@acarmisc/backstage-plugin-litellm-backend 0.17.7 → 0.19.0

package/dist/index.cjs.js

@@ -568,9 +568,9 @@ var require_index_cjs = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/webidl-conversions/lib/index.js
+// ../../node_modules/webidl-conversions/lib/index.js
 var require_lib = __commonJS({
-  "../../node_modules/node-fetch/node_modules/webidl-conversions/lib/index.js"(exports2, module2) {
+  "../../node_modules/webidl-conversions/lib/index.js"(exports2, module2) {
     "use strict";
     var conversions = {};
     module2.exports = conversions;
@@ -721,9 +721,9 @@ var require_lib = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/utils.js
+// ../../node_modules/whatwg-url/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/utils.js"(exports2, module2) {
+  "../../node_modules/whatwg-url/lib/utils.js"(exports2, module2) {
     "use strict";
     module2.exports.mixin = function mixin(target, source) {
       const keys = Object.getOwnPropertyNames(source);
@@ -910,9 +910,9 @@ var require_tr46 = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/url-state-machine.js
+// ../../node_modules/whatwg-url/lib/url-state-machine.js
 var require_url_state_machine = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/url-state-machine.js"(exports2, module2) {
+  "../../node_modules/whatwg-url/lib/url-state-machine.js"(exports2, module2) {
     "use strict";
     var punycode = require("punycode");
     var tr46 = require_tr46();
@@ -1982,9 +1982,9 @@ var require_url_state_machine = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL-impl.js
+// ../../node_modules/whatwg-url/lib/URL-impl.js
 var require_URL_impl = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL-impl.js"(exports2) {
+  "../../node_modules/whatwg-url/lib/URL-impl.js"(exports2) {
     "use strict";
     var usm = require_url_state_machine();
     exports2.implementation = class URLImpl {
@@ -2139,9 +2139,9 @@ var require_URL_impl = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL.js
+// ../../node_modules/whatwg-url/lib/URL.js
 var require_URL = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL.js"(exports2, module2) {
+  "../../node_modules/whatwg-url/lib/URL.js"(exports2, module2) {
     "use strict";
     var conversions = require_lib();
     var utils = require_utils();
@@ -2321,9 +2321,9 @@ var require_URL = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/public-api.js
+// ../../node_modules/whatwg-url/lib/public-api.js
 var require_public_api = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/public-api.js"(exports2) {
+  "../../node_modules/whatwg-url/lib/public-api.js"(exports2) {
     "use strict";
     exports2.URL = require_URL().interface;
     exports2.serializeURL = require_url_state_machine().serializeURL;
@@ -7976,7 +7976,6 @@ __export(index_exports, {
   ProvisioningError: () => ProvisioningError,
   applyRoleOverrides: () => applyRoleOverrides,
   assertTeamAdmin: () => assertTeamAdmin,
-  bridgeGenerateKey: () => bridgeGenerateKey,
   bridgeListKeys: () => bridgeListKeys,
   createRouter: () => createRouter,
   default: () => litellmPlugin,
@@ -7998,7 +7997,6 @@ __export(index_exports, {
   litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
-  normalizeRequestTags: () => normalizeRequestTags,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
   readProvisioningDefaults: () => readProvisioningDefaults,
@@ -8024,16 +8022,11 @@ var import_backend_plugin_api = require("@backstage/backend-plugin-api");
 // src/router.ts
 var import_express = __toESM(require("express"));
 var import_plugin_permission_common2 = __toESM(require_index_cjs2());
-var import_errors20 = __toESM(require_index_cjs());
+var import_errors21 = __toESM(require_index_cjs());
 var import_catalog_client = require("@backstage/catalog-client");
 
