@acarmisc/backstage-plugin-litellm-backend 0.12.0 → 0.14.0

package/config.d.ts

@@ -248,6 +248,34 @@ export interface Config {
       };
     };
 
+    /**
+     * Display controls for team budget amounts in the frontend.
+     * Each flag independently hides real dollar budgets while the backend
+     * still exposes the consumption level (percent of cap + ok/near/over
+     * status + reset window). Enforcement is server-side: the backend
+     * redacts max_budget/spend from the corresponding endpoints, so the
+     * dollars are not merely hidden in CSS.
+     */
+    display?: {
+      /**
+       * Hide dollar budgets from regular team members (GET /teams, Teams
+       * cards, TEAM section of the budget widget). Team managers still see
+       * dollars unless hideTeamBudgetForManagers is also set.
+       * @default false
+       * @visibility frontend
+       */
+      hideTeamBudgetForMembers?: boolean;
+
+      /**
+       * Hide dollar budgets even from team managers (GET /teams/managed,
+       * team write responses, ManageTeamDialog budget field which becomes
+       * write-only). Useful when budgets are finance-sensitive.
+       * @default false
+       * @visibility frontend
+       */
+      hideTeamBudgetForManagers?: boolean;
+    };
+
     bridge?: {
       /**
        * When true, mount the /bridge/keys, /bridge/keys (POST), /bridge/models

package/dist/client.d.ts

@@ -1,4 +1,10 @@
-import { LiteLLMConfig, UserInfo, VirtualKey, ModelInfo, UsageMetrics, TeamInfo, GenerateKeyRequest, GenerateKeyResponse, UpdateKeyRequest, DeleteKeyRequest, CreateUserRequest, CreateUserResponse, CreateTeamRequest, CreateTeamResponse, UpdateTeamRequest, AuditLogsParams, PaginatedAuditLogs } from './types';
+import { LiteLLMConfig, UserInfo, VirtualKey, ModelInfo, UsageMetrics, TeamInfo, GenerateKeyRequest, GenerateKeyResponse, UpdateKeyRequest, DeleteKeyRequest, CreateUserRequest, CreateUserResponse, CreateTeamRequest, CreateTeamResponse, UpdateTeamRequest, AuditLogsParams, PaginatedAuditLogs, SpendLogEntry, SpendLogsParams } from './types';
+/**
+ * LiteLLM versions differ on `request_tags`: an array of `k:v` strings in
+ * current builds, but historically an object map. Normalise both to a flat
+ * string array so callers can `includes('session:...')` uniformly.
+ */
+export declare function normalizeRequestTags(tags: SpendLogEntry['request_tags']): string[];
 /**
  * Typed error for failed upstream LiteLLM responses. Preserves the HTTP
  * status and the structured `param` (e.g. `key_alias`) from the upstream
@@ -149,6 +155,17 @@ export declare class LiteLLMClient {
         name?: string;
         url?: string;
     }>>;
+    /**
+     * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
+     * by date range and optionally by key/user/team. Rows are normalised so
+     * `request_tags` is always a `string[]` (LiteLLM returns either an array
+     * or an object depending on version) — callers group by tag to attribute
+     * spend to a conversation or caller.
+     *
+     * This is the admin/DB-backed endpoint: it can return a large number of
+     * rows, so callers should keep the date window tight and cap `page_size`.
+     */
+    getSpendLogs(params: SpendLogsParams): Promise<SpendLogEntry[]>;
     private emptyUsage;
     /**
      * Transforms LiteLLM's SpendAnalyticsPaginatedResponse into the flatter

