@acarmisc/backstage-plugin-litellm-backend 0.15.0 → 0.16.0

package/dist/services/userInfoCache.d.ts

@@ -0,0 +1,65 @@
+import { UserInfo } from '../types';
+import { LiteLLMClient } from '../client';
+/**
+ * Clock abstraction for testing. Allows tests to fake time without real delays.
+ */
+export interface Clock {
+    now(): number;
+}
+/**
+ * Simple LRU cache with per-entry TTL.
+ * - Max ~500 entries; LRU eviction when full.
+ * - Each entry has its own expiry time.
+ * - Tracks pending promises for single-flight deduplication.
+ */
+export declare class UserInfoCache {
+    private static readonly MAX_ENTRIES;
+    private cache;
+    private pending;
+    private clock;
+    private ttlMs;
+    constructor(ttlMs?: number, clock?: Clock);
+    /**
+     * Get a cached value, or null if not found or expired.
+     */
+    get(userId: string): UserInfo | null;
+    /**
+     * Set a cache entry (does not expire).
+     */
+    set(userId: string, value: UserInfo): void;
+    /**
+     * Invalidate a single user's cache entry.
+     */
+    invalidate(userId: string): void;
+    /**
+     * Clear all cache entries and pending promises.
+     */
+    clear(): void;
+    /**
+     * Internal: track a pending promise for single-flight deduplication.
+     * Returns the promise, which is stored and shared across concurrent requests.
+     */
+    private getPending;
+    /**
+     * Load a value through the cache with single-flight deduplication.
+     * If the value is already cached and not expired, return it.
+     * If another request is loading the same userId, wait for that promise.
+     * Otherwise, call the loader and cache the result (unless null or error).
+     *
+     * Errors and null results are NOT cached.
+     */
+    load(userId: string, loader: () => Promise<UserInfo | null>): Promise<UserInfo | null>;
+}
+/**
+ * Wraps a LiteLLMClient to inject getUserInfo caching and automatic cache
+ * invalidation on mutations.
+ *
+ * Returns a Proxy that:
+ * - Routes getUserInfo(userId) through the cache
+ * - Invalidates the cache (clear all) after any method matching the mutation pattern
+ * - Delegates all other methods to the wrapped client unchanged
+ */
+export declare function withUserInfoCache(client: LiteLLMClient, options?: {
+    ttlMs?: number;
+    clock?: Clock;
+}): LiteLLMClient;

