@acarmisc/backstage-plugin-litellm-backend 0.18.0 → 0.20.0

package/dist/index.cjs.js

@@ -7976,29 +7976,27 @@ __export(index_exports, {
   ProvisioningError: () => ProvisioningError,
   applyRoleOverrides: () => applyRoleOverrides,
   assertTeamAdmin: () => assertTeamAdmin,
-  bridgeGenerateKey: () => bridgeGenerateKey,
   bridgeListKeys: () => bridgeListKeys,
   createRouter: () => createRouter,
   default: () => litellmPlugin,
   getOrProvisionUser: () => getOrProvisionUser,
   getOrProvisionUserFromClaims: () => getOrProvisionUserFromClaims,
   isTeamManagementEnabled: () => isTeamManagementEnabled,
-  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common11.litellmAuditReadPermission,
-  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common11.litellmKeyCreatePermission,
-  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common11.litellmKeyManagePermission,
-  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common11.litellmKeyResetSpendPermission,
-  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common11.litellmKeyRevokePermission,
-  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common11.litellmKeyUnblockPermission,
-  litellmPermissions: () => import_backstage_plugin_litellm_common11.litellmPermissions,
+  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common12.litellmAuditReadPermission,
+  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common12.litellmKeyCreatePermission,
+  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common12.litellmKeyManagePermission,
+  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common12.litellmKeyResetSpendPermission,
+  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common12.litellmKeyRevokePermission,
+  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common12.litellmKeyUnblockPermission,
+  litellmPermissions: () => import_backstage_plugin_litellm_common12.litellmPermissions,
   litellmPlugin: () => litellmPlugin,
-  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common11.litellmTeamCreatePermission,
-  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common11.litellmTeamDeletePermission,
-  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamKnowledgebaseManagePermission,
-  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamManagePermission,
-  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMcpManagePermission,
-  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMembersManagePermission,
+  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common12.litellmTeamCreatePermission,
+  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common12.litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamManagePermission,
+  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
-  normalizeRequestTags: () => normalizeRequestTags,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
   readProvisioningDefaults: () => readProvisioningDefaults,
@@ -8024,16 +8022,11 @@ var import_backend_plugin_api = require("@backstage/backend-plugin-api");
 // src/router.ts
 var import_express = __toESM(require("express"));
 var import_plugin_permission_common2 = __toESM(require_index_cjs2());
-var import_errors20 = __toESM(require_index_cjs());
+var import_errors21 = __toESM(require_index_cjs());
 var import_catalog_client = require("@backstage/catalog-client");
 
 // src/client.ts
 var DEFAULT_TIMEOUT = 3e4;
-function normalizeRequestTags(tags) {
-  if (!tags) return [];
-  if (Array.isArray(tags)) return tags.filter((t) => typeof t === "string");
-  return Object.entries(tags).map(([k, v]) => `${k}:${v}`);
-}
 var LiteLLMUpstreamError = class extends Error {
   constructor(status, statusText, body) {
     let message2 = `LiteLLM API error: ${status} ${statusText}`;
@@ -8089,6 +8082,29 @@ var LiteLLMClient = class {
       clearTimeout(timeoutId);
     }
   }
+  /**
+   * Normalizes a raw LiteLLM user response to the UserInfo contract.
+   * Handles both `/user/info` (with `user_info` wrapper) and `/user/list`
+   * response shapes, and converts team arrays to team_id strings.
+   */
+  normalizeUserInfo(raw, fallbackUserId) {
+    const inner = raw?.user_info ?? {};
+    const teamIds = Array.isArray(raw?.teams) ? raw.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
+    return {
+      user_id: raw?.user_id ?? inner.user_id ?? fallbackUserId ?? "",
+      user_email: inner.user_email ?? raw?.user_email,
+      email: inner.email ?? raw?.email,
+      teams: teamIds,
+      models: inner.models ?? raw?.models,
+      max_budget: inner.max_budget ?? raw?.max_budget,
+      budget_duration: inner.budget_duration ?? raw?.budget_duration,
+      budget_reset_at: inner.budget_reset_at ?? raw?.budget_reset_at,
+      spend: inner.spend ?? raw?.spend,
+      current_spend: inner.current_spend ?? raw?.current_spend,
+      soft_limit: inner.soft_limit ?? raw?.soft_limit,
+      hard_limit: inner.hard_limit ?? raw?.hard_limit
+    };
+  }
   /**
    * Returns null when the user is not found in LiteLLM (404).
    * Throws on all other errors so callers know something went wrong.