package/dist/client.js

@@ -1,7 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LiteLLMClient = exports.LiteLLMUpstreamError = void 0;
+exports.normalizeRequestTags = normalizeRequestTags;
 const DEFAULT_TIMEOUT = 30000;
+/**
+ * LiteLLM versions differ on `request_tags`: an array of `k:v` strings in
+ * current builds, but historically an object map. Normalise both to a flat
+ * string array so callers can `includes('session:...')` uniformly.
+ */
+function normalizeRequestTags(tags) {
+    if (!tags)
+        return [];
+    if (Array.isArray(tags))
+        return tags.filter((t) => typeof t === 'string');
+    return Object.entries(tags).map(([k, v]) => `${k}:${v}`);
+}
 /**
  * Typed error for failed upstream LiteLLM responses. Preserves the HTTP
  * status and the structured `param` (e.g. `key_alias`) from the upstream
@@ -451,6 +464,47 @@ class LiteLLMClient {
         }))
             .filter(r => r.id);
     }
+    /**
+     * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
+     * by date range and optionally by key/user/team. Rows are normalised so
+     * `request_tags` is always a `string[]` (LiteLLM returns either an array
+     * or an object depending on version) — callers group by tag to attribute
+     * spend to a conversation or caller.
+     *
+     * This is the admin/DB-backed endpoint: it can return a large number of
+     * rows, so callers should keep the date window tight and cap `page_size`.
+     */
+    async getSpendLogs(params) {
+        const query = new URLSearchParams({
+            start_date: params.start_date,
+            end_date: params.end_date,
+        });
+        if (params.api_key)
+            query.append('api_key', params.api_key);
+        if (params.user_id)
+            query.append('user_id', params.user_id);
+        if (params.team_id)
+            query.append('team_id', params.team_id);
+        if (params.page_size)
+            query.append('page_size', String(params.page_size));
+        const raw = await this.request(`/spend/logs?${query.toString()}`);
+        const rows = Array.isArray(raw) ? raw : raw?.data ?? [];
+        return rows.map(row => ({
+            request_id: row?.request_id,
+            startTime: row?.startTime ?? row?.start_time,
+            endTime: row?.endTime ?? row?.end_time,
+            spend: row?.spend ?? 0,
+            total_tokens: row?.total_tokens ?? 0,
+            prompt_tokens: row?.prompt_tokens ?? 0,
+            completion_tokens: row?.completion_tokens ?? 0,
+            model: row?.model,
+            api_key: row?.api_key,
+            user: row?.user,
+            team_id: row?.team_id,
+            request_tags: normalizeRequestTags(row?.request_tags),
+            metadata: row?.metadata,
+        }));
+    }
     emptyUsage() {
         return {
             total_spend: 0,

package/dist/index.cjs.js

@@ -7997,15 +7997,20 @@ __export(index_exports, {
   litellmTeamMcpManagePermission: () => litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission: () => litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
+  normalizeRequestTags: () => normalizeRequestTags,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
   readProvisioningDefaults: () => readProvisioningDefaults,
   readRoleConfigs: () => readRoleConfigs,
   readTeamAdminConfig: () => readTeamAdminConfig,
+  readTeamBudgetVisibility: () => readTeamBudgetVisibility,
+  redactTeamBudget: () => redactTeamBudget,
+  redactTeamUsage: () => redactTeamUsage,
   resolveBridgeUserId: () => resolveBridgeUserId,
   resolveUserId: () => resolveUserId,
   resolveUserProfile: () => resolveUserProfile,
   resolveUserRole: () => resolveUserRole,
+  teamBudgetStatusFor: () => teamBudgetStatusFor,
   toLiteLLMUserId: () => toLiteLLMUserId,
   validateTeamPatchInput: () => validateTeamPatchInput,
   validateTeamWriteInput: () => validateTeamWriteInput
@@ -8022,6 +8027,11 @@ var import_catalog_client = require("@backstage/catalog-client");
 
