@acarmisc/backstage-plugin-litellm-backend 0.13.0 → 0.14.0

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { litellmPlugin } from './plugin';
 export { litellmPlugin as default } from './plugin';
 export { createRouter } from './router';
 export * from './types';
-export { LiteLLMClient } from './client';
+export { LiteLLMClient, normalizeRequestTags } from './client';
 export { resolveUserId, resolveUserProfile, toLiteLLMUserId, getOrProvisionUser, provisionUser, readProvisioningDefaults, readRoleConfigs, applyRoleOverrides, resolveUserRole, ProvisioningError, } from './provisioning';
 export type { BackstageUserProfile } from './provisioning';
 export { readTeamAdminConfig, isTeamManagementEnabled, assertTeamAdmin, validateTeamWriteInput, validateTeamPatchInput, } from './teamAdmin';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeGenerateKey = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.teamBudgetStatusFor = exports.redactTeamUsage = exports.redactTeamBudget = exports.readTeamBudgetVisibility = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
+exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeGenerateKey = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.teamBudgetStatusFor = exports.redactTeamUsage = exports.redactTeamBudget = exports.readTeamBudgetVisibility = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.normalizeRequestTags = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
 var plugin_1 = require("./plugin");
 Object.defineProperty(exports, "litellmPlugin", { enumerable: true, get: function () { return plugin_1.litellmPlugin; } });
 var plugin_2 = require("./plugin");
@@ -24,6 +24,7 @@ Object.defineProperty(exports, "createRouter", { enumerable: true, get: function
 __exportStar(require("./types"), exports);
 var client_1 = require("./client");
 Object.defineProperty(exports, "LiteLLMClient", { enumerable: true, get: function () { return client_1.LiteLLMClient; } });
+Object.defineProperty(exports, "normalizeRequestTags", { enumerable: true, get: function () { return client_1.normalizeRequestTags; } });
 var provisioning_1 = require("./provisioning");
 Object.defineProperty(exports, "resolveUserId", { enumerable: true, get: function () { return provisioning_1.resolveUserId; } });
 Object.defineProperty(exports, "resolveUserProfile", { enumerable: true, get: function () { return provisioning_1.resolveUserProfile; } });

package/dist/opencode.d.ts

@@ -0,0 +1,30 @@
+import { Config } from '@backstage/config';
+/**
+ * Configuration for the OpenCode SSO-connect integration (litellm.opencode.*).
+ *
+ * The connect flow is served by the opencode-portal-auth plugin client-side:
+ * the user runs /connect in OpenCode, a browser opens
+ *   GET {baseUrl}/api/litellm/opencode/connect?team=...&redirect_uri=...
+ * and this backend generates (or reuses) a LiteLLM virtual key bound to the
+ * signed-in Backstage user and, optionally, one of their teams, then 302s
+ * back to the local OpenCode callback listener.
+ */
+export interface OpencodeConfig {
+    /** Route is mounted only when true. Default false. */
+    enabled: boolean;
+    /**
+     * Default duration for freshly generated keys, in LiteLLM format
+     * (e.g. "30d"). Users can re-connect to rotate. Default '30d'.
+     */
+    keyDuration: string;
+    /** Default max budget (USD) for keys created via the connect flow. Default 50. */
+    maxBudget: number;
+    /**
+     * When true, a team query parameter must reference a team the user is a
+     * member of (or manage); otherwise the key is personal-only.
+     */
+    requireTeam: boolean;
+    /** Extra metadata stamped on keys created via this flow. */
+    metadata: Record<string, string>;
+}
+export declare function readOpencodeConfig(config: Config): OpencodeConfig;

package/dist/opencode.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOpencodeConfig = readOpencodeConfig;
+function readOpencodeConfig(config) {
+    const enabled = config.getOptionalBoolean('litellm.opencode.enabled') ?? false;
+    return {
+        enabled,
+        keyDuration: config.getOptionalString('litellm.opencode.keyDuration') ?? '30d',
+        maxBudget: config.getOptionalNumber('litellm.opencode.maxBudget') ?? 50,
+        requireTeam: config.getOptionalBoolean('litellm.opencode.requireTeam') ?? false,
+        metadata: config.getOptional('litellm.opencode.metadata') ?? {},
+    };
+}