 // src/client.ts
 var DEFAULT_TIMEOUT = 3e4;
-function normalizeRequestTags(tags) {
-  if (!tags) return [];
-  if (Array.isArray(tags)) return tags.filter((t) => typeof t === "string");
-  return Object.entries(tags).map(([k, v]) => `${k}:${v}`);
-}
 var LiteLLMUpstreamError = class extends Error {
   constructor(status, statusText, body) {
     let message2 = `LiteLLM API error: ${status} ${statusText}`;
@@ -8089,6 +8082,29 @@ var LiteLLMClient = class {
       clearTimeout(timeoutId);
     }
   }
+  /**
+   * Normalizes a raw LiteLLM user response to the UserInfo contract.
+   * Handles both `/user/info` (with `user_info` wrapper) and `/user/list`
+   * response shapes, and converts team arrays to team_id strings.
+   */
+  normalizeUserInfo(raw, fallbackUserId) {
+    const inner = raw?.user_info ?? {};
+    const teamIds = Array.isArray(raw?.teams) ? raw.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
+    return {
+      user_id: raw?.user_id ?? inner.user_id ?? fallbackUserId ?? "",
+      user_email: inner.user_email ?? raw?.user_email,
+      email: inner.email ?? raw?.email,
+      teams: teamIds,
+      models: inner.models ?? raw?.models,
+      max_budget: inner.max_budget ?? raw?.max_budget,
+      budget_duration: inner.budget_duration ?? raw?.budget_duration,
+      budget_reset_at: inner.budget_reset_at ?? raw?.budget_reset_at,
+      spend: inner.spend ?? raw?.spend,
+      current_spend: inner.current_spend ?? raw?.current_spend,
+      soft_limit: inner.soft_limit ?? raw?.soft_limit,
+      hard_limit: inner.hard_limit ?? raw?.hard_limit
+    };
+  }
   /**
    * Returns null when the user is not found in LiteLLM (404).
    * Throws on all other errors so callers know something went wrong.
@@ -8102,22 +8118,7 @@ var LiteLLMClient = class {
     const query = userId ? `?user_id=${encodeURIComponent(userId)}` : "";
     try {
       const raw = await this.request(`/user/info${query}`);
-      const inner = raw?.user_info ?? {};
-      const teamIds = Array.isArray(raw?.teams) ? raw.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
-      return {
-        user_id: raw?.user_id ?? inner.user_id ?? userId ?? "",
-        user_email: inner.user_email ?? raw?.user_email,
-        email: inner.email ?? raw?.email,
-        teams: teamIds,
-        models: inner.models ?? raw?.models,
-        max_budget: inner.max_budget ?? raw?.max_budget,
-        budget_duration: inner.budget_duration ?? raw?.budget_duration,
-        budget_reset_at: inner.budget_reset_at ?? raw?.budget_reset_at,
-        spend: inner.spend ?? raw?.spend,
-        current_spend: inner.current_spend ?? raw?.current_spend,
-        soft_limit: inner.soft_limit ?? raw?.soft_limit,
-        hard_limit: inner.hard_limit ?? raw?.hard_limit
-      };
+      return this.normalizeUserInfo(raw, userId);
     } catch (err) {
       if (err instanceof LiteLLMUpstreamError && err.status === 404) return null;
       throw err;
@@ -8144,22 +8145,7 @@ var LiteLLMClient = class {
         (u) => (u.user_email ?? u.email ?? "").toLowerCase() === email.toLowerCase()
       );
       if (!found) return null;
-      const inner = found.user_info ?? {};
-      const teamIds = Array.isArray(found.teams) ? found.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
-      return {
-        user_id: found.user_id ?? inner.user_id ?? "",
-        user_email: inner.user_email ?? found.user_email,
-        email: inner.email ?? found.email,
-        teams: teamIds,
-        models: inner.models ?? found.models,
-        max_budget: inner.max_budget ?? found.max_budget,
-        budget_duration: inner.budget_duration ?? found.budget_duration,
-        budget_reset_at: inner.budget_reset_at ?? found.budget_reset_at,
-        spend: inner.spend ?? found.spend,
-        current_spend: inner.current_spend ?? found.current_spend,
-        soft_limit: inner.soft_limit ?? found.soft_limit,
-        hard_limit: inner.hard_limit ?? found.hard_limit
-      };
+      return this.normalizeUserInfo(found);
     } catch (err) {
       if (err instanceof LiteLLMUpstreamError && err.status === 404) return null;
       throw err;
@@ -8423,18 +8409,6 @@ var LiteLLMClient = class {
       body: JSON.stringify({ team_ids: [teamId] })
     });
   }
-  async blockTeam(teamId) {
-    return this.request("/team/block", {
-      method: "POST",
-      body: JSON.stringify({ team_id: teamId })
-    });
-  }
-  async unblockTeam(teamId) {
-    return this.request("/team/unblock", {
-      method: "POST",
-      body: JSON.stringify({ team_id: teamId })
-    });
-  }
   /**
    * Adds a member to a team. LiteLLM's `/team/member_add` nests the member
    * under a `member` object; `role` is 'user' or 'admin' (we only ever send
@@ -8498,43 +8472,6 @@ var LiteLLMClient = class {
       url: r?.url ?? void 0
     })).filter((r) => r.id);
   }
-  /**
-   * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
-   * by date range and optionally by key/user/team. Rows are normalised so
-   * `request_tags` is always a `string[]` (LiteLLM returns either an array
-   * or an object depending on version) — callers group by tag to attribute
-   * spend to a conversation or caller.
-   *
-   * This is the admin/DB-backed endpoint: it can return a large number of
-   * rows, so callers should keep the date window tight and cap `page_size`.
-   */
-  async getSpendLogs(params) {
-    const query = new URLSearchParams({
-      start_date: params.start_date,
-      end_date: params.end_date
-    });
-    if (params.api_key) query.append("api_key", params.api_key);
-    if (params.user_id) query.append("user_id", params.user_id);
-    if (params.team_id) query.append("team_id", params.team_id);
-    if (params.page_size) query.append("page_size", String(params.page_size));
-    const raw = await this.request(`/spend/logs?${query.toString()}`);
-    const rows = Array.isArray(raw) ? raw : raw?.data ?? [];
-    return rows.map((row) => ({
-      request_id: row?.request_id,
-      startTime: row?.startTime ?? row?.start_time,
-      endTime: row?.endTime ?? row?.end_time,
-      spend: row?.spend ?? 0,
-      total_tokens: row?.total_tokens ?? 0,
-      prompt_tokens: row?.prompt_tokens ?? 0,
-      completion_tokens: row?.completion_tokens ?? 0,
-      model: row?.model,
-      api_key: row?.api_key,
-      user: row?.user,
-      team_id: row?.team_id,
-      request_tags: normalizeRequestTags(row?.request_tags),
-      metadata: row?.metadata
-    }));
-  }
   emptyUsage() {
     return {
       total_spend: 0,
@@ -8698,6 +8635,114 @@ var LiteLLMClient = class {
   }
 };
 
+// src/errors.ts
+var HTML_TAG_PATTERN = /<[^>]*>|&[a-z]+;/gi;
+function isHttpishError(error) {
+  return error !== null && typeof error === "object" && "status" in error && "body" in error && typeof error.status === "number" && // any: property access after guard check
+  typeof error.body === "object";
+}
+function sanitizeUpstreamMessage(msg) {
+  if (!msg || typeof msg !== "string") return "";
+  return msg.replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, "Bearer [redacted]").replace(/sk-[A-Za-z0-9_\-]{8,}/g, "sk-[redacted]").replace(HTML_TAG_PATTERN, "").replace(/\s+/g, " ").trim().slice(0, 500);
+}
+function toHttpError(error) {
+  if (isHttpishError(error)) {
+    return {
+      status: error.status,
+      body: error.body,
+      logLevel: "warn"
+    };
+  }
+  if (error instanceof LiteLLMUpstreamError) {
+    if (error.status === 401 || error.status === 403) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM rejected the request" },
+        logLevel: "warn"
+      };
+    }
+    if (error.status >= 500 || error.status < 100) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM is unavailable" },
+        logLevel: "error"
+      };
+    }
+    return {
+      status: error.status === 404 || error.status === 409 ? error.status : 400,
+      body: {
+        error: sanitizeUpstreamMessage(error.message),
+        ...error.param ? { param: error.param } : {}
+      },
+      logLevel: "warn"
+    };
+  }
+  if (error && typeof error === "object" && "name" in error && "message" in error) {
+    const name = error.name;
+    const message3 = String(error.message);
+    if (name === "InputError") {
+      return {
+        status: 400,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "NotAllowedError") {
+      return {
+        status: 403,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "NotFoundError") {
+      return {
+        status: 404,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "ConflictError") {
+      return {
+        status: 409,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+  }
+  if (error instanceof Error) {
+    const code = error.code;
+    const cause = error.cause;
+    const networkCodes = ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "ETIMEDOUT", "EAI_AGAIN", "UND_ERR_CONNECT_TIMEOUT"];
+    if (error.name === "AbortError" || error.name === "TimeoutError" || error.name === "TypeError" && error.message === "fetch failed" || typeof code === "string" && networkCodes.includes(code) || typeof cause?.code === "string" && networkCodes.includes(cause.code)) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM is unavailable" },
+        logLevel: "error",
+        _logMessage: error.message
+      };
+    }
+  }
+  const message2 = error instanceof Error ? error.message : String(error);
+  return {
+    status: 500,
+    body: { error: "Internal error" },
+    logLevel: "error",
+    _logMessage: message2
+  };
+}
+function sendError(res, error, logger, context) {
+  const { status, body, logLevel, _logMessage } = toHttpError(error);
+  const realMessage = _logMessage || (error instanceof Error ? error.message : String(error));
+  if (logLevel === "error") {
+    logger.error(`Failed to ${context}`, error instanceof Error ? error : new Error(String(error)));
+  } else if (logLevel === "warn") {
+    logger.warn(`${context}: ${realMessage}`);
+  } else {
+    logger.info(`${context}: ${realMessage}`);
+  }
+  res.status(status).json(body);
+}
+
 // src/provisioning.ts
 function toLiteLLMUserId(userEntityRef, userIdDomain) {
   const name = userEntityRef.split("/").pop() ?? userEntityRef;
@@ -8754,8 +8799,9 @@ function readProvisioningDefaults(config) {
   return { enabled, defaults };
 }
 async function resolveUserId(req, auth) {
-  const rawToken = req.headers.authorization?.slice(7);
-  if (!rawToken) return void 0;
+  const authHeader = req.headers.authorization ?? "";
+  if (!authHeader.startsWith("Bearer ")) return void 0;
+  const rawToken = authHeader.slice(7);
   try {
     const credentials = await auth.authenticate(rawToken);
     const principal = credentials.principal;
@@ -8767,8 +8813,9 @@ async function resolveUserId(req, auth) {
   return void 0;
 }
 async function resolveCredentials(req, auth) {
-  const rawToken = req.headers.authorization?.slice(7);
-  if (!rawToken) return void 0;
+  const authHeader = req.headers.authorization ?? "";
+  if (!authHeader.startsWith("Bearer ")) return void 0;
+  const rawToken = authHeader.slice(7);
   try {
     return await auth.authenticate(rawToken);
   } catch {
@@ -8847,10 +8894,6 @@ async function provisionUser(client, userId, defaults, profile, backstageEntity,
   }
 }
 var provisioningInFlight = /* @__PURE__ */ new Map();
-function sanitizeUpstreamMessage(message2) {
-  if (!message2) return "unknown error";
-  return message2.replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, "Bearer [redacted]").replace(/sk-[A-Za-z0-9_\-]{8,}/g, "sk-[redacted]").slice(0, 500);
-}
 var ProvisioningError = class extends Error {
   constructor(message2, hint, provisioning, status = 404) {
     super(message2);
@@ -9050,7 +9093,10 @@ function readTeamAdminConfig(config) {
     allowedMcpAccessGroups: config.getOptionalStringArray(
       "litellm.teamAdmin.allowedMcpAccessGroups"
     ) ?? [],
-    allowTeamDelete: config.getOptionalBoolean("litellm.teamAdmin.allowTeamDelete") ?? false
+    allowTeamDelete: config.getOptionalBoolean("litellm.teamAdmin.allowTeamDelete") ?? false,
+    readOnly: config.getOptionalBoolean("litellm.teamAdmin.readOnly") ?? false,
+    createGroups: config.getOptionalStringArray("litellm.teamAdmin.createGroups") ?? [],
+    memberManagerRoles: config.getOptionalStringArray("litellm.teamAdmin.memberManagerRoles") ?? []
   };
 }
 function validateTeamWriteInput(input, cfg) {
@@ -9251,114 +9297,6 @@ function readOpencodeConfig(config) {
   };
 }
 