@@ -8102,22 +8118,7 @@ var LiteLLMClient = class {
     const query = userId ? `?user_id=${encodeURIComponent(userId)}` : "";
     try {
       const raw = await this.request(`/user/info${query}`);
-      const inner = raw?.user_info ?? {};
-      const teamIds = Array.isArray(raw?.teams) ? raw.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
-      return {
-        user_id: raw?.user_id ?? inner.user_id ?? userId ?? "",
-        user_email: inner.user_email ?? raw?.user_email,
-        email: inner.email ?? raw?.email,
-        teams: teamIds,
-        models: inner.models ?? raw?.models,
-        max_budget: inner.max_budget ?? raw?.max_budget,
-        budget_duration: inner.budget_duration ?? raw?.budget_duration,
-        budget_reset_at: inner.budget_reset_at ?? raw?.budget_reset_at,
-        spend: inner.spend ?? raw?.spend,
-        current_spend: inner.current_spend ?? raw?.current_spend,
-        soft_limit: inner.soft_limit ?? raw?.soft_limit,
-        hard_limit: inner.hard_limit ?? raw?.hard_limit
-      };
+      return this.normalizeUserInfo(raw, userId);
     } catch (err) {
       if (err instanceof LiteLLMUpstreamError && err.status === 404) return null;
       throw err;
@@ -8144,22 +8145,7 @@ var LiteLLMClient = class {
         (u) => (u.user_email ?? u.email ?? "").toLowerCase() === email.toLowerCase()
       );
       if (!found) return null;
-      const inner = found.user_info ?? {};
-      const teamIds = Array.isArray(found.teams) ? found.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
-      return {
-        user_id: found.user_id ?? inner.user_id ?? "",
-        user_email: inner.user_email ?? found.user_email,
-        email: inner.email ?? found.email,
-        teams: teamIds,
-        models: inner.models ?? found.models,
-        max_budget: inner.max_budget ?? found.max_budget,
-        budget_duration: inner.budget_duration ?? found.budget_duration,
-        budget_reset_at: inner.budget_reset_at ?? found.budget_reset_at,
-        spend: inner.spend ?? found.spend,
-        current_spend: inner.current_spend ?? found.current_spend,
-        soft_limit: inner.soft_limit ?? found.soft_limit,
-        hard_limit: inner.hard_limit ?? found.hard_limit
-      };
+      return this.normalizeUserInfo(found);
     } catch (err) {
       if (err instanceof LiteLLMUpstreamError && err.status === 404) return null;
       throw err;
@@ -8211,6 +8197,28 @@ var LiteLLMClient = class {
       throw err;
     }
   }
+  /**
+   * Lists every key bound to a team (any owner), following `/key/list`
+   * pagination. Stops after 50 pages of 100 keys.
+   */
+  async listTeamKeys(teamId) {
+    const keys = [];
+    for (let page = 1; page <= 50; page++) {
+      const params = new URLSearchParams({
+        team_id: teamId,
+        return_full_object: "true",
+        page: String(page),
+        size: "100"
+      });
+      const response = await this.request(`/key/list?${params.toString()}`);
+      const rawKeys = (response.keys ?? []).filter(
+        (k) => typeof k === "object" && k !== null
+      );
+      keys.push(...rawKeys.map(this.toVirtualKey));
+      if (rawKeys.length === 0 || page >= (response.total_pages ?? 1)) break;
+    }
+    return keys;
+  }
   toVirtualKey(k) {
     return {
       key: k.key_name ?? k.token,
@@ -8423,18 +8431,6 @@ var LiteLLMClient = class {
       body: JSON.stringify({ team_ids: [teamId] })
     });
   }
-  async blockTeam(teamId) {
-    return this.request("/team/block", {
-      method: "POST",
-      body: JSON.stringify({ team_id: teamId })
-    });
-  }
-  async unblockTeam(teamId) {
-    return this.request("/team/unblock", {
-      method: "POST",
-      body: JSON.stringify({ team_id: teamId })
-    });
-  }
   /**
    * Adds a member to a team. LiteLLM's `/team/member_add` nests the member
    * under a `member` object; `role` is 'user' or 'admin' (we only ever send
@@ -8498,43 +8494,6 @@ var LiteLLMClient = class {
       url: r?.url ?? void 0
     })).filter((r) => r.id);
   }
-  /**
-   * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
-   * by date range and optionally by key/user/team. Rows are normalised so
-   * `request_tags` is always a `string[]` (LiteLLM returns either an array
-   * or an object depending on version) — callers group by tag to attribute
-   * spend to a conversation or caller.
-   *
-   * This is the admin/DB-backed endpoint: it can return a large number of
-   * rows, so callers should keep the date window tight and cap `page_size`.