package/dist/services/userInfoCache.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInfoCache = void 0;
+exports.withUserInfoCache = withUserInfoCache;
+/**
+ * Default system clock using Date.now().
+ */
+const SystemClock = {
+    now: () => Date.now(),
+};
+/**
+ * Simple LRU cache with per-entry TTL.
+ * - Max ~500 entries; LRU eviction when full.
+ * - Each entry has its own expiry time.
+ * - Tracks pending promises for single-flight deduplication.
+ */
+class UserInfoCache {
+    constructor(ttlMs = 10000, clock = SystemClock) {
+        this.cache = new Map();
+        this.pending = new Map();
+        this.ttlMs = ttlMs;
+        this.clock = clock;
+    }
+    /**
+     * Get a cached value, or null if not found or expired.
+     */
+    get(userId) {
+        const entry = this.cache.get(userId);
+        if (!entry)
+            return null;
+        if (this.clock.now() >= entry.expiresAt) {
+            // Expired; remove and return null
+            this.cache.delete(userId);
+            return null;
+        }
+        return entry.value;
+    }
+    /**
+     * Set a cache entry (does not expire).
+     */
+    set(userId, value) {
+        // Evict LRU entry if at capacity
+        if (this.cache.size >= UserInfoCache.MAX_ENTRIES && !this.cache.has(userId)) {
+            const firstKey = this.cache.keys().next().value;
+            if (firstKey)
+                this.cache.delete(firstKey);
+        }
+        const expiresAt = this.clock.now() + this.ttlMs;
+        this.cache.set(userId, { value, expiresAt });
+    }
+    /**
+     * Invalidate a single user's cache entry.
+     */
+    invalidate(userId) {
+        this.cache.delete(userId);
+    }
+    /**
+     * Clear all cache entries and pending promises.
+     */
+    clear() {
+        this.cache.clear();
+        this.pending.clear();
+    }
+    /**
+     * Internal: track a pending promise for single-flight deduplication.
+     * Returns the promise, which is stored and shared across concurrent requests.
+     */
+    getPending(userId, loader) {
+        const existing = this.pending.get(userId);
+        if (existing)
+            return existing;
+        const promise = loader().finally(() => {
+            // Clean up pending once resolved or rejected
+            this.pending.delete(userId);
+        });
+        this.pending.set(userId, promise);
+        return promise;
+    }
+    /**
+     * Load a value through the cache with single-flight deduplication.
+     * If the value is already cached and not expired, return it.
+     * If another request is loading the same userId, wait for that promise.
+     * Otherwise, call the loader and cache the result (unless null or error).
+     *
+     * Errors and null results are NOT cached.
+     */
+    async load(userId, loader) {
+        // Check cache first
+        const cached = this.get(userId);
+        if (cached)
+            return cached;
+        // Use single-flight for concurrent requests
+        const result = await this.getPending(userId, loader);
+        // Cache only non-null success results
+        if (result) {
+            this.set(userId, result);
+        }
+        return result;
+    }
+}
+exports.UserInfoCache = UserInfoCache;
+UserInfoCache.MAX_ENTRIES = 500;
+/**
+ * Wraps a LiteLLMClient to inject getUserInfo caching and automatic cache
+ * invalidation on mutations.
+ *
+ * Returns a Proxy that:
+ * - Routes getUserInfo(userId) through the cache
+ * - Invalidates the cache (clear all) after any method matching the mutation pattern
+ * - Delegates all other methods to the wrapped client unchanged
+ */
+function withUserInfoCache(client, options) {
+    const cache = new UserInfoCache(options?.ttlMs ?? 10000, options?.clock);
+    // Methods whose names match this pattern indicate a mutation that should
+    // invalidate the cache to ensure consistency.
+    const isMutatingMethod = /^(generate|update|delete|block|unblock|reset|create|add|remove|set|regenerate|provision|teamMember)/i;
+    return new Proxy(client, {
+        get(target, prop) {
+            // Wrap getUserInfo through the cache
+            if (prop === 'getUserInfo') {
+                return async (userId) => {
+                    if (!userId) {
+                        // No userId => call upstream directly (shouldn't happen in normal flow)
+                        return target.getUserInfo(userId);
+                    }
+                    return cache.load(userId, () => target.getUserInfo(userId));
+                };
+            }
+            // Get the method from the target
+            const method = target[prop];
+            if (typeof method !== 'function') {
+                return method;
+            }
+            // If the method name matches the mutation pattern, wrap it to invalidate cache
+            if (isMutatingMethod.test(String(prop))) {
+                return async (...args) => {
+                    const result = await method.apply(target, args);
+                    // Invalidate entire cache after any mutation (simple and safe)
+                    cache.clear();
+                    return result;
+                };
+            }
+            // For other methods, bind and return as-is
+            return method.bind(target);
+        },
+    });
+}

package/dist/teamAdmin.d.ts

@@ -1,6 +1,6 @@
 import { Request } from 'express';
 import { Config } from '@backstage/config';
-import { AuthService, PermissionsService } from '@backstage/backend-plugin-api';
+import { AuthService, PermissionsService, LoggerService } from '@backstage/backend-plugin-api';
 import { BasicPermission } from '@backstage/plugin-permission-common';
 import { CatalogClient } from '@backstage/catalog-client';
 /**
@@ -108,7 +108,7 @@ export declare function assertTeamAdmin(opts: {
     catalogClient: CatalogClient;
     teamAdminGroup: string;
     permission: BasicPermission;
-    logger: any;
+    logger: LoggerService;
 }): Promise<TeamAdminCheck>;
 /**
  * Reads the team-admin governance block from config, applying fail-closed