-// src/errors.ts
-var HTML_TAG_PATTERN = /<[^>]*>|&[a-z]+;/gi;
-function isHttpishError(error) {
-  return error !== null && typeof error === "object" && "status" in error && "body" in error && typeof error.status === "number" && // any: property access after guard check
-  typeof error.body === "object";
-}
-function sanitizeUpstreamMessage2(msg) {
-  if (!msg || typeof msg !== "string") return "";
-  return msg.replace(HTML_TAG_PATTERN, "").replace(/\s+/g, " ").trim().slice(0, 500);
-}
-function toHttpError(error) {
-  if (isHttpishError(error)) {
-    return {
-      status: error.status,
-      body: error.body,
-      logLevel: "warn"
-    };
-  }
-  if (error instanceof LiteLLMUpstreamError) {
-    if (error.status === 401 || error.status === 403) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM rejected the request" },
-        logLevel: "warn"
-      };
-    }
-    if (error.status >= 500 || error.status < 100) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM is unavailable" },
-        logLevel: "error"
-      };
-    }
-    return {
-      status: error.status === 404 || error.status === 409 ? error.status : 400,
-      body: {
-        error: sanitizeUpstreamMessage2(error.message),
-        ...error.param ? { param: error.param } : {}
-      },
-      logLevel: "warn"
-    };
-  }
-  if (error && typeof error === "object" && "name" in error && "message" in error) {
-    const name = error.name;
-    const message3 = String(error.message);
-    if (name === "InputError") {
-      return {
-        status: 400,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "NotAllowedError") {
-      return {
-        status: 403,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "NotFoundError") {
-      return {
-        status: 404,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "ConflictError") {
-      return {
-        status: 409,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-  }
-  if (error instanceof Error) {
-    const code = error.code;
-    const cause = error.cause;
-    const networkCodes = ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "ETIMEDOUT", "EAI_AGAIN", "UND_ERR_CONNECT_TIMEOUT"];
-    if (error.name === "AbortError" || error.name === "TimeoutError" || error.name === "TypeError" && error.message === "fetch failed" || typeof code === "string" && networkCodes.includes(code) || typeof cause?.code === "string" && networkCodes.includes(cause.code)) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM is unavailable" },
-        logLevel: "error",
-        _logMessage: error.message
-      };
-    }
-  }
-  const message2 = error instanceof Error ? error.message : String(error);
-  return {
-    status: 500,
-    body: { error: "Internal error" },
-    logLevel: "error",
-    _logMessage: message2
-  };
-}
-function sendError(res, error, logger, context) {
-  const { status, body, logLevel, _logMessage } = toHttpError(error);
-  const realMessage = _logMessage || (error instanceof Error ? error.message : String(error));
-  if (logLevel === "error") {
-    logger.error(`Failed to ${context}`, error instanceof Error ? error : new Error(String(error)));
-  } else if (logLevel === "warn") {
-    logger.warn(`${context}: ${realMessage}`);
-  } else {
-    logger.info(`${context}: ${realMessage}`);
-  }
-  res.status(status).json(body);
-}
-
 // src/routes/middleware/withUser.ts
 function createRequireUser(ctx) {
   return async (req, res, next) => {
@@ -9795,7 +9733,9 @@ function registerConfigRoutes(router, ctx) {
         enabled: ctx.teamMgmtEnabled,
         maxBudgetCeiling: ctx.teamAdminCfg.maxBudgetCeiling,
         allowUnlimitedBudget: ctx.teamAdminCfg.allowUnlimitedBudget,
-        objectPermissionsEnabled: ctx.objectPermsEnabled
+        objectPermissionsEnabled: ctx.objectPermsEnabled,
+        readOnly: ctx.teamAdminCfg.readOnly,
+        memberManagerRoles: ctx.teamAdminCfg.memberManagerRoles
       },
       display: {
         hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,
@@ -9892,56 +9832,9 @@ async function createKeyForUser(user, input, ctx) {
     config,
     catalogClient,
     auth,
-    logger,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs
+    logger
   } = ctx;
-  let userInfo;
-  if (catalogClient !== void 0 && catalogClient !== null && auth !== void 0 && auth !== null) {
-    userInfo = await getOrProvisionUser(
-      client,
-      user.tokenEntityRef || "",
-      user.userId,
-      provisioningEnabled,
-      provisioningDefaults,
-      roleConfigs,
-      catalogClient,
-      auth,
-      logger
-    );
-  } else {
-    userInfo = await client.getUserInfo(user.userId);
-    if (!userInfo) {
-      if (!provisioningEnabled) {
-        throw new KeyServiceError(
-          404,
-          {
-            error: "User not found in LiteLLM",
-            detail: "No LiteLLM user for this identity. Log in to Backstage once to be provisioned, or enable litellm.provisioning.enabled."
-          }
-        );
-      }
-      const created = await client.createUser({
-        user_id: user.userId,
-        user_email: user.userId,
-        max_budget: provisioningDefaults.maxBudget,
-        budget_duration: provisioningDefaults.budgetDuration,
-        models: provisioningDefaults.models,
-        teams: provisioningDefaults.teams?.length ? [provisioningDefaults.teams[0]] : []
-      });
-      if (!created) {
-        throw new KeyServiceError(
-          500,
-          {
-            error: "User provisioning failed",
-            detail: "Failed to create user in LiteLLM"
-          }
-        );
-      }
-      userInfo = await client.getUserInfo(user.userId);
-    }
-  }
+  const userInfo = user.userInfo;
   if (!config.allowUnlimitedBudget && (input.max_budget === null || input.max_budget === void 0)) {
     throw new KeyServiceError(
       400,
@@ -9987,13 +9880,15 @@ async function createKeyForUser(user, input, ctx) {
   }
   const profile = user.tokenEntityRef && catalogClient !== void 0 && catalogClient !== null && auth !== void 0 && auth !== null ? await resolveUserProfile(user.tokenEntityRef, catalogClient, auth, logger) : {};
   const clientMetadata = input.metadata ?? {};
+  const createdVia = user.createdVia ?? "backstage";
   const serverMetadata = {
-    created_by_backstage_user: user.tokenEntityRef ?? "unknown",
+    ...user.tokenEntityRef && { created_by_backstage_user: user.tokenEntityRef },
+    ...!user.tokenEntityRef && { created_by: userInfo.user_id },
     ...profile.email && { created_by_email: profile.email },
     ...profile.displayName && {
       created_by_display_name: profile.displayName
     },
-    created_via: "backstage",
+    created_via: createdVia,
     created_at_iso: (/* @__PURE__ */ new Date()).toISOString()
   };
   const enrichedMetadata = {
@@ -10002,7 +9897,7 @@ async function createKeyForUser(user, input, ctx) {
   };
   const upstreamRequest = {
     alias: input.alias,
-    user_id: user.userId
+    user_id: userInfo.user_id
   };
   if (input.models !== void 0) {
     upstreamRequest.models = input.models;
@@ -10027,7 +9922,7 @@ async function createKeyForUser(user, input, ctx) {
   }
   upstreamRequest.metadata = enrichedMetadata;
   const result = await client.generateKey(upstreamRequest);
-  logger.info("key.generate", { userId: user.userId, keyAlias: input.alias });
+  logger.info("key.generate", { userId: userInfo.user_id, keyAlias: input.alias });
   return result;
 }
 