-   */
-  async getSpendLogs(params) {
-    const query = new URLSearchParams({
-      start_date: params.start_date,
-      end_date: params.end_date
-    });
-    if (params.api_key) query.append("api_key", params.api_key);
-    if (params.user_id) query.append("user_id", params.user_id);
-    if (params.team_id) query.append("team_id", params.team_id);
-    if (params.page_size) query.append("page_size", String(params.page_size));
-    const raw = await this.request(`/spend/logs?${query.toString()}`);
-    const rows = Array.isArray(raw) ? raw : raw?.data ?? [];
-    return rows.map((row) => ({
-      request_id: row?.request_id,
-      startTime: row?.startTime ?? row?.start_time,
-      endTime: row?.endTime ?? row?.end_time,
-      spend: row?.spend ?? 0,
-      total_tokens: row?.total_tokens ?? 0,
-      prompt_tokens: row?.prompt_tokens ?? 0,
-      completion_tokens: row?.completion_tokens ?? 0,
-      model: row?.model,
-      api_key: row?.api_key,
-      user: row?.user,
-      team_id: row?.team_id,
-      request_tags: normalizeRequestTags(row?.request_tags),
-      metadata: row?.metadata
-    }));
-  }
   emptyUsage() {
     return {
       total_spend: 0,
@@ -8698,6 +8657,114 @@ var LiteLLMClient = class {
   }
 };
 
+// src/errors.ts
+var HTML_TAG_PATTERN = /<[^>]*>|&[a-z]+;/gi;
+function isHttpishError(error) {
+  return error !== null && typeof error === "object" && "status" in error && "body" in error && typeof error.status === "number" && // any: property access after guard check
+  typeof error.body === "object";
+}
+function sanitizeUpstreamMessage(msg) {
+  if (!msg || typeof msg !== "string") return "";
+  return msg.replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, "Bearer [redacted]").replace(/sk-[A-Za-z0-9_\-]{8,}/g, "sk-[redacted]").replace(HTML_TAG_PATTERN, "").replace(/\s+/g, " ").trim().slice(0, 500);
+}
+function toHttpError(error) {
+  if (isHttpishError(error)) {
+    return {
+      status: error.status,
+      body: error.body,
+      logLevel: "warn"
+    };
+  }
+  if (error instanceof LiteLLMUpstreamError) {
+    if (error.status === 401 || error.status === 403) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM rejected the request" },
+        logLevel: "warn"
+      };
+    }
+    if (error.status >= 500 || error.status < 100) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM is unavailable" },
+        logLevel: "error"
+      };
+    }
+    return {
+      status: error.status === 404 || error.status === 409 ? error.status : 400,
+      body: {
+        error: sanitizeUpstreamMessage(error.message),
+        ...error.param ? { param: error.param } : {}
+      },
+      logLevel: "warn"
+    };
+  }
+  if (error && typeof error === "object" && "name" in error && "message" in error) {
+    const name = error.name;
+    const message3 = String(error.message);
+    if (name === "InputError") {
+      return {
+        status: 400,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "NotAllowedError") {
+      return {
+        status: 403,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "NotFoundError") {
+      return {
+        status: 404,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "ConflictError") {
+      return {
+        status: 409,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+  }
+  if (error instanceof Error) {
+    const code = error.code;
+    const cause = error.cause;
+    const networkCodes = ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "ETIMEDOUT", "EAI_AGAIN", "UND_ERR_CONNECT_TIMEOUT"];
+    if (error.name === "AbortError" || error.name === "TimeoutError" || error.name === "TypeError" && error.message === "fetch failed" || typeof code === "string" && networkCodes.includes(code) || typeof cause?.code === "string" && networkCodes.includes(cause.code)) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM is unavailable" },
+        logLevel: "error",
+        _logMessage: error.message
+      };
+    }
+  }
+  const message2 = error instanceof Error ? error.message : String(error);
+  return {
+    status: 500,
+    body: { error: "Internal error" },
+    logLevel: "error",
+    _logMessage: message2
+  };
+}
+function sendError(res, error, logger, context) {
+  const { status, body, logLevel, _logMessage } = toHttpError(error);
+  const realMessage = _logMessage || (error instanceof Error ? error.message : String(error));
+  if (logLevel === "error") {
+    logger.error(`Failed to ${context}`, error instanceof Error ? error : new Error(String(error)));
+  } else if (logLevel === "warn") {
+    logger.warn(`${context}: ${realMessage}`);