package/dist/router.js

@@ -46,6 +46,7 @@ const bridge_1 = require("./bridge");
 const permissions_1 = require("./permissions");
 const teamAdmin_1 = require("./teamAdmin");
 const teamBudgetVisibility_1 = require("./teamBudgetVisibility");
+const opencode_1 = require("./opencode");
 const teamCreateInFlight = new Map();
 /** Backoff schedule for `withTeamFetchRetry` — 3 retries over ~1.3s total. */
 const TEAM_FETCH_RETRY_DELAYS_MS = [100, 300, 900];
@@ -85,6 +86,24 @@ async function withTeamFetchRetry(fn, delaysMs = TEAM_FETCH_RETRY_DELAYS_MS) {
         }
     }
 }
+/**
+ * Only loopback http://localhost:<port>/callback redirect URIs are accepted —
+ * the OpenCode plugin runs its callback listener on 127.0.0.1. This
+ * keeps the flow from being usable as an open redirect.
+ */
+function isValidRedirectUri(uri) {
+    if (!uri)
+        return false;
+    try {
+        const url = new URL(uri);
+        return (url.protocol === 'http:' &&
+            (url.hostname === 'localhost' || url.hostname === '127.0.0.1') &&
+            url.pathname === '/callback');
+    }
+    catch {
+        return false;
+    }
+}
 async function createRouter(options) {
     const { config, logger, auth, discovery, permissions } = options;
     const baseUrl = config.getString('litellm.baseUrl');
@@ -104,6 +123,7 @@ async function createRouter(options) {
     const objectPermsEnabled = (0, teamAdmin_1.isObjectPermissionsEnabled)(config);
     const teamAdminCfg = (0, teamAdmin_1.readTeamAdminConfig)(config);
     const teamBudgetVisibility = (0, teamBudgetVisibility_1.readTeamBudgetVisibility)(config);
+    const opencodeCfg = (0, opencode_1.readOpencodeConfig)(config);
     const catalogClient = options.catalogClient ?? new catalog_client_1.CatalogClient({ discoveryApi: discovery });
     if (provisioningEnabled) {
         logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length
@@ -131,6 +151,7 @@ async function createRouter(options) {
         res.json({
             baseUrl: publicBaseUrl,
             keyGeneration: { allowUnlimitedBudget, teamRequired },
+            opencode: { enabled: opencodeCfg.enabled },
             teamManagement: {
                 enabled: teamMgmtEnabled,
                 maxBudgetCeiling: teamAdminCfg.maxBudgetCeiling,
@@ -396,6 +417,122 @@ async function createRouter(options) {
             res.status(500).json({ error: error.message });
         }
     });
+    // ── OpenCode SSO-connect ─────────────────────────────────────────────────
+    //
+    // Client side: the opencode-portal-auth plugin. Handshake contract (see
+    // that package's README):
+    //
+    //   GET /opencode/connect?team=<id>&redirect_uri=http://localhost:<port>/callback
+    //     → (SSO-authenticated) generate/reuse a virtual key bound to the
+    //       user and optional team → 302 {redirect_uri}?key=<api-key>
+    //
+    // Mounted only when litellm.opencode.enabled is true. Key creation is
+    // gated by the same litellmKeyCreatePermission as POST /keys/generate.
+    if (opencodeCfg.enabled) {
+        logger.info(`OpenCode connect endpoint enabled — duration=${opencodeCfg.keyDuration}, maxBudget=$${opencodeCfg.maxBudget}`);
+        router.get('/opencode/connect', async (req, res) => {
+            try {
+                // The request comes from the browser (user session), so SSO
+                // auth applies exactly like for any other UI route.
+                const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+                if (!tokenEntityRef) {
+                    res.status(401).json({ error: 'Authentication required' });
+                    return;
+                }
+                const redirectUri = req.query.redirect_uri;
+                if (!isValidRedirectUri(redirectUri)) {
+                    res.status(400).json({
+                        error: 'Invalid redirect_uri — expected http://localhost:<port>/callback',
+                    });
+                    return;
+                }
+                if (!(await assertPermission(req, permissions_1.litellmKeyCreatePermission))) {
+                    sendPermissionDenied(res, permissions_1.litellmKeyCreatePermission);
+                    return;
+                }