@@ -10038,17 +9933,12 @@ function registerKeysRoutes(router, ctx) {
     catalogClient,
     auth,
     logger,
-    userIdDomain,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs,
     auditGroup,
     allowUnlimitedBudget,
     teamRequired,
     allowOwnerResetSpend,
     keyValidationConfig,
     authorizeKeyAction,
-    sendOwnershipError,
     assertPermission,
     sendPermissionDenied
   } = ctx;
@@ -10120,7 +10010,7 @@ function registerKeysRoutes(router, ctx) {
           const keyId = key.token ?? key.key;
           let errorMsg = "Unknown error";
           if (err instanceof Error) {
-            errorMsg = sanitizeUpstreamMessage2(err.message) || "Unknown error";
+            errorMsg = sanitizeUpstreamMessage(err.message) || "Unknown error";
           }
           failures.push({ keyId, error: errorMsg });
           logger.warn("key.prune-expired failed", {
@@ -10160,7 +10050,7 @@ function registerKeysRoutes(router, ctx) {
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
-      const resolvedUserId = res.locals.userId;
+      const userInfo = await getProvisionedUser(ctx, res);
       const keyCreateCtx = {
         client,
         config: {
@@ -10170,14 +10060,10 @@ function registerKeysRoutes(router, ctx) {
         catalogClient,
         auth,
         logger,
-        keyValidationConfig,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        userIdDomain
+        keyValidationConfig
       };
       const result = await createKeyForUser(
-        { tokenEntityRef, userId: resolvedUserId },
+        { tokenEntityRef, userInfo },
         input,
         keyCreateCtx
       );
@@ -10277,7 +10163,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.update", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json(result);
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "update key");
     }
   });
@@ -10297,7 +10182,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.delete", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "delete key");
     }
   });
@@ -10326,7 +10210,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.block", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "block key");
     }
   });
@@ -10351,7 +10234,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.unblock", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "unblock key");
     }
   });
@@ -10373,7 +10255,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.reset_spend", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "reset key spend");
     }
   });
@@ -10433,23 +10314,11 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "start_date and end_date are required" });
         return;
       }
-      const tokenEntityRef = res.locals.tokenEntityRef;
-      const userId = res.locals.userId;
-      await getOrProvisionUser(
-        client,
-        tokenEntityRef,
-        userId,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        catalogClient,
-        auth,
-        logger
-      );
+      await getProvisionedUser(ctx, res);
       const usage = await client.getUsage(
         start_date,
         end_date,
-        userId
+        res.locals.userId
       );
       res.json(usage);
     } catch (error) {
@@ -10671,6 +10540,10 @@ function registerOpencodeRoutes(router, ctx) {
 var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/http/respondTeam.ts
+function respondTeam(res, team, ctx, caller) {
+  const shouldHide = caller === "member" ? ctx.teamBudgetVisibility.hideTeamBudgetForMembers : ctx.teamBudgetVisibility.hideTeamBudgetForManagers;
+  res.json(shouldHide ? redactTeamBudget(team) : team);
+}
 function respondTeamList(res, teams, ctx, caller) {
   const shouldHide = caller === "member" ? ctx.teamBudgetVisibility.hideTeamBudgetForMembers : ctx.teamBudgetVisibility.hideTeamBudgetForManagers;
   res.json(shouldHide ? teams.map(redactTeamBudget) : teams);
@@ -10711,7 +10584,6 @@ function registerTeamsRoutes(router, ctx) {
     provisioningDefaults,
     roleConfigs,
     teamAdminCfg,
-    teamBudgetVisibility,
     requireTeamMgmt,
     sendTeamError,
     authorizeTeamSubresource
@@ -10748,6 +10620,12 @@ function registerTeamsRoutes(router, ctx) {
       res.status(500).json({ error: "Team management is misconfigured (group is missing)" });
       return;
     }
+    if (teamAdminCfg.readOnly) {
+      res.status(403).json({
+        error: "Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage"
+      });
+      return;
+    }
     const check = await assertTeamAdmin({
       req,
       auth,
@@ -10761,6 +10639,19 @@ function registerTeamsRoutes(router, ctx) {
       res.status(check.status).json({ error: check.error });
       return;
     }
+    if (teamAdminCfg.createGroups.length > 0) {
+      const memberships = await Promise.all(
+        teamAdminCfg.createGroups.map(
+          (group) => isUserMemberOfGroup(check.userEntityRef, group, catalogClient, auth, logger)
+        )
+      );
+      if (!memberships.some(Boolean)) {
+        res.status(403).json({
+          error: `Access denied: team creation is limited to ${teamAdminCfg.createGroups.join(", ")}`
+        });
+        return;
+      }
+    }
     const v = validateTeamWriteInput(req.body ?? {}, teamAdminCfg);
     if (!v.ok) {
       res.status(400).json({ error: v.error });
@@ -10772,7 +10663,7 @@ function registerTeamsRoutes(router, ctx) {
       logger.info(`Team creation already in flight for ${key} \u2014 joining`);
       try {
         const result = await pending;
-        res.json(result);
+        respondTeam(res, result, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -10804,9 +10695,7 @@ function registerTeamsRoutes(router, ctx) {
     teamCreateInFlight.set(key, createPromise);
     try {
       const result = await createPromise;
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(result) : result
-      );
+      respondTeam(res, result, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     } finally {
@@ -10849,9 +10738,7 @@ function registerTeamsRoutes(router, ctx) {
         teamId,
         owningGroup
       });
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(r) : r
-      );
+      respondTeam(res, r, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -10913,9 +10800,7 @@ function registerTeamsRoutes(router, ctx) {
       const owned = all.filter(
         (t) => typeof t.metadata?.owning_group === "string" && t.metadata.owning_group === teamAdminCfg.group
       );
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? owned.map(redactTeamBudget) : owned
-      );
+      respondTeamList(res, owned, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -10923,9 +10808,14 @@ function registerTeamsRoutes(router, ctx) {
   router.post(
     "/teams/:teamId/members",
     async (req, res) => {
-      const authz = await authorizeTeamSubresource(req, res, import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission);
+      const authz = await authorizeTeamSubresource(
+        req,
+        res,
+        import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission,
+        { allowTeamRole: true }
+      );
       if (!authz) return;
-      const { teamId, owningGroup, actor } = authz;
+      const { teamId, owningGroup, actor, via } = authz;
       const body = req.body ?? {};
       const userEntityRef = (body.userEntityRef ?? "").trim();
       if (!userEntityRef) {
@@ -10945,6 +10835,12 @@ function registerTeamsRoutes(router, ctx) {
           return;
         }
         maxBudgetInTeam = body.maxBudgetInTeam;
+        if (via === "teamRole") {
+          res.status(403).json({
+            error: "Team member managers cannot set member budgets"
+          });
+          return;
+        }
       }
       try {
         const { token } = await auth.getPluginRequestToken({
@@ -11003,12 +10899,11 @@ function registerTeamsRoutes(router, ctx) {
           actor,
           teamId,
           member: litellmUserId,
-          owningGroup
+          owningGroup,
+          via
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11017,15 +10912,35 @@ function registerTeamsRoutes(router, ctx) {
   router.delete(
     "/teams/:teamId/members",
     async (req, res) => {
-      const authz = await authorizeTeamSubresource(req, res, import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission);
+      const authz = await authorizeTeamSubresource(
+        req,
+        res,
+        import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission,
+        { allowTeamRole: true }
+      );
       if (!authz) return;
-      const { teamId, owningGroup, actor } = authz;
+      const { teamId, owningGroup, actor, team, via } = authz;
       const userEntityRef = String(req.query.userEntityRef ?? "").trim();
       if (!userEntityRef) {
         res.status(400).json({ error: "userEntityRef query parameter is required" });
         return;
       }
       const litellmUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
+      if (via === "teamRole") {
+        if (litellmUserId === toLiteLLMUserId(actor, userIdDomain)) {
+          res.status(400).json({ error: "You cannot remove yourself from the team" });
+          return;
+        }
+        const role = team.members_with_roles?.find(
+          (m) => m.user_id === litellmUserId
+        )?.role;
+        if (role && teamAdminCfg.memberManagerRoles.includes(role)) {
+          res.status(403).json({
+            error: `Only platform team admins can remove a team ${role}`
+          });
+          return;
+        }
+      }
       try {
         await client.teamMemberDelete({
           team_id: teamId,
@@ -11035,12 +10950,11 @@ function registerTeamsRoutes(router, ctx) {
           actor,
           teamId,
           member: litellmUserId,
-          owningGroup
+          owningGroup,
+          via
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11058,7 +10972,6 @@ function registerObjectPermissionsRoutes(router, ctx) {
     permissions,
     logger,
     teamAdminCfg,
-    teamBudgetVisibility,
     requireObjectPerms,
     sendTeamError,
     authorizeTeamSubresource
@@ -11139,9 +11052,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
           owningGroup,
           vector_stores: requested
         });
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11225,9 +11136,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
           before,
           after: requested
         });
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11242,9 +11151,6 @@ function registerTeamUsageRoutes(router, ctx) {
     catalogClient,
     auth,
     logger,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs,
     teamBudgetVisibility
   } = ctx;
   const requireUser = createRequireUser(ctx);
@@ -11257,18 +11163,7 @@ function registerTeamUsageRoutes(router, ctx) {
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
-      const userId = res.locals.userId;
-      const userInfo = await getOrProvisionUser(
-        client,
-        tokenEntityRef,
-        userId,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        catalogClient,
-        auth,
-        logger
-      );
+      const userInfo = await getProvisionedUser(ctx, res);
       const isMember = userInfo?.teams?.includes(teamId) ?? false;
       let isManager = false;
       const managerCheckNeeded = ctx.teamMgmtEnabled && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
@@ -11314,10 +11209,10 @@ function registerTeamUsageRoutes(router, ctx) {
   });
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/base64url.js
+// node_modules/jose/dist/node/esm/runtime/base64url.js
 var import_node_buffer = require("node:buffer");
 