 // src/client.ts
 var DEFAULT_TIMEOUT = 3e4;
+function normalizeRequestTags(tags) {
+  if (!tags) return [];
+  if (Array.isArray(tags)) return tags.filter((t) => typeof t === "string");
+  return Object.entries(tags).map(([k, v]) => `${k}:${v}`);
+}
 var LiteLLMUpstreamError = class extends Error {
   constructor(status, statusText, body) {
     let message2 = `LiteLLM API error: ${status} ${statusText} - ${body}`;
@@ -8425,6 +8435,43 @@ var LiteLLMClient = class {
       url: r?.url ?? void 0
     })).filter((r) => r.id);
   }
+  /**
+   * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
+   * by date range and optionally by key/user/team. Rows are normalised so
+   * `request_tags` is always a `string[]` (LiteLLM returns either an array
+   * or an object depending on version) — callers group by tag to attribute
+   * spend to a conversation or caller.
+   *
+   * This is the admin/DB-backed endpoint: it can return a large number of
+   * rows, so callers should keep the date window tight and cap `page_size`.
+   */
+  async getSpendLogs(params) {
+    const query = new URLSearchParams({
+      start_date: params.start_date,
+      end_date: params.end_date
+    });
+    if (params.api_key) query.append("api_key", params.api_key);
+    if (params.user_id) query.append("user_id", params.user_id);
+    if (params.team_id) query.append("team_id", params.team_id);
+    if (params.page_size) query.append("page_size", String(params.page_size));
+    const raw = await this.request(`/spend/logs?${query.toString()}`);
+    const rows = Array.isArray(raw) ? raw : raw?.data ?? [];
+    return rows.map((row) => ({
+      request_id: row?.request_id,
+      startTime: row?.startTime ?? row?.start_time,
+      endTime: row?.endTime ?? row?.end_time,
+      spend: row?.spend ?? 0,
+      total_tokens: row?.total_tokens ?? 0,
+      prompt_tokens: row?.prompt_tokens ?? 0,
+      completion_tokens: row?.completion_tokens ?? 0,
+      model: row?.model,
+      api_key: row?.api_key,
+      user: row?.user,
+      team_id: row?.team_id,
+      request_tags: normalizeRequestTags(row?.request_tags),
+      metadata: row?.metadata
+    }));
+  }
   emptyUsage() {
     return {
       total_spend: 0,
@@ -8629,6 +8676,10 @@ var openApiSpec = {
               keyGeneration: { type: "object", properties: {
                 allowUnlimitedBudget: { type: "boolean" },
                 teamRequired: { type: "boolean" }
+              } },
+              display: { type: "object", properties: {
+                hideTeamBudgetForMembers: { type: "boolean" },
+                hideTeamBudgetForManagers: { type: "boolean" }
               } }
             } } } }
           }
@@ -8733,6 +8784,7 @@ var openApiSpec = {
       get: {
         tags: ["Teams"],
         summary: "List teams the current user belongs to",
+        description: "When litellm.display.hideTeamBudgetForMembers is set, max_budget/spend are stripped and budget_pct/budget_status/budget_hidden carry the consumption level instead.",
         responses: { "200": { description: "Array of teams" } }
       }
     },
@@ -8740,6 +8792,7 @@ var openApiSpec = {
       get: {
         tags: ["Teams"],
         summary: "Usage metrics for a team",
+        description: "Spend fields are zeroed when the caller is subject to team budget hiding (member or manager flag, whichever applies to them).",
         parameters: [
           { name: "teamId", in: "path", required: true, schema: { type: "string" } },
           { name: "start_date", in: "query", required: true, schema: { type: "string" } },
@@ -10827,6 +10880,79 @@ function validateTeamPatchInput(input, cfg) {
   return { ok: true, value: result };
 }
 