+                const userId = (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain);
+                const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+                // Optional team binding: must be one of the user's own teams so
+                // the connect flow can never mint a key billed to someone else.
+                const teamId = req.query.team;
+                if (teamId) {
+                    const userTeams = userInfo?.teams ?? [];
+                    if (!userTeams.includes(teamId)) {
+                        res.status(403).json({
+                            error: 'Access denied: team is not one of your teams',
+                            team: teamId,
+                        });
+                        return;
+                    }
+                }
+                else if (opencodeCfg.requireTeam) {
+                    res.status(400).json({ error: 'A team is required for this connection' });
+                    return;
+                }
+                // Alias is stable per user+team so re-connecting rotates the same
+                // logical key slot instead of accumulating duplicates. LiteLLM
+                // rejects duplicate aliases, so on conflict we look up the existing
+                // key and reuse it (the user gets a working connection either way).
+                const alias = teamId
+                    ? `opencode-${userId}-${teamId}`
+                    : `opencode-${userId}`;
+                const existing = await client
+                    .listKeys(userId)
+                    .catch(() => []);
+                // Reuse a healthy existing key for this slot rather than failing
+                // on the alias collision LiteLLM would raise. Blocked keys are
+                // skipped so a blocked slot can be recovered by re-connecting.
+                const reusable = existing.find(k => k.key_alias === alias &&
+                    !k.blocked &&
+                    k.user_id === userId);
+                let key;
+                if (reusable?.token ?? reusable?.key) {
+                    key = reusable.token ?? reusable.key;
+                }
+                else {
+                    const profile = await (0, provisioning_1.resolveUserProfile)(tokenEntityRef, catalogClient, auth, logger);
+                    const result = await client.generateKey({
+                        alias,
+                        duration: opencodeCfg.keyDuration,
+                        max_budget: opencodeCfg.maxBudget,
+                        team_id: teamId,
+                        metadata: {
+                            ...opencodeCfg.metadata,
+                            created_via: 'opencode-connect',
+                            created_by_backstage_user: tokenEntityRef,
+                            ...(profile.email && { created_by_email: profile.email }),
+                            ...(teamId && { opencode_team: teamId }),
+                        },
+                        user_id: userId,
+                    });
+                    if (!result.key) {
+                        res.status(502).json({ error: 'LiteLLM returned no key material' });
+                        return;
+                    }
+                    key = result.key;
+                }
+                const url = new URL(redirectUri);
+                url.searchParams.set('key', key);
+                if (teamId)
+                    url.searchParams.set('team', teamId);
+                logger.info({
+                    action: 'opencode.connect',
+                    userId,
+                    team: teamId ?? null,
+                    reused: Boolean(reusable?.token ?? reusable?.key),
+                });
+                res.redirect(302, url.href);
+            }
+            catch (error) {
+                if (error instanceof provisioning_1.ProvisioningError) {
+                    res.status(error.status).json(error.body);
+                    return;
+                }
+                logger.error('OpenCode connect failed', error);
+                res.status(500).json({ error: error.message });
+            }
+        });
+    }
     router.post('/keys/:keyId/update', async (req, res) => {
         try {
             const { keyId } = req.params;