-// ../../node_modules/jose/dist/node/esm/lib/buffer_utils.js
+// node_modules/jose/dist/node/esm/lib/buffer_utils.js
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 var MAX_INT32 = 2 ** 32;
@@ -11332,7 +11227,7 @@ function concat(...buffers) {
   return buf;
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/base64url.js
+// node_modules/jose/dist/node/esm/runtime/base64url.js
 function normalize(input) {
   let encoded = input;
   if (encoded instanceof Uint8Array) {
@@ -11342,7 +11237,7 @@ function normalize(input) {
 }
 var decode = (input) => new Uint8Array(import_node_buffer.Buffer.from(normalize(input), "base64url"));
 
-// ../../node_modules/jose/dist/node/esm/util/errors.js
+// node_modules/jose/dist/node/esm/util/errors.js
 var JOSEError = class extends Error {
   static code = "ERR_JOSE_GENERIC";
   code = "ERR_JOSE_GENERIC";
@@ -11428,18 +11323,18 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
   }
 };
 
-// ../../node_modules/jose/dist/node/esm/runtime/is_key_object.js
+// node_modules/jose/dist/node/esm/runtime/is_key_object.js
 var util = __toESM(require("node:util"), 1);
 var is_key_object_default = (obj) => util.types.isKeyObject(obj);
 
-// ../../node_modules/jose/dist/node/esm/runtime/webcrypto.js
+// node_modules/jose/dist/node/esm/runtime/webcrypto.js
 var crypto = __toESM(require("node:crypto"), 1);
 var util2 = __toESM(require("node:util"), 1);
 var webcrypto2 = crypto.webcrypto;
 var webcrypto_default = webcrypto2;
 var isCryptoKey = (key) => util2.types.isCryptoKey(key);
 