+  } else {
+    logger.info(`${context}: ${realMessage}`);
+  }
+  res.status(status).json(body);
+}
+
 // src/provisioning.ts
 function toLiteLLMUserId(userEntityRef, userIdDomain) {
   const name = userEntityRef.split("/").pop() ?? userEntityRef;
@@ -8754,8 +8821,9 @@ function readProvisioningDefaults(config) {
   return { enabled, defaults };
 }
 async function resolveUserId(req, auth) {
-  const rawToken = req.headers.authorization?.slice(7);
-  if (!rawToken) return void 0;
+  const authHeader = req.headers.authorization ?? "";
+  if (!authHeader.startsWith("Bearer ")) return void 0;
+  const rawToken = authHeader.slice(7);
   try {
     const credentials = await auth.authenticate(rawToken);
     const principal = credentials.principal;
@@ -8767,8 +8835,9 @@ async function resolveUserId(req, auth) {
   return void 0;
 }
 async function resolveCredentials(req, auth) {
-  const rawToken = req.headers.authorization?.slice(7);
-  if (!rawToken) return void 0;
+  const authHeader = req.headers.authorization ?? "";
+  if (!authHeader.startsWith("Bearer ")) return void 0;
+  const rawToken = authHeader.slice(7);
   try {
     return await auth.authenticate(rawToken);
   } catch {
@@ -8847,10 +8916,6 @@ async function provisionUser(client, userId, defaults, profile, backstageEntity,
   }
 }
 var provisioningInFlight = /* @__PURE__ */ new Map();
-function sanitizeUpstreamMessage(message2) {
-  if (!message2) return "unknown error";
-  return message2.replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, "Bearer [redacted]").replace(/sk-[A-Za-z0-9_\-]{8,}/g, "sk-[redacted]").slice(0, 500);
-}
 var ProvisioningError = class extends Error {
   constructor(message2, hint, provisioning, status = 404) {
     super(message2);
@@ -8858,6 +8923,38 @@ var ProvisioningError = class extends Error {
     this.body = { error: message2, hint, provisioning };
   }
 };
+var adoptedUserIds = /* @__PURE__ */ new Map();
+function effectiveUserId(userId) {
+  return adoptedUserIds.get(userId) ?? userId;
+}
+async function getUserByIdOrAdopted(client, userId) {
+  const adopted = adoptedUserIds.get(userId);
+  if (adopted) {
+    const info = await client.getUserInfo(adopted);
+    if (info) return info;
+    adoptedUserIds.delete(userId);
+  }
+  return client.getUserInfo(userId);
+}
+async function adoptUserByEmail(client, userId, email, logger) {
+  if (!email) return null;
+  const byEmail = await client.getUserByEmail(email);
+  if (!byEmail?.user_id) return null;
+  if (byEmail.user_id !== userId) {
+    logger.info(
+      `Found existing LiteLLM user ${byEmail.user_id} by email ${email}, reusing for ${userId}`
+    );
+    adoptedUserIds.set(userId, byEmail.user_id);
+  }
+  return byEmail;
+}
+async function findLiteLLMUser(client, tokenEntityRef, userId, catalogClient, auth, logger) {
+  const existing = await getUserByIdOrAdopted(client, userId);
+  if (existing) return existing;
+  if (!tokenEntityRef) return null;
+  const profile = await resolveUserProfile(tokenEntityRef, catalogClient, auth, logger);
+  return adoptUserByEmail(client, userId, profile.email, logger);
+}
 async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger) {
   if (!userId) {
     throw new ProvisioningError(
@@ -8866,17 +8963,10 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
       provisioningEnabled
     );
   }
-  const existing = await client.getUserInfo(userId);
+  const existing = await getUserByIdOrAdopted(client, userId);
   if (existing) {
     return existing;
   }
-  if (!provisioningEnabled) {
-    throw new ProvisioningError(
-      "User not found in LiteLLM",
-      "Enable litellm.provisioning.enabled in app-config.yaml or create the user manually",
-      false
-    );
-  }
   const pending = provisioningInFlight.get(userId);
   if (pending) {
     logger.info(
@@ -8885,11 +8975,25 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
     return pending;
   }
   const provisionPromise = (async () => {
-    const catalogRef = tokenEntityRef ?? userId;
-    const [matchedRole, profile] = await Promise.all([
-      resolveUserRole(catalogRef, roleConfigs, catalogClient, auth, logger),
-      tokenEntityRef ? resolveUserProfile(tokenEntityRef, catalogClient, auth, logger) : Promise.resolve({})
-    ]);
+    const profile = tokenEntityRef ? await resolveUserProfile(tokenEntityRef, catalogClient, auth, logger) : {};
+    const byEmail = await adoptUserByEmail(client, userId, profile.email, logger);
+    if (byEmail) {
+      return byEmail;
+    }
+    if (!provisioningEnabled) {
+      throw new ProvisioningError(