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  user_email?: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamObjectPermission {\n  /** Vector store ids/names attached to the team. */\n  vector_stores?: string[];\n  /** MCP server ids/names attached to the team. */\n  mcp_servers?: string[];\n  /** MCP access group names attached to the team. */\n  mcp_access_groups?: string[];\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  spend: number;\n  /**\n   * Share of max_budget consumed (0-100), present only on redacted records.\n   * Set by the backend when litellm.display.hideTeamBudgetFor* is enabled so\n   * clients can render the consumption level without dollar amounts.\n   */\n  budget_pct?: number;\n  /** ok | near (>=80%) | over (>=100%), present only on redacted records. */\n  budget_status?: 'ok' | 'near' | 'over';\n  /** True when max_budget/spend were stripped by budget hiding. */\n  budget_hidden?: boolean;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  /** Arbitrary metadata stored on the team record. */\n  metadata?: Record<string, unknown>;\n  /** Knowledge bases (vector stores) and MCP servers attached to the team. */\n  object_permission?: TeamObjectPermission;\n  /** Whether the team is blocked/deactivated. */\n  blocked?: boolean;\n  /** Max budget available to individual team members (if set per-member). */\n  team_member_budget?: number;\n}\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: TeamObjectPermission;\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\nexport interface CreateTeamResponse {\n  team_id: string;\n  team_alias?: string;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n  max_input_tokens?: number;\n  max_output_tokens?: number;\n  /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */\n  access_groups?: string[];\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  user_email?: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamObjectPermission {\n  /** Vector store ids/names attached to the team. */\n  vector_stores?: string[];\n  /** MCP server ids/names attached to the team. */\n  mcp_servers?: string[];\n  /** MCP access group names attached to the team. */\n  mcp_access_groups?: string[];\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  spend: number;\n  /**\n   * Share of max_budget consumed (0-100), present only on redacted records.\n   * Set by the backend when litellm.display.hideTeamBudgetFor* is enabled so\n   * clients can render the consumption level without dollar amounts.\n   */\n  budget_pct?: number;\n  /** ok | near (>=80%) | over (>=100%), present only on redacted records. */\n  budget_status?: 'ok' | 'near' | 'over';\n  /** True when max_budget/spend were stripped by budget hiding. */\n  budget_hidden?: boolean;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  /** Arbitrary metadata stored on the team record. */\n  metadata?: Record<string, unknown>;\n  /** Knowledge bases (vector stores) and MCP servers attached to the team. */\n  object_permission?: TeamObjectPermission;\n  /** Whether the team is blocked/deactivated. */\n  blocked?: boolean;\n  /** Max budget available to individual team members (if set per-member). */\n  team_member_budget?: number;\n}\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: TeamObjectPermission;\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\nexport interface CreateTeamResponse {\n  team_id: string;\n  team_alias?: string;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n  max_input_tokens?: number;\n  max_output_tokens?: number;\n  /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */\n  access_groups?: string[];\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\n/** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */\nexport interface SpendLogEntry {\n  request_id?: string;\n  /** ISO timestamp of the call. */\n  startTime?: string;\n  endTime?: string;\n  spend?: number;\n  total_tokens?: number;\n  prompt_tokens?: number;\n  completion_tokens?: number;\n  model?: string;\n  /** Virtual key alias or hash the request was billed to. */\n  api_key?: string;\n  user?: string;\n  team_id?: string;\n  /**\n   * Tags attached to the request (e.g. `channel:backstage`,\n   * `session:<thread>`, `invoked-by:<user>`). Shape varies across LiteLLM\n   * versions (array or object) and is normalised to a string[].\n   */\n  request_tags?: string[] | Record<string, string>;\n  /** LiteLLM `metadata` blob; carries trace ids and session grouping. */\n  metadata?: Record<string, unknown> | string | null;\n}\n\nexport interface SpendLogsParams {\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  start_date: string;\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  end_date: string;\n  /** Restrict to the given virtual key. */\n  api_key?: string;\n  user_id?: string;\n  team_id?: string;\n  /** Max rows to return (LiteLLM caps at 1000 per page). */\n  page_size?: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -283,6 +283,42 @@ export interface PaginatedAuditLogs {
     page_size: number;
     total_pages: number;
 }
+/** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */
+export interface SpendLogEntry {
+    request_id?: string;
+    /** ISO timestamp of the call. */
+    startTime?: string;
+    endTime?: string;
+    spend?: number;
+    total_tokens?: number;
+    prompt_tokens?: number;
+    completion_tokens?: number;
+    model?: string;
+    /** Virtual key alias or hash the request was billed to. */
+    api_key?: string;
+    user?: string;
+    team_id?: string;
+    /**
+     * Tags attached to the request (e.g. `channel:backstage`,
+     * `session:<thread>`, `invoked-by:<user>`). Shape varies across LiteLLM
+     * versions (array or object) and is normalised to a string[].
+     */
+    request_tags?: string[] | Record<string, string>;
+    /** LiteLLM `metadata` blob; carries trace ids and session grouping. */
+    metadata?: Record<string, unknown> | string | null;
+}
+export interface SpendLogsParams {
+    /** ISO date `YYYY-MM-DD` (inclusive). */
+    start_date: string;
+    /** ISO date `YYYY-MM-DD` (inclusive). */
+    end_date: string;
+    /** Restrict to the given virtual key. */
+    api_key?: string;
+    user_id?: string;
+    team_id?: string;
+    /** Max rows to return (LiteLLM caps at 1000 per page). */
+    page_size?: number;
+}
 export interface AuditLogsParams {
     page?: number;
     page_size?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",