-// ../../node_modules/jose/dist/node/esm/lib/crypto_key.js
+// node_modules/jose/dist/node/esm/lib/crypto_key.js
 function unusable(name, prop = "algorithm.name") {
   return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -11538,7 +11433,7 @@ function checkSigCryptoKey(key, alg, ...usages) {
   checkUsage(key, usages);
 }
 
-// ../../node_modules/jose/dist/node/esm/lib/invalid_key_input.js
+// node_modules/jose/dist/node/esm/lib/invalid_key_input.js
 function message(msg, actual, ...types4) {
   types4 = types4.filter(Boolean);
   if (types4.length > 2) {
@@ -11567,14 +11462,14 @@ function withAlg(alg, actual, ...types4) {
   return message(`Key for the ${alg} algorithm must be `, actual, ...types4);
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/is_key_like.js
+// node_modules/jose/dist/node/esm/runtime/is_key_like.js
 var is_key_like_default = (key) => is_key_object_default(key) || isCryptoKey(key);
 var types3 = ["KeyObject"];
 if (globalThis.CryptoKey || webcrypto_default?.CryptoKey) {
   types3.push("CryptoKey");
 }
 
-// ../../node_modules/jose/dist/node/esm/lib/is_disjoint.js
+// node_modules/jose/dist/node/esm/lib/is_disjoint.js
 var isDisjoint = (...headers) => {
   const sources = headers.filter(Boolean);
   if (sources.length === 0 || sources.length === 1) {
@@ -11598,7 +11493,7 @@ var isDisjoint = (...headers) => {
 };
 var is_disjoint_default = isDisjoint;
 
-// ../../node_modules/jose/dist/node/esm/lib/is_object.js
+// node_modules/jose/dist/node/esm/lib/is_object.js
 function isObjectLike(value) {
   return typeof value === "object" && value !== null;
 }
@@ -11616,10 +11511,10 @@ function isObject(input) {
   return Object.getPrototypeOf(input) === proto;
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/get_named_curve.js
+// node_modules/jose/dist/node/esm/runtime/get_named_curve.js
 var import_node_crypto = require("node:crypto");
 
-// ../../node_modules/jose/dist/node/esm/lib/is_jwk.js
+// node_modules/jose/dist/node/esm/lib/is_jwk.js
 function isJWK(key) {
   return isObject(key) && typeof key.kty === "string";
 }
@@ -11633,7 +11528,7 @@ function isSecretJWK(key) {
   return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/get_named_curve.js
+// node_modules/jose/dist/node/esm/runtime/get_named_curve.js
 var namedCurveToJOSE = (namedCurve) => {
   switch (namedCurve) {
     case "prime256v1":
@@ -11682,7 +11577,7 @@ var getNamedCurve2 = (kee, raw) => {
 };
 var get_named_curve_default = getNamedCurve2;
 
-// ../../node_modules/jose/dist/node/esm/runtime/check_key_length.js
+// node_modules/jose/dist/node/esm/runtime/check_key_length.js
 var import_node_crypto2 = require("node:crypto");
 var check_key_length_default = (key, alg) => {
   let modulusLength;
@@ -11699,7 +11594,7 @@ var check_key_length_default = (key, alg) => {
   }
 };
 
-// ../../node_modules/jose/dist/node/esm/runtime/jwk_to_key.js
+// node_modules/jose/dist/node/esm/runtime/jwk_to_key.js
 var import_node_crypto3 = require("node:crypto");
 var parse = (key) => {
   if (key.d) {
@@ -11709,7 +11604,7 @@ var parse = (key) => {
 };
 var jwk_to_key_default = parse;
 
-// ../../node_modules/jose/dist/node/esm/key/import.js
+// node_modules/jose/dist/node/esm/key/import.js
 async function importJWK(jwk, alg) {
   if (!isObject(jwk)) {
     throw new TypeError("JWK must be an object");
@@ -11733,7 +11628,7 @@ async function importJWK(jwk, alg) {
   }
 }
 
-// ../../node_modules/jose/dist/node/esm/lib/check_key_type.js
+// node_modules/jose/dist/node/esm/lib/check_key_type.js
 var tag = (key) => key?.[Symbol.toStringTag];
 var jwkMatchesOp = (alg, key, usage) => {
   if (key.use !== void 0 && key.use !== "sig") {
@@ -11805,7 +11700,7 @@ function checkKeyType(allowJwk, alg, key, usage) {
 var check_key_type_default = checkKeyType.bind(void 0, false);
 var checkKeyTypeWithJwk = checkKeyType.bind(void 0, true);
 
-// ../../node_modules/jose/dist/node/esm/lib/validate_crit.js
+// node_modules/jose/dist/node/esm/lib/validate_crit.js
 function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
   if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
     throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
@@ -11837,7 +11732,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
 }
 var validate_crit_default = validateCrit;
 
-// ../../node_modules/jose/dist/node/esm/lib/validate_algorithms.js
+// node_modules/jose/dist/node/esm/lib/validate_algorithms.js
 var validateAlgorithms = (option, algorithms) => {
   if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
     throw new TypeError(`"${option}" option must be an array of strings`);
@@ -11849,11 +11744,11 @@ var validateAlgorithms = (option, algorithms) => {
 };
 var validate_algorithms_default = validateAlgorithms;
 
-// ../../node_modules/jose/dist/node/esm/runtime/verify.js
+// node_modules/jose/dist/node/esm/runtime/verify.js
 var crypto3 = __toESM(require("node:crypto"), 1);
 var import_node_util2 = require("node:util");
 
-// ../../node_modules/jose/dist/node/esm/runtime/dsa_digest.js
+// node_modules/jose/dist/node/esm/runtime/dsa_digest.js
 function dsaDigest(alg) {
   switch (alg) {
     case "PS256":
@@ -11877,7 +11772,7 @@ function dsaDigest(alg) {
   }
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/node_key.js
+// node_modules/jose/dist/node/esm/runtime/node_key.js
 var import_node_crypto4 = require("node:crypto");
 var ecCurveAlgMap = /* @__PURE__ */ new Map([
   ["ES256", "P-256"],
@@ -11981,11 +11876,11 @@ function keyForCrypto(alg, key) {
   return options ? { ...options, key } : key;
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/sign.js
+// node_modules/jose/dist/node/esm/runtime/sign.js
 var crypto2 = __toESM(require("node:crypto"), 1);
 var import_node_util = require("node:util");
 
-// ../../node_modules/jose/dist/node/esm/runtime/hmac_digest.js
+// node_modules/jose/dist/node/esm/runtime/hmac_digest.js
 function hmacDigest(alg) {
   switch (alg) {
     case "HS256":
@@ -11999,7 +11894,7 @@ function hmacDigest(alg) {
   }
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/get_sign_verify_key.js
+// node_modules/jose/dist/node/esm/runtime/get_sign_verify_key.js
 var import_node_crypto5 = require("node:crypto");
 function getSignVerifyKey(alg, key, usage) {
   if (key instanceof Uint8Array) {
@@ -12024,7 +11919,7 @@ function getSignVerifyKey(alg, key, usage) {
   throw new TypeError(invalid_key_input_default(key, ...types3, "Uint8Array", "JSON Web Key"));
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/sign.js
+// node_modules/jose/dist/node/esm/runtime/sign.js
 var oneShotSign = (0, import_node_util.promisify)(crypto2.sign);
 var sign2 = async (alg, key, data) => {
   const k = getSignVerifyKey(alg, key, "sign");
@@ -12037,7 +11932,7 @@ var sign2 = async (alg, key, data) => {
 };
 var sign_default = sign2;
 
