcp_servers?: string[];\n  /** MCP access group names attached to the team. */\n  mcp_access_groups?: string[];\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  /** Arbitrary metadata stored on the team record. */\n  metadata?: Record<string, unknown>;\n  /** Knowledge bases (vector stores) and MCP servers attached to the team. */\n  object_permission?: TeamObjectPermission;\n  /** Whether the team is blocked/deactivated. */\n  blocked?: boolean;\n  /** Max budget available to individual team members (if set per-member). */\n  team_member_budget?: number;\n}\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: TeamObjectPermission;\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\nexport interface CreateTeamResponse {\n  team_id: string;\n  team_alias?: string;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n  max_input_tokens?: number;\n  max_output_tokens?: number;\n  /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */\n  access_groups?: string[];\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  user_email?: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamObjectPermission {\n  /** Vector store ids/names attached to the team. */\n  vector_stores?: string[];\n  /** MCP server ids/names attached to the team. */\n  mcp_servers?: string[];\n  /** MCP access group names attached to the team. */\n  mcp_access_groups?: string[];\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  spend: number;\n  /**\n   * Share of max_budget consumed (0-100), present only on redacted records.\n   * Set by the backend when litellm.display.hideTeamBudgetFor* is enabled so\n   * clients can render the consumption level without dollar amounts.\n   */\n  budget_pct?: number;\n  /** ok | near (>=80%) | over (>=100%), present only on redacted records. */\n  budget_status?: 'ok' | 'near' | 'over';\n  /** True when max_budget/spend were stripped by budget hiding. */\n  budget_hidden?: boolean;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  /** Arbitrary metadata stored on the team record. */\n  metadata?: Record<string, unknown>;\n  /** Knowledge bases (vector stores) and MCP servers attached to the team. */\n  object_permission?: TeamObjectPermission;\n  /** Whether the team is blocked/deactivated. */\n  blocked?: boolean;\n  /** Max budget available to individual team members (if set per-member). */\n  team_member_budget?: number;\n}\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: TeamObjectPermission;\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\nexport interface CreateTeamResponse {\n  team_id: string;\n  team_alias?: string;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n  max_input_tokens?: number;\n  max_output_tokens?: number;\n  /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */\n  access_groups?: string[];\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -9,6 +9,8 @@ export interface UserInfo {
     current_spend?: number;
     soft_limit?: number;
     hard_limit?: number;
+    /** Spend-reset period for max_budget, e.g. "30d". */
+    budget_duration?: string;
     /** Backstage-computed: true when the user is a member of litellm.audit.group */
     can_view_audit?: boolean;
 }
@@ -32,6 +34,16 @@ export interface TeamInfo {
     /** Spend-reset period for max_budget, e.g. "30d". */
     budget_duration?: string;
     spend: number;
+    /**
+     * Share of max_budget consumed (0-100), present only on redacted records.
+     * Set by the backend when litellm.display.hideTeamBudgetFor* is enabled so
+     * clients can render the consumption level without dollar amounts.
+     */
+    budget_pct?: number;
+    /** ok | near (>=80%) | over (>=100%), present only on redacted records. */
+    budget_status?: 'ok' | 'near' | 'over';
+    /** True when max_budget/spend were stripped by budget hiding. */
+    budget_hidden?: boolean;
     members_with_roles?: TeamMember[];
     models?: string[];
     tpm_limit?: number;
@@ -71,6 +83,7 @@ export interface VirtualKey {
     expires_at?: string;
     spend: number;
     max_budget?: number;
+    budget_duration?: string;
     tpm_limit?: number;
     rpm_limit?: number;
     models?: string[];
@@ -93,6 +106,7 @@ export interface LiteLLMUserKey {
     tpm_limit?: number | null;
     rpm_limit?: number | null;
     max_budget?: number | null;
+    budget_duration?: string | null;
     user_id?: string | null;
     team_id?: string | null;
     created_at: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.11.1",
+  "version": "0.13.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",