+        "User not found in LiteLLM",
+        "Enable litellm.provisioning.enabled in app-config.yaml or create the user manually",
+        false
+      );
+    }
+    const matchedRole = await resolveUserRole(
+      tokenEntityRef ?? userId,
+      roleConfigs,
+      catalogClient,
+      auth,
+      logger
+    );
     const effectiveDefaults = matchedRole ? applyRoleOverrides(provisioningDefaults, matchedRole) : provisioningDefaults;
     if (matchedRole) {
       logger.info(
@@ -8918,7 +9022,7 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
         logger.info(
           `LiteLLM user ${userId} already exists during provisioning \u2014 re-fetching`
         );
-        const refetched = await client.getUserInfo(userId);
+        const refetched = await client.getUserInfo(userId) ?? await adoptUserByEmail(client, userId, profile.email, logger);
         if (refetched) {
           return refetched;
         }
@@ -8979,7 +9083,7 @@ async function resolveUserRole(userEntityRef, roleConfigs, catalogClient, auth,
 }
 
 // src/router.ts
-var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/teamAdmin.ts
 var import_plugin_permission_common = __toESM(require_index_cjs2());
@@ -9254,112 +9358,91 @@ function readOpencodeConfig(config) {
   };
 }
 
-// src/errors.ts
-var HTML_TAG_PATTERN = /<[^>]*>|&[a-z]+;/gi;
-function isHttpishError(error) {
-  return error !== null && typeof error === "object" && "status" in error && "body" in error && typeof error.status === "number" && // any: property access after guard check
-  typeof error.body === "object";
-}
-function sanitizeUpstreamMessage2(msg) {
-  if (!msg || typeof msg !== "string") return "";
-  return msg.replace(HTML_TAG_PATTERN, "").replace(/\s+/g, " ").trim().slice(0, 500);
+// src/teamMemberUsage.ts
+function readMemberBreakdownConfig(config) {
+  return {
+    enabled: config.getOptionalBoolean("litellm.teamUsage.memberBreakdown.enabled") ?? false,
+    viewerRoles: config.getOptionalStringArray("litellm.teamUsage.memberBreakdown.viewerRoles") ?? [],
+    permissionEnabled: config.getOptionalBoolean("permission.enabled") ?? false
+  };
 }
-function toHttpError(error) {
-  if (isHttpishError(error)) {
-    return {
-      status: error.status,
-      body: error.body,
-      logLevel: "warn"
-    };
-  }
-  if (error instanceof LiteLLMUpstreamError) {
-    if (error.status === 401 || error.status === 403) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM rejected the request" },
-        logLevel: "warn"
-      };
-    }
-    if (error.status >= 500 || error.status < 100) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM is unavailable" },
-        logLevel: "error"
-      };
-    }
-    return {
-      status: error.status === 404 || error.status === 409 ? error.status : 400,
-      body: {
-        error: sanitizeUpstreamMessage2(error.message),
-        ...error.param ? { param: error.param } : {}
-      },
-      logLevel: "warn"
-    };
+function memberEmails(team, keys) {
+  const emails = /* @__PURE__ */ new Set();
+  for (const m of team.members_with_roles ?? []) {
+    if (m.user_email) emails.add(m.user_email.toLowerCase());
+    else if (m.user_id?.includes("@")) emails.add(m.user_id.toLowerCase());
   }
-  if (error && typeof error === "object" && "name" in error && "message" in error) {
-    const name = error.name;
-    const message3 = String(error.message);
-    if (name === "InputError") {
-      return {
-        status: 400,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "NotAllowedError") {
-      return {
-        status: 403,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "NotFoundError") {
-      return {
-        status: 404,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "ConflictError") {
-      return {
-        status: 409,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
+  for (const k of keys) {
+    if (k.user_id?.includes("@")) emails.add(k.user_id.toLowerCase());
   }
-  if (error instanceof Error) {
-    const code = error.code;
-    const cause = error.cause;
-    const networkCodes = ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "ETIMEDOUT", "EAI_AGAIN", "UND_ERR_CONNECT_TIMEOUT"];
-    if (error.name === "AbortError" || error.name === "TimeoutError" || error.name === "TypeError" && error.message === "fetch failed" || typeof code === "string" && networkCodes.includes(code) || typeof cause?.code === "string" && networkCodes.includes(cause.code)) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM is unavailable" },
-        logLevel: "error",
-        _logMessage: error.message