+// src/teamBudgetVisibility.ts
+function teamBudgetStatusFor(spend, budget) {
+  if (budget > 0 && spend >= budget) return "over";
+  if (budget > 0 && spend >= budget * 0.8) return "near";
+  return "ok";
+}
+function readTeamBudgetVisibility(config) {
+  return {
+    hideTeamBudgetForMembers: config.getOptionalBoolean(
+      "litellm.display.hideTeamBudgetForMembers"
+    ) ?? false,
+    hideTeamBudgetForManagers: config.getOptionalBoolean(
+      "litellm.display.hideTeamBudgetForManagers"
+    ) ?? false
+  };
+}
+function redactTeamBudget(team) {
+  const budget = team.max_budget ?? 0;
+  if (budget <= 0) return team;
+  const spend = team.spend ?? 0;
+  const pct = Math.min(100, Math.max(0, spend / budget * 100));
+  const { max_budget: _dropped, ...rest } = team;
+  return {
+    ...rest,
+    spend: 0,
+    budget_pct: pct,
+    budget_status: teamBudgetStatusFor(spend, budget),
+    budget_hidden: true
+  };
+}
+function redactTeamUsage(usage) {
+  const zeroSpend = (p) => ({
+    ...p,
+    spend: 0
+  });
+  const zeroTotalSpend = (p) => ({
+    ...p,
+    total_spend: 0
+  });
+  return {
+    ...usage,
+    total_spend: 0,
+    usage_by_model: Object.fromEntries(
+      Object.entries(usage.usage_by_model ?? {}).map(([k, v]) => [
+        k,
+        zeroTotalSpend(v)
+      ])
+    ),
+    usage_by_key: Object.fromEntries(
+      Object.entries(usage.usage_by_key ?? {}).map(([k, v]) => [
+        k,
+        zeroTotalSpend(v)
+      ])
+    ),
+    daily_usage: (usage.daily_usage ?? []).map(zeroSpend),
+    daily_by_model: (usage.daily_by_model ?? []).map(zeroSpend)
+  };
+}
+
+// src/opencode.ts
+function readOpencodeConfig(config) {
+  const enabled = config.getOptionalBoolean("litellm.opencode.enabled") ?? false;
+  return {
+    enabled,
+    keyDuration: config.getOptionalString("litellm.opencode.keyDuration") ?? "30d",
+    maxBudget: config.getOptionalNumber("litellm.opencode.maxBudget") ?? 50,
+    requireTeam: config.getOptionalBoolean("litellm.opencode.requireTeam") ?? false,
+    metadata: config.getOptional(
+      "litellm.opencode.metadata"
+    ) ?? {}
+  };
+}
+
 // src/router.ts
 var teamCreateInFlight = /* @__PURE__ */ new Map();
 var TEAM_FETCH_RETRY_DELAYS_MS = [100, 300, 900];
@@ -10848,6 +10974,15 @@ async function withTeamFetchRetry(fn, delaysMs = TEAM_FETCH_RETRY_DELAYS_MS) {
     }
   }
 }
+function isValidRedirectUri(uri) {
+  if (!uri) return false;
+  try {
+    const url = new URL(uri);
+    return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1") && url.pathname === "/callback";
+  } catch {
+    return false;
+  }
+}
 async function createRouter(options) {
   const { config, logger, auth, discovery, permissions } = options;
   const baseUrl = config.getString("litellm.baseUrl");
@@ -10863,6 +10998,8 @@ async function createRouter(options) {
   const teamMgmtEnabled = isTeamManagementEnabled(config);
   const objectPermsEnabled = isObjectPermissionsEnabled(config);
   const teamAdminCfg = readTeamAdminConfig(config);
+  const teamBudgetVisibility = readTeamBudgetVisibility(config);
+  const opencodeCfg = readOpencodeConfig(config);
   const catalogClient = options.catalogClient ?? new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
@@ -10874,6 +11011,11 @@ async function createRouter(options) {
       "litellm.teamAdmin is configured but team management is disabled \u2014 set permission.enabled: true and litellm.teamAdmin.group to enable it."
     );
   }
+  if (teamBudgetVisibility.hideTeamBudgetForMembers || teamBudgetVisibility.hideTeamBudgetForManagers) {
+    logger.info(
+      `LiteLLM team budget hiding enabled \u2014 members: ${teamBudgetVisibility.hideTeamBudgetForMembers}, managers: ${teamBudgetVisibility.hideTeamBudgetForManagers}`
+    );
+  }
   const router = (0, import_express.Router)();
   router.use(import_express.default.json());
   router.get("/health", (_req, res) => {
@@ -10883,11 +11025,16 @@ async function createRouter(options) {
     res.json({
       baseUrl: publicBaseUrl,
       keyGeneration: { allowUnlimitedBudget, teamRequired },
+      opencode: { enabled: opencodeCfg.enabled },
       teamManagement: {
         enabled: teamMgmtEnabled,
         maxBudgetCeiling: teamAdminCfg.maxBudgetCeiling,