package/dist/teamBudgetVisibility.d.ts

@@ -1,5 +1,6 @@
 import { Config } from '@backstage/config';
 import { TeamInfo, UsageMetrics } from './types';
+import { BudgetStatus } from '@acarmisc/backstage-plugin-litellm-common';
 /**
  * Independent "hide team budget" switches for the two team audiences.
  *
@@ -23,7 +24,7 @@ export interface TeamBudgetVisibility {
  * Consumption status derived from spend vs. cap. Mirrors the frontend
  * `budgetTone` thresholds (80% near, 100% over) so both sides agree.
  */
-export type TeamBudgetStatus = 'ok' | 'near' | 'over';
+export type TeamBudgetStatus = BudgetStatus;
 export declare function teamBudgetStatusFor(spend: number, budget: number): TeamBudgetStatus;
 export declare function readTeamBudgetVisibility(config: Config): TeamBudgetVisibility;
 /**

package/dist/teamBudgetVisibility.js

@@ -4,12 +4,12 @@ exports.teamBudgetStatusFor = teamBudgetStatusFor;
 exports.readTeamBudgetVisibility = readTeamBudgetVisibility;
 exports.redactTeamBudget = redactTeamBudget;
 exports.redactTeamUsage = redactTeamUsage;
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 function teamBudgetStatusFor(spend, budget) {
-    if (budget > 0 && spend >= budget)
-        return 'over';
-    if (budget > 0 && spend >= budget * 0.8)
-        return 'near';
-    return 'ok';
+    if (budget <= 0)
+        return 'ok';
+    const pct = (spend / budget) * 100;
+    return (0, backstage_plugin_litellm_common_1.budgetStatusForPct)(pct);
 }
 function readTeamBudgetVisibility(config) {
     return {