+  return [...emails];
+}
+function buildTeamMemberUsage(teamId, usage, keys, team, profiles = /* @__PURE__ */ new Map()) {
+  const rows = /* @__PURE__ */ new Map();
+  const rowFor = (userId) => {
+    let row = rows.get(userId);
+    if (!row) {
+      row = {
+        user_id: userId,
+        spend: 0,
+        spend_share_pct: 0,
+        prompt_tokens: 0,
+        completion_tokens: 0,
+        total_tokens: 0,
+        api_requests: 0,
+        successful_requests: 0,
+        failed_requests: 0,
+        success_rate: null,
+        key_count: 0
       };
+      rows.set(userId, row);
     }
-  }
-  const message2 = error instanceof Error ? error.message : String(error);
-  return {
-    status: 500,
-    body: { error: "Internal error" },
-    logLevel: "error",
-    _logMessage: message2
+    return row;
   };
+  for (const m of team.members_with_roles ?? []) {
+    if (!m.user_id) continue;
+    const row = rowFor(m.user_id);
+    row.role = m.role;
+    if (m.user_email) row.user_email = m.user_email;
+  }
+  const ownerByKey = /* @__PURE__ */ new Map();
+  for (const k of keys) {
+    if (!k.user_id || !k.token) continue;
+    ownerByKey.set(k.token, k.user_id);
+    rowFor(k.user_id).key_count += 1;
+  }
+  for (const [keyHash, k] of Object.entries(usage.usage_by_key ?? {})) {
+    const row = rowFor(ownerByKey.get(keyHash) ?? null);
+    row.spend += k.total_spend ?? 0;
+    row.prompt_tokens += k.prompt_tokens ?? 0;
+    row.completion_tokens += k.completion_tokens ?? 0;
+    row.total_tokens += k.total_tokens ?? 0;
+    row.api_requests += k.api_requests ?? 0;
+    row.successful_requests += k.successful_requests ?? 0;
+    row.failed_requests += k.failed_requests ?? 0;
+  }
+  const members = [...rows.values()];
+  const totalSpend = members.reduce((sum, r) => sum + r.spend, 0);
+  for (const row of members) {
+    row.spend_share_pct = totalSpend > 0 ? row.spend / totalSpend * 100 : 0;
+    const finished = row.successful_requests + row.failed_requests;
+    row.success_rate = finished > 0 ? row.successful_requests / finished * 100 : null;
+    if (!row.user_email && row.user_id?.includes("@")) row.user_email = row.user_id;
+    const profile = row.user_email && profiles.get(row.user_email.toLowerCase());
+    if (profile && profile.displayName) row.display_name = profile.displayName;
+  }
+  members.sort(
+    (a, b) => b.spend - a.spend || b.total_tokens - a.total_tokens || String(a.user_id ?? "\uFFFF").localeCompare(String(b.user_id ?? "\uFFFF"))
+  );
+  return { team_id: teamId, total_spend: totalSpend, members };
 }
-function sendError(res, error, logger, context) {
-  const { status, body, logLevel, _logMessage } = toHttpError(error);
-  const realMessage = _logMessage || (error instanceof Error ? error.message : String(error));
-  if (logLevel === "error") {
-    logger.error(`Failed to ${context}`, error instanceof Error ? error : new Error(String(error)));
-  } else if (logLevel === "warn") {
-    logger.warn(`${context}: ${realMessage}`);
-  } else {
-    logger.info(`${context}: ${realMessage}`);
-  }
-  res.status(status).json(body);
+function redactTeamMemberUsage(usage) {
+  return {
+    ...usage,
+    total_spend: 0,
+    budget_hidden: true,
+    members: usage.members.map((m) => ({ ...m, spend: 0 }))
+  };
 }
 
 // src/routes/middleware/withUser.ts
@@ -9382,7 +9465,7 @@ function createRequireUser(ctx) {
 async function getProvisionedUser(ctx, res) {
   const tokenEntityRef = res.locals.tokenEntityRef;
   const userId = res.locals.userId;
-  return getOrProvisionUser(
+  const userInfo = await getOrProvisionUser(
     ctx.client,
     tokenEntityRef,
     userId,
@@ -9393,6 +9476,8 @@ async function getProvisionedUser(ctx, res) {
     ctx.auth,
     ctx.logger
   );
+  res.locals.userId = effectiveUserId(userId);
+  return userInfo;
 }
 
 // src/services/userInfoCache.ts
@@ -9601,6 +9686,7 @@ var openApiSpec = {
             team_id: { type: "string" },
             duration: { type: "string" },
             max_budget: { type: "number", nullable: true, description: "Positive number caps spend; null = unlimited" },
+            budget_duration: { type: "string", description: 'How often max_budget resets (e.g. "30d", "1mo"); one of litellm.keys.allowedBudgetDurations' },
             tpm_limit: { type: "number" },
             rpm_limit: { type: "number" }
           } } } }
@@ -9697,6 +9783,24 @@ var openApiSpec = {
         responses: { "200": { description: "Team usage" }, "400": { description: "Missing date range" } }
       }
     },
+    "/teams/{teamId}/usage/members": {
+      get: {
+        tags: ["Teams"],
+        summary: "Per-member usage breakdown for a team",
+        description: "Needs litellm.teamUsage.memberBreakdown.enabled. Allowed for team managers, members holding one of memberBreakdown.viewerRoles, and members granted litellm.team.usage.read. Spend is zeroed (with budget_hidden: true) under team budget hiding; spend_share_pct remains.",
+        parameters: [
+          { name: "teamId", in: "path", required: true, schema: { type: "string" } },
+          { name: "start_date", in: "query", required: true, schema: { type: "string" } },
+          { name: "end_date", in: "query", required: true, schema: { type: "string" } }
+        ],
+        responses: {
+          "200": { description: "One row per member, sorted by spend" },
+          "400": { description: "Missing date range" },
+          "403": { description: "Caller may see the team but not its member breakdown" },
+          "404": { description: "Feature disabled, or team not found / not visible to the caller" }
+        }
+      }
+    },
     "/usage": {
       get: {
         tags: ["Usage"],
@@ -9802,6 +9906,9 @@ function registerConfigRoutes(router, ctx) {
         readOnly: ctx.teamAdminCfg.readOnly,
         memberManagerRoles: ctx.teamAdminCfg.memberManagerRoles
       },
+      teamUsage: {
+        memberBreakdown: ctx.memberBreakdownCfg.enabled
+      },
       display: {
         hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,
         hideTeamBudgetForManagers: ctx.teamBudgetVisibility.hideTeamBudgetForManagers
@@ -9897,56 +10004,9 @@ async function createKeyForUser(user, input, ctx) {
     config,
     catalogClient,
     auth,
-    logger,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs
+    logger
   } = ctx;
-  let userInfo;
-  if (catalogClient !== void 0 && catalogClient !== null && auth !== void 0 && auth !== null) {
-    userInfo = await getOrProvisionUser(
-      client,
-      user.tokenEntityRef || "",
-      user.userId,
-      provisioningEnabled,
-      provisioningDefaults,
-      roleConfigs,
-      catalogClient,
-      auth,
-      logger
-    );
-  } else {
-    userInfo = await client.getUserInfo(user.userId);
-    if (!userInfo) {
-      if (!provisioningEnabled) {
-        throw new KeyServiceError(
-          404,
-          {
-            error: "User not found in LiteLLM",
-            detail: "No LiteLLM user for this identity. Log in to Backstage once to be provisioned, or enable litellm.provisioning.enabled."
-          }
-        );
-      }
-      const created = await client.createUser({
-        user_id: user.userId,
-        user_email: user.userId,
-        max_budget: provisioningDefaults.maxBudget,
-        budget_duration: provisioningDefaults.budgetDuration,
-        models: provisioningDefaults.models,
-        teams: provisioningDefaults.teams?.length ? [provisioningDefaults.teams[0]] : []
-      });
-      if (!created) {
-        throw new KeyServiceError(
-          500,
-          {
-            error: "User provisioning failed",
-            detail: "Failed to create user in LiteLLM"
-          }
-        );
-      }
-      userInfo = await client.getUserInfo(user.userId);
-    }
-  }
+  const userInfo = user.userInfo;
   if (!config.allowUnlimitedBudget && (input.max_budget === null || input.max_budget === void 0)) {
     throw new KeyServiceError(
       400,
@@ -9992,13 +10052,15 @@ async function createKeyForUser(user, input, ctx) {
   }
   const profile = user.tokenEntityRef && catalogClient !== void 0 && catalogClient !== null && auth !== void 0 && auth !== null ? await resolveUserProfile(user.tokenEntityRef, catalogClient, auth, logger) : {};
   const clientMetadata = input.metadata ?? {};
+  const createdVia = user.createdVia ?? "backstage";
   const serverMetadata = {
-    created_by_backstage_user: user.tokenEntityRef ?? "unknown",
+    ...user.tokenEntityRef && { created_by_backstage_user: user.tokenEntityRef },
+    ...!user.tokenEntityRef && { created_by: userInfo.user_id },
     ...profile.email && { created_by_email: profile.email },
     ...profile.displayName && {
       created_by_display_name: profile.displayName
     },
-    created_via: "backstage",
+    created_via: createdVia,
     created_at_iso: (/* @__PURE__ */ new Date()).toISOString()
   };
   const enrichedMetadata = {
@@ -10007,7 +10069,7 @@ async function createKeyForUser(user, input, ctx) {
   };
   const upstreamRequest = {
     alias: input.alias,
-    user_id: user.userId
+    user_id: userInfo.user_id
   };
   if (input.models !== void 0) {
     upstreamRequest.models = input.models;
@@ -10018,6 +10080,9 @@ async function createKeyForUser(user, input, ctx) {
   if (input.max_budget !== void 0) {
     upstreamRequest.max_budget = input.max_budget ?? void 0;
   }
+  if (input.budget_duration !== void 0) {
+    upstreamRequest.budget_duration = input.budget_duration;
+  }
   if (input.tpm_limit !== void 0) {
     upstreamRequest.tpm_limit = input.tpm_limit;
   }
@@ -10032,7 +10097,7 @@ async function createKeyForUser(user, input, ctx) {
   }
   upstreamRequest.metadata = enrichedMetadata;
   const result = await client.generateKey(upstreamRequest);
-  logger.info("key.generate", { userId: user.userId, keyAlias: input.alias });
+  logger.info("key.generate", { userId: userInfo.user_id, keyAlias: input.alias });
   return result;
 }
 
@@ -10043,17 +10108,12 @@ function registerKeysRoutes(router, ctx) {
     catalogClient,
     auth,
     logger,
-    userIdDomain,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs,
     auditGroup,
     allowUnlimitedBudget,
     teamRequired,
     allowOwnerResetSpend,
     keyValidationConfig,
     authorizeKeyAction,
-    sendOwnershipError,
     assertPermission,
     sendPermissionDenied
   } = ctx;
@@ -10081,8 +10141,8 @@ function registerKeysRoutes(router, ctx) {
   });
   router.get("/keys", async (_req, res) => {
     try {
-      const userId = res.locals.userId;
       await getProvisionedUser(ctx, res);
+      const userId = res.locals.userId;
       const keys = await client.listKeys(userId);
       res.json(keys);
     } catch (error) {
@@ -10099,8 +10159,8 @@ function registerKeysRoutes(router, ctx) {
         sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission);
         return;
       }
-      const userId = res.locals.userId;
       await getProvisionedUser(ctx, res);
+      const userId = res.locals.userId;
       const keys = await client.listKeys(userId);
       const now = Date.now();
       const expiredKeys = keys.filter((k) => {
@@ -10125,7 +10185,7 @@ function registerKeysRoutes(router, ctx) {
           const keyId = key.token ?? key.key;
           let errorMsg = "Unknown error";
           if (err instanceof Error) {
-            errorMsg = sanitizeUpstreamMessage2(err.message) || "Unknown error";
+            errorMsg = sanitizeUpstreamMessage(err.message) || "Unknown error";
           }
           failures.push({ keyId, error: errorMsg });
           logger.warn("key.prune-expired failed", {
@@ -10165,7 +10225,7 @@ function registerKeysRoutes(router, ctx) {
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
-      const resolvedUserId = res.locals.userId;
+      const userInfo = await getProvisionedUser(ctx, res);
       const keyCreateCtx = {
         client,
         config: {
@@ -10175,14 +10235,10 @@ function registerKeysRoutes(router, ctx) {
         catalogClient,
         auth,
         logger,
-        keyValidationConfig,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        userIdDomain
+        keyValidationConfig
       };
       const result = await createKeyForUser(
-        { tokenEntityRef, userId: resolvedUserId },
+        { tokenEntityRef, userInfo },
         input,
         keyCreateCtx
       );
@@ -10282,7 +10338,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.update", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json(result);
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "update key");
     }
   });
@@ -10302,7 +10357,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.delete", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "delete key");
     }
   });
@@ -10331,7 +10385,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.block", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "block key");
     }
   });
@@ -10356,7 +10409,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.unblock", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "unblock key");
     }
   });
@@ -10378,7 +10430,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.reset_spend", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "reset key spend");
     }
   });
@@ -10438,23 +10489,11 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "start_date and end_date are required" });
         return;
       }
-      const tokenEntityRef = res.locals.tokenEntityRef;
-      const userId = res.locals.userId;
-      await getOrProvisionUser(
-        client,
-        tokenEntityRef,
-        userId,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        catalogClient,
-        auth,
-        logger
-      );
+      await getProvisionedUser(ctx, res);