         allowUnlimitedBudget: teamAdminCfg.allowUnlimitedBudget,
         objectPermissionsEnabled: objectPermsEnabled
+      },
+      display: {
+        hideTeamBudgetForMembers: teamBudgetVisibility.hideTeamBudgetForMembers,
+        hideTeamBudgetForManagers: teamBudgetVisibility.hideTeamBudgetForManagers
       }
     });
   });
@@ -11115,6 +11262,109 @@ async function createRouter(options) {
       res.status(500).json({ error: error.message });
     }
   });
+  if (opencodeCfg.enabled) {
+    logger.info(
+      `OpenCode connect endpoint enabled \u2014 duration=${opencodeCfg.keyDuration}, maxBudget=$${opencodeCfg.maxBudget}`
+    );
+    router.get("/opencode/connect", async (req, res) => {
+      try {
+        const tokenEntityRef = await resolveUserId(req, auth);
+        if (!tokenEntityRef) {
+          res.status(401).json({ error: "Authentication required" });
+          return;
+        }
+        const redirectUri = req.query.redirect_uri;
+        if (!isValidRedirectUri(redirectUri)) {
+          res.status(400).json({
+            error: "Invalid redirect_uri \u2014 expected http://localhost:<port>/callback"
+          });
+          return;
+        }
+        if (!await assertPermission(req, litellmKeyCreatePermission)) {
+          sendPermissionDenied(res, litellmKeyCreatePermission);
+          return;
+        }
+        const userId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
+        const userInfo = await getOrProvisionUser(
+          client,
+          tokenEntityRef,
+          userId,
+          provisioningEnabled,
+          provisioningDefaults,
+          roleConfigs,
+          catalogClient,
+          auth,
+          logger
+        );
+        const teamId = req.query.team;
+        if (teamId) {
+          const userTeams = userInfo?.teams ?? [];
+          if (!userTeams.includes(teamId)) {
+            res.status(403).json({
+              error: "Access denied: team is not one of your teams",
+              team: teamId
+            });
+            return;
+          }
+        } else if (opencodeCfg.requireTeam) {
+          res.status(400).json({ error: "A team is required for this connection" });
+          return;
+        }
+        const alias = teamId ? `opencode-${userId}-${teamId}` : `opencode-${userId}`;
+        const existing = await client.listKeys(userId).catch(() => []);
+        const reusable = existing.find(
+          (k) => k.key_alias === alias && !k.blocked && k.user_id === userId
+        );
+        let key;
+        if (reusable?.token ?? reusable?.key) {
+          key = reusable.token ?? reusable.key;
+        } else {
+          const profile = await resolveUserProfile(
+            tokenEntityRef,
+            catalogClient,
+            auth,
+            logger
+          );
+          const result = await client.generateKey({
+            alias,
+            duration: opencodeCfg.keyDuration,
+            max_budget: opencodeCfg.maxBudget,
+            team_id: teamId,
+            metadata: {
+              ...opencodeCfg.metadata,
+              created_via: "opencode-connect",
+              created_by_backstage_user: tokenEntityRef,
+              ...profile.email && { created_by_email: profile.email },
+              ...teamId && { opencode_team: teamId }
+            },
+            user_id: userId
+          });
+          if (!result.key) {
+            res.status(502).json({ error: "LiteLLM returned no key material" });
+            return;
+          }
+          key = result.key;
+        }
+        const url = new URL(redirectUri);
+        url.searchParams.set("key", key);
+        if (teamId) url.searchParams.set("team", teamId);
+        logger.info({
+          action: "opencode.connect",
+          userId,
+          team: teamId ?? null,
+          reused: Boolean(reusable?.token ?? reusable?.key)
+        });
+        res.redirect(302, url.href);
+      } catch (error) {
+        if (error instanceof ProvisioningError) {
+          res.status(error.status).json(error.body);
+          return;
+        }
+        logger.error("OpenCode connect failed", error);
+        res.status(500).json({ error: error.message });
+      }
+    });
+  }
   router.post("/keys/:keyId/update", async (req, res) => {
     try {
       const { keyId } = req.params;