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  user_email?: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamObjectPermission {\n  /** Vector store ids/names attached to the team. */\n  vector_stores?: string[];\n  /** MCP server ids/names attached to the team. */\n  mcp_servers?: string[];\n  /** MCP access group names attached to the team. */\n  mcp_access_groups?: string[];\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  /** Spend-reset period for max_budget, e.g. \"30d\". */\n  budget_duration?: string;\n  spend: number;\n  /**\n   * Share of max_budget consumed (0-100), present only on redacted records.\n   * Set by the backend when litellm.display.hideTeamBudgetFor* is enabled so\n   * clients can render the consumption level without dollar amounts.\n   */\n  budget_pct?: number;\n  /** ok | near (>=80%) | over (>=100%), present only on redacted records. */\n  budget_status?: 'ok' | 'near' | 'over';\n  /** True when max_budget/spend were stripped by budget hiding. */\n  budget_hidden?: boolean;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  /** Arbitrary metadata stored on the team record. */\n  metadata?: Record<string, unknown>;\n  /** Knowledge bases (vector stores) and MCP servers attached to the team. */\n  object_permission?: TeamObjectPermission;\n  /** Whether the team is blocked/deactivated. */\n  blocked?: boolean;\n  /** Max budget available to individual team members (if set per-member). */\n  team_member_budget?: number;\n}\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: TeamObjectPermission;\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\nexport interface CreateTeamResponse {\n  team_id: string;\n  team_alias?: string;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  /** Team the key is bound to, when any (mirrors LiteLLM /user/info team_id). */\n  team_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n  max_input_tokens?: number;\n  max_output_tokens?: number;\n  /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */\n  access_groups?: string[];\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\n/** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */\nexport interface SpendLogEntry {\n  request_id?: string;\n  /** ISO timestamp of the call. */\n  startTime?: string;\n  endTime?: string;\n  spend?: number;\n  total_tokens?: number;\n  prompt_tokens?: number;\n  completion_tokens?: number;\n  model?: string;\n  /** Virtual key alias or hash the request was billed to. */\n  api_key?: string;\n  user?: string;\n  team_id?: string;\n  /**\n   * Tags attached to the request (e.g. `channel:backstage`,\n   * `session:<thread>`, `invoked-by:<user>`). Shape varies across LiteLLM\n   * versions (array or object) and is normalised to a string[].\n   */\n  request_tags?: string[] | Record<string, string>;\n  /** LiteLLM `metadata` blob; carries trace ids and session grouping. */\n  metadata?: Record<string, unknown> | string | null;\n}\n\nexport interface SpendLogsParams {\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  start_date: string;\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  end_date: string;\n  /** Restrict to the given virtual key. */\n  api_key?: string;\n  user_id?: string;\n  team_id?: string;\n  /** Max rows to return (LiteLLM caps at 1000 per page). */\n  page_size?: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n/** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */\nexport interface SpendLogEntry {\n  request_id?: string;\n  /** ISO timestamp of the call. */\n  startTime?: string;\n  endTime?: string;\n  spend?: number;\n  total_tokens?: number;\n  prompt_tokens?: number;\n  completion_tokens?: number;\n  model?: string;\n  /** Virtual key alias or hash the request was billed to. */\n  api_key?: string;\n  user?: string;\n  team_id?: string;\n  /**\n   * Tags attached to the request (e.g. `channel:backstage`,\n   * `session:<thread>`, `invoked-by:<user>`). Shape varies across LiteLLM\n   * versions (array or object) and is normalised to a string[].\n   */\n  request_tags?: string[] | Record<string, string>;\n  /** LiteLLM `metadata` blob; carries trace ids and session grouping. */\n  metadata?: Record<string, unknown> | string | null;\n}\n\nexport interface SpendLogsParams {\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  start_date: string;\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  end_date: string;\n  /** Restrict to the given virtual key. */\n  api_key?: string;\n  user_id?: string;\n  team_id?: string;\n  /** Max rows to return (LiteLLM caps at 1000 per page). */\n  page_size?: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -1,62 +1,4 @@
-export interface UserInfo {
-    user_id: string;
-    user_email?: string;
-    email?: string;
-    teams?: string[];
-    models?: string[];
-    max_budget?: number;
-    spend?: number;
-    current_spend?: number;
-    soft_limit?: number;
-    hard_limit?: number;
-    /** Spend-reset period for max_budget, e.g. "30d". */
-    budget_duration?: string;
-    /** Backstage-computed: true when the user is a member of litellm.audit.group */
-    can_view_audit?: boolean;
-}
-export interface TeamMember {
-    user_id: string;
-    user_email?: string;
-    role: 'admin' | 'user';
-}
-export interface TeamObjectPermission {
-    /** Vector store ids/names attached to the team. */
-    vector_stores?: string[];
-    /** MCP server ids/names attached to the team. */
-    mcp_servers?: string[];
-    /** MCP access group names attached to the team. */
-    mcp_access_groups?: string[];
-}
-export interface TeamInfo {
-    team_id: string;
-    team_alias?: string;
-    max_budget?: number;
-    /** Spend-reset period for max_budget, e.g. "30d". */
-    budget_duration?: string;
-    spend: number;
-    /**
-     * Share of max_budget consumed (0-100), present only on redacted records.
-     * Set by the backend when litellm.display.hideTeamBudgetFor* is enabled so
-     * clients can render the consumption level without dollar amounts.
-     */
-    budget_pct?: number;
-    /** ok | near (>=80%) | over (>=100%), present only on redacted records. */
-    budget_status?: 'ok' | 'near' | 'over';
-    /** True when max_budget/spend were stripped by budget hiding. */
-    budget_hidden?: boolean;
-    members_with_roles?: TeamMember[];
-    models?: string[];
-    tpm_limit?: number;
-    rpm_limit?: number;
-    /** Arbitrary metadata stored on the team record. */
-    metadata?: Record<string, unknown>;
-    /** Knowledge bases (vector stores) and MCP servers attached to the team. */