-// ../../node_modules/jose/dist/node/esm/runtime/verify.js
+// node_modules/jose/dist/node/esm/runtime/verify.js
 var oneShotVerify = (0, import_node_util2.promisify)(crypto3.verify);
 var verify2 = async (alg, key, signature, data) => {
   const k = getSignVerifyKey(alg, key, "verify");
@@ -12060,7 +11955,7 @@ var verify2 = async (alg, key, signature, data) => {
 };
 var verify_default = verify2;
 
-// ../../node_modules/jose/dist/node/esm/jws/flattened/verify.js
+// node_modules/jose/dist/node/esm/jws/flattened/verify.js
 async function flattenedVerify(jws, key, options) {
   if (!isObject(jws)) {
     throw new JWSInvalid("Flattened JWS must be an object");
@@ -12166,7 +12061,7 @@ async function flattenedVerify(jws, key, options) {
   return result;
 }
 
-// ../../node_modules/jose/dist/node/esm/jws/compact/verify.js
+// node_modules/jose/dist/node/esm/jws/compact/verify.js
 async function compactVerify(jws, key, options) {
   if (jws instanceof Uint8Array) {
     jws = decoder.decode(jws);
@@ -12186,10 +12081,10 @@ async function compactVerify(jws, key, options) {
   return result;
 }
 
-// ../../node_modules/jose/dist/node/esm/lib/epoch.js
+// node_modules/jose/dist/node/esm/lib/epoch.js
 var epoch_default = (date) => Math.floor(date.getTime() / 1e3);
 
-// ../../node_modules/jose/dist/node/esm/lib/secs.js
+// node_modules/jose/dist/node/esm/lib/secs.js
 var minute = 60;
 var hour = minute * 60;
 var day = hour * 24;
@@ -12246,7 +12141,7 @@ var secs_default = (str) => {
   return numericDate;
 };
 
-// ../../node_modules/jose/dist/node/esm/lib/jwt_claims_set.js
+// node_modules/jose/dist/node/esm/lib/jwt_claims_set.js
 var normalizeTyp = (value) => value.toLowerCase().replace(/^application\//, "");
 var checkAudiencePresence = (audPayload, audOption) => {
   if (typeof audPayload === "string") {
@@ -12342,7 +12237,7 @@ var jwt_claims_set_default = (protectedHeader, encodedPayload, options = {}) =>
   return payload;
 };
 
-// ../../node_modules/jose/dist/node/esm/jwt/verify.js
+// node_modules/jose/dist/node/esm/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
   const verified = await compactVerify(jwt, key, options);
   if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) {
@@ -12356,7 +12251,7 @@ async function jwtVerify(jwt, key, options) {
   return result;
 }
 
-// ../../node_modules/jose/dist/node/esm/jwks/local.js
+// node_modules/jose/dist/node/esm/jwks/local.js
 function getKtyFromAlg(alg) {
   switch (typeof alg === "string" && alg.slice(0, 2)) {
     case "RS":
@@ -12477,7 +12372,7 @@ function createLocalJWKSet(jwks) {
   return localJWKSet;
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/fetch_jwks.js
+// node_modules/jose/dist/node/esm/runtime/fetch_jwks.js
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var import_node_events = require("node:events");
@@ -12519,7 +12414,7 @@ var fetchJwks = async (url, timeout, options) => {
 };
 var fetch_jwks_default = fetchJwks;
 
-// ../../node_modules/jose/dist/node/esm/jwks/remote.js
+// node_modules/jose/dist/node/esm/jwks/remote.js
 function isCloudflareWorkers() {
   return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
 }
@@ -12727,18 +12622,17 @@ function newDefaultVerifier(cfg) {
   return new KeycloakJWTVerifier({ issuer: cfg.issuer, clientId: cfg.clientId });
 }
 function normalizeIdentityOptions(opts) {
-  const o = typeof opts === "string" ? { userIdDomain: opts } : opts ?? {};
   let domains = [];
-  if (o.trustedEmailDomains?.length) {
-    domains = o.trustedEmailDomains;
-  } else if (o.userIdDomain) {
-    domains = [o.userIdDomain];
+  if (opts.trustedEmailDomains?.length) {
+    domains = opts.trustedEmailDomains;
+  } else if (opts.userIdDomain) {
+    domains = [opts.userIdDomain];
   }
   const trusted = domains.map((d) => d.toLowerCase());
-  return { userIdDomain: o.userIdDomain, trusted };
+  return { userIdDomain: opts.userIdDomain, trusted };
 }
 function resolveBridgeUserId(claims, identity) {
-  const { userIdDomain, trusted } = normalizeIdentityOptions(identity);
+  const { userIdDomain, trusted } = normalizeIdentityOptions(identity ?? {});
   if (trusted.length === 0) {
     throw new BridgeIdentityError(
       "set litellm.bridge.allowedEmailDomains (or litellm.userIdDomain) to use the CLI bridge"
@@ -12773,8 +12667,8 @@ function resolveBridgeUserId(claims, identity) {
   name = name || emailLocalPart;
   return toLiteLLMUserId(name, userIdDomain);
 }
-async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
-  const userId = resolveBridgeUserId(claims, userIdDomain);
+async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, identity) {
+  const userId = resolveBridgeUserId(claims, identity);
   const existing = await client.getUserInfo(userId);
   if (existing) return existing;
   if (claims.email) {
@@ -12815,38 +12709,17 @@ async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled,
   }
   return created;
 }
-async function bridgeListKeys(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
+async function bridgeListKeys(client, claims, provisioningEnabled, provisioningDefaults, logger, identity) {
   const user = await getOrProvisionUserFromClaims(
     client,
     claims,
     provisioningEnabled,
     provisioningDefaults,
     logger,
-    userIdDomain
+    identity
   );
   return client.listKeys(user.user_id);
 }
-async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, request, userIdDomain) {
-  const user = await getOrProvisionUserFromClaims(
-    client,
-    claims,
-    provisioningEnabled,
-    provisioningDefaults,
-    logger,
-    userIdDomain
-  );
-  const enriched = {
-    ...request,
-    user_id: user.user_id,
-    metadata: {
-      ...request.metadata ?? {},
-      created_via: "abby-cli",
-      created_by: user.user_id,
-      created_at_iso: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  };
-  return client.generateKey(enriched);
-}
 