@@ -11287,7 +11537,10 @@ async function createRouter(options) {
           })
         )
       );
-      res.json(teams.filter(Boolean));
+      const list = teams.filter(Boolean);
+      res.json(
+        teamBudgetVisibility.hideTeamBudgetForMembers ? list.map(redactTeamBudget) : list
+      );
     } catch (error) {
       if (error instanceof ProvisioningError) {
         res.status(error.status).json(error.body);
@@ -11386,7 +11639,9 @@ async function createRouter(options) {
     teamCreateInFlight.set(key, createPromise);
     try {
       const result = await createPromise;
-      res.json(result);
+      res.json(
+        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(result) : result
+      );
     } catch (err) {
       sendTeamError(err, res);
     } finally {
@@ -11430,7 +11685,9 @@ async function createRouter(options) {
         teamId,
         owningGroup
       });
-      res.json(r);
+      res.json(
+        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(r) : r
+      );
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -11488,7 +11745,9 @@ async function createRouter(options) {
       const owned = all.filter(
         (t) => typeof t.metadata?.owning_group === "string" && t.metadata.owning_group === teamAdminCfg.group
       );
-      res.json(owned);
+      res.json(
+        teamBudgetVisibility.hideTeamBudgetForManagers ? owned.map(redactTeamBudget) : owned
+      );
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -11630,7 +11889,9 @@ async function createRouter(options) {
           owningGroup
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(updated);
+        res.json(
+          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
+        );
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11661,7 +11922,9 @@ async function createRouter(options) {
           owningGroup
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(updated);
+        res.json(
+          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
+        );
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11740,7 +12003,9 @@ async function createRouter(options) {
           owningGroup,
           vector_stores: requested
         });
-        res.json(updated);
+        res.json(
+          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
+        );
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11821,7 +12086,9 @@ async function createRouter(options) {
           before,
           after: requested
         });
-        res.json(updated);
+        res.json(
+          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
+        );
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11840,7 +12107,24 @@ async function createRouter(options) {
         start_date,
         end_date
       );
-      res.json(usage);
+      let hide = teamBudgetVisibility.hideTeamBudgetForMembers;
+      if (teamAdminCfg.group) {
+        try {
+          const tokenEntityRef = await resolveUserId(req, auth);
+          const isManager = !!tokenEntityRef && await isUserMemberOfGroup(
+            tokenEntityRef,
+            teamAdminCfg.group,
+            catalogClient,
+            auth,
+            logger
+          );
+          hide = isManager ? teamBudgetVisibility.hideTeamBudgetForManagers : teamBudgetVisibility.hideTeamBudgetForMembers;
+        } catch (err) {
+          logger.warn(`Team-manager check failed, hiding team spend: ${err.message}`);
+          hide = teamBudgetVisibility.hideTeamBudgetForMembers;
+        }
+      }
+      res.json(hide ? redactTeamUsage(usage) : usage);
     } catch (error) {
       logger.error("Failed to fetch team usage", error);
       res.status(500).json({ error: error.message });
@@ -12037,15 +12321,20 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
   litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission,
   newDefaultVerifier,
+  normalizeRequestTags,
   provisionUser,
   readBridgeConfig,
   readProvisioningDefaults,
   readRoleConfigs,
   readTeamAdminConfig,
+  readTeamBudgetVisibility,
+  redactTeamBudget,
+  redactTeamUsage,
   resolveBridgeUserId,
   resolveUserId,
   resolveUserProfile,
   resolveUserRole,
+  teamBudgetStatusFor,
   toLiteLLMUserId,
   validateTeamPatchInput,
   validateTeamWriteInput