-    object_permission?: TeamObjectPermission;
-    /** Whether the team is blocked/deactivated. */
-    blocked?: boolean;
-    /** Max budget available to individual team members (if set per-member). */
-    team_member_budget?: number;
-}
+export { type UserInfo, type TeamMember, type TeamObjectPermission, type TeamInfo, type CreateTeamResponse, type VirtualKey, type ModelInfo, type UsageModelBreakdown, type UsageKeyBreakdown, type UsageDailyPoint, type UsageDailyModelPoint, type UsageMetrics, type GenerateKeyRequest, type UpdateKeyRequest, type GenerateKeyResponse, type AuditLogEntry, type PaginatedAuditLogs, } from '@acarmisc/backstage-plugin-litellm-common';
 export interface CreateTeamRequest {
     team_alias: string;
     models?: string[];
@@ -65,33 +7,16 @@ export interface CreateTeamRequest {
     tpm_limit?: number;
     rpm_limit?: number;
     metadata?: Record<string, unknown>;
-    object_permission?: TeamObjectPermission;
+    object_permission?: {
+        vector_stores?: string[];
+        mcp_servers?: string[];
+        mcp_access_groups?: string[];
+    };
 }
 export interface UpdateTeamRequest extends Partial<CreateTeamRequest> {
     team_id: string;
     blocked?: boolean;
 }
-export interface CreateTeamResponse {
-    team_id: string;
-    team_alias?: string;
-}
-export interface VirtualKey {
-    key: string;
-    token: string;
-    key_alias?: string;
-    created_at: string;
-    expires_at?: string;
-    spend: number;
-    max_budget?: number;
-    budget_duration?: string;
-    tpm_limit?: number;
-    rpm_limit?: number;
-    models?: string[];
-    user_id?: string;
-    /** Team the key is bound to, when any (mirrors LiteLLM /user/info team_id). */
-    team_id?: string;
-    blocked?: boolean;
-}
 /**
  * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.
  * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes
@@ -113,104 +38,8 @@ export interface LiteLLMUserKey {
     team_id?: string | null;
     created_at: string;
     blocked?: boolean | null;
-}
-export interface ModelInfo {
-    model_name: string;
-    mode: string;
-    supports_function_calling?: boolean;
-    supports_vision?: boolean;
-    input_cost_per_token?: number;
-    output_cost_per_token?: number;
-    max_input_tokens?: number;
-    max_output_tokens?: number;
-    /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */
-    access_groups?: string[];
-}
-export interface UsageModelBreakdown {
-    total_spend: number;
-    total_tokens: number;
-    prompt_tokens: number;
-    completion_tokens: number;
-    api_requests: number;
-    successful_requests: number;
-    failed_requests: number;
-}
-export interface UsageKeyBreakdown {
-    key_alias?: string;
-    team_id?: string | null;
-    models: string[];
-    total_spend: number;
-    total_tokens: number;
-    prompt_tokens: number;
-    completion_tokens: number;
-    api_requests: number;
-    successful_requests: number;
-    failed_requests: number;
-}
-export interface UsageDailyPoint {
-    date: string;
-    spend: number;
-    total_tokens: number;
-    prompt_tokens: number;
-    completion_tokens: number;
-    api_requests: number;
-    successful_requests: number;
-    failed_requests: number;
-}
-export interface UsageDailyModelPoint {
-    date: string;
-    model: string;
-    spend: number;
-    prompt_tokens: number;
-    completion_tokens: number;
-    total_tokens: number;
-    api_requests: number;
-    successful_requests: number;
-    failed_requests: number;
-}
-export interface UsageMetrics {
-    total_spend: number;
-    total_tokens: number;
-    prompt_tokens: number;
-    completion_tokens: number;
-    api_requests: number;
-    successful_requests: number;
-    failed_requests: number;
-    usage_by_model: Record<string, UsageModelBreakdown>;
-    usage_by_key: Record<string, UsageKeyBreakdown>;
-    daily_usage: UsageDailyPoint[];
-    daily_by_model: UsageDailyModelPoint[];
-}
-export interface GenerateKeyRequest {
-    alias?: string;
-    models?: string[];
-    duration?: string;
-    max_budget?: number;
-    tpm_limit?: number;
-    rpm_limit?: number;
-    user_id?: string;
-    team_id?: string;
-    key_type?: string;
-    metadata?: Record<string, string>;
-}
-export interface UpdateKeyRequest {
-    key: string;
-    key_alias?: string;
-    models?: string[];
-    max_budget?: number;
-    tpm_limit?: number;
-    rpm_limit?: number;
-    team_id?: string;
-    duration?: string;
-}
-export interface GenerateKeyResponse {
-    key: string;
-    key_alias?: string;
-    expires_at?: string;
-    max_budget?: number;
-    tpm_limit?: number;
-    rpm_limit?: number;
-    models?: string[];
+    /** Arbitrary metadata stored on the key record. */
+    metadata?: Record<string, unknown> | null;
 }
 export interface DeleteKeyRequest {
     keys: string[];
@@ -267,24 +96,6 @@ export interface CreateUserResponse {
     models?: string[];
     teams?: string[];
 }
-export interface AuditLogEntry {
-    id: string;
-    updated_at: string;
-    changed_by?: string;
-    changed_by_api_key?: string;
-    action?: string;
-    table_name?: string;
-    object_id?: string;
-    before_value?: Record<string, unknown> | null;
-    updated_values?: Record<string, unknown> | null;
-}
-export interface PaginatedAuditLogs {
-    audit_logs: AuditLogEntry[];
-    total: number;
-    page: number;
-    page_size: number;
-    total_pages: number;
-}
 /** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */
 export interface SpendLogEntry {
     request_id?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -30,20 +30,23 @@
   "scripts": {
     "build": "node build.js && tsc -p tsconfig.json",
     "lint": "eslint src --ext .ts",
-    "test": "tsc -p tsconfig.test.json && node --test dist-test/**/*.test.js dist-test/*.test.js",
+    "test": "tsc -p tsconfig.test.json && node --test \"dist-test/**/*.test.js\"",
     "api-report": "npm run build && api-extractor run --local --verbose",
     "prepack": "npm run build",
     "postpack": ""
   },
   "dependencies": {
+    "@acarmisc/backstage-plugin-litellm-common": "0.1.0",
     "@backstage/backend-plugin-api": "^1.9.1",
     "@backstage/catalog-client": "^1.9.0",
     "@backstage/catalog-model": "^1.7.0",
     "@backstage/config": "^1.3.0",
+    "@backstage/errors": "^1.3.0",
     "@backstage/plugin-permission-common": "^0.9.10",
     "@backstage/types": "^1.2.0",
     "express": "^4.18.2",
-    "jose": "^5.9.6"
+    "jose": "^5.9.6",
+    "zod": "^3.22.0"
   },
   "devDependencies": {
     "@backstage/cli": "^0.36.2",