 // src/routes/bridge.ts
 var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
@@ -12858,7 +12731,6 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
     userIdDomain,
     provisioningEnabled,
     provisioningDefaults,
-    roleConfigs,
     allowUnlimitedBudget,
     teamRequired,
     keyValidationConfig
@@ -12943,26 +12815,25 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         if (!allowUnlimitedBudget && input.max_budget === void 0) {
           input.max_budget = provisioningDefaults.maxBudget;
         }
-        const userId = resolveBridgeUserId(claims, bridgeIdentity);
+        const userInfo = await getOrProvisionUserFromClaims(
+          client,
+          claims,
+          provisioningEnabled,
+          provisioningDefaults,
+          logger,
+          bridgeIdentity
+        );
         const keyCreateCtx = {
           client,
           config: {
             allowUnlimitedBudget,
             teamRequired
           },
-          // Bridge does not have Backstage catalogClient/auth
-          // so provisioning from JWT claims only (no Backstage profile enrichment)
-          catalogClient: void 0,
-          auth: void 0,
           logger,
-          keyValidationConfig,
-          provisioningEnabled,
-          provisioningDefaults,
-          roleConfigs,
-          userIdDomain
+          keyValidationConfig
         };
         const result = await createKeyForUser(
-          { userId },
+          { userInfo, createdVia: "abby-cli" },
           input,
           keyCreateCtx
         );
@@ -12983,20 +12854,21 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
           bridgeIdentity
         );
         const teamIds = user.teams ?? [];
-        const teamMetadata = [];
-        for (const teamId of teamIds) {
-          try {
-            const teamInfo = await client.getTeamInfo(teamId);
-            teamMetadata.push({
-              id: teamId,
-              name: teamInfo.team_alias || teamId
-              // Use alias as display name, fallback to ID
-            });
-          } catch (e) {
-            logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
-            teamMetadata.push({ id: teamId });
-          }
-        }
+        const teamMetadata = await Promise.all(
+          teamIds.map(async (teamId) => {
+            try {
+              const teamInfo = await client.getTeamInfo(teamId);
+              return {
+                id: teamId,
+                name: teamInfo.team_alias || teamId
+                // Use alias as display name, fallback to ID
+              };
+            } catch (e) {
+              logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
+              return { id: teamId };
+            }
+          })
+        );
         res.json({ user_id: user.user_id, teams: teamIds, team_metadata: teamMetadata });
       } catch (error) {
         handleBridgeError(error, res);
@@ -13115,31 +12987,17 @@ async function createRouter(options) {
     // Helper functions - defined inline below this object
     authorizeKeyAction: async (req, keyId) => {
       if (!req.res || !req.res.locals.tokenEntityRef || !req.res.locals.userId) {
-        throw new import_errors20.NotAllowedError("User identity not found in request");
+        throw new import_errors21.NotAllowedError("User identity not found in request");
       }
       const tokenEntityRef = req.res.locals.tokenEntityRef;
       const userId = req.res.locals.userId;
       const ownKeys = await client.listKeys(userId);
       const key = ownKeys.find((k) => (k.token ?? k.key) === keyId);
       if (!key) {
-        throw new import_errors20.NotAllowedError("Access denied: key does not belong to the caller");
+        throw new import_errors21.NotAllowedError("Access denied: key does not belong to the caller");
       }
       return { tokenEntityRef, userId, key };
     },
-    sendOwnershipError: (err, res) => {
-      if (err instanceof import_errors20.NotAllowedError) {
-        res.status(403).json({ error: err.message });
-        return true;
-      }
-      if (err && typeof err === "object" && "status" in err && "body" in err) {
-        const errObj = err;
-        if (typeof errObj.status === "number" && errObj.body) {
-          res.status(errObj.status).json(errObj.body);
-          return true;
-        }
-      }
-      return false;
-    },
     assertPermission: async (req, permission) => {
       const credentials = await resolveCredentials(req, auth);
       if (!credentials) return false;
@@ -13175,12 +13033,18 @@ async function createRouter(options) {
     sendTeamError: (err, res) => {
       sendError(res, err, logger, "team operation");
     },
-    authorizeTeamSubresource: async (req, res, permission) => {
+    authorizeTeamSubresource: async (req, res, permission, opts) => {
       if (!ctx.requireTeamMgmt(res)) return null;
       if (!teamAdminCfg.group) {
         res.status(500).json({ error: "Team management is misconfigured (group is missing)" });
         return null;
       }
+      if (teamAdminCfg.readOnly) {
+        res.status(403).json({
+          error: "Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage"
+        });
+        return null;
+      }
       const check = await assertTeamAdmin({
         req,
         auth,
@@ -13190,7 +13054,8 @@ async function createRouter(options) {
         permission,
         logger
       });
-      if (!check.ok) {
+      const teamRoleEligible = !!opts?.allowTeamRole && teamAdminCfg.memberManagerRoles.length > 0;
+      if (!check.ok && !(check.status === 403 && teamRoleEligible)) {
         res.status(check.status).json({ error: check.error });
         return null;
       }
@@ -13211,29 +13076,52 @@ async function createRouter(options) {
         return null;
       }
       const owningGroup = typeof existing.metadata?.owning_group === "string" ? existing.metadata.owning_group : void 0;
-      if (!owningGroup) {
-        res.status(403).json({
+      let denial;
+      if (!check.ok) {
+        denial = { status: check.status, error: check.error };
+      } else if (!owningGroup) {
+        denial = {
+          status: 403,
           error: "This team is not managed by Backstage team admins and cannot be edited here"
-        });
-        return null;
-      }
-      const owns = await isUserMemberOfGroup(
+        };
+      } else if (await isUserMemberOfGroup(
         check.userEntityRef,
         owningGroup,
         catalogClient,
         auth,
         logger
-      );
-      if (!owns) {
-        res.status(403).json({ error: `Access denied: team is owned by ${owningGroup}` });
-        return null;
+      )) {
+        return {
+          teamId,
+          owningGroup,
+          actor: check.userEntityRef,
+          team: existing,
+          via: "group"
+        };
+      } else {
+        denial = {
+          status: 403,
+          error: `Access denied: team is owned by ${owningGroup}`
+        };
       }
-      return {
-        teamId,
-        owningGroup,
-        actor: check.userEntityRef,
-        team: existing
-      };
+      if (teamRoleEligible) {
+        const actor = await resolveUserId(req, auth);
+        const litellmUserId = actor && toLiteLLMUserId(actor, userIdDomain);
+        const role = existing.members_with_roles?.find(
+          (m) => m.user_id === litellmUserId
+        )?.role;
+        if (actor && role && teamAdminCfg.memberManagerRoles.includes(role) && await ctx.assertPermission(req, permission)) {
+          return {
+            teamId,
+            owningGroup: owningGroup ?? "",
+            actor,
+            team: existing,
+            via: "teamRole"
+          };
+        }
+      }
+      res.status(denial.status).json({ error: denial.error });
+      return null;
     }
   };
   const router = (0, import_express.Router)();
@@ -13309,7 +13197,6 @@ var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plug
   ProvisioningError,
   applyRoleOverrides,
   assertTeamAdmin,
-  bridgeGenerateKey,
   bridgeListKeys,
   createRouter,
   getOrProvisionUser,
@@ -13330,7 +13217,6 @@ var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plug
   litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission,
   newDefaultVerifier,
-  normalizeRequestTags,
   provisionUser,
   readBridgeConfig,
   readProvisioningDefaults,