package/dist/permissions.d.ts

@@ -1,11 +0,0 @@
-export declare const litellmKeyCreatePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmKeyRevokePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmKeyManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmAuditReadPermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmTeamCreatePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmTeamManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmTeamMembersManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmTeamKnowledgebaseManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmTeamMcpManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmTeamDeletePermission: import("@backstage/plugin-permission-common").BasicPermission;
-export declare const litellmPermissions: import("@backstage/plugin-permission-common").BasicPermission[];

package/dist/permissions.js

@@ -1,57 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.litellmPermissions = exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = void 0;
-const plugin_permission_common_1 = require("@backstage/plugin-permission-common");
-exports.litellmKeyCreatePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.key.create',
-    attributes: { action: 'create' },
-});
-exports.litellmKeyRevokePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.key.revoke',
-    attributes: { action: 'delete' },
-});
-exports.litellmKeyManagePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.key.manage',
-    attributes: { action: 'update' },
-});
-exports.litellmAuditReadPermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.audit.read',
-    attributes: { action: 'read' },
-});
-// Team-management permissions — delegated to litellm-team-admins group
-exports.litellmTeamCreatePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.team.create',
-    attributes: { action: 'create' },
-});
-exports.litellmTeamManagePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.team.manage',
-    attributes: { action: 'update' },
-});
-exports.litellmTeamMembersManagePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.team.members.manage',
-    attributes: { action: 'update' },
-});
-exports.litellmTeamKnowledgebaseManagePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.team.knowledgebase.manage',
-    attributes: { action: 'update' },
-});
-exports.litellmTeamMcpManagePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.team.mcp.manage',
-    attributes: { action: 'update' },
-});
-exports.litellmTeamDeletePermission = (0, plugin_permission_common_1.createPermission)({
-    name: 'litellm.team.delete',
-    attributes: { action: 'delete' },
-});
-exports.litellmPermissions = [
-    exports.litellmKeyCreatePermission,
-    exports.litellmKeyRevokePermission,
-    exports.litellmKeyManagePermission,
-    exports.litellmAuditReadPermission,
-    exports.litellmTeamCreatePermission,
-    exports.litellmTeamManagePermission,
-    exports.litellmTeamMembersManagePermission,
-    exports.litellmTeamKnowledgebaseManagePermission,
-    exports.litellmTeamMcpManagePermission,
-    exports.litellmTeamDeletePermission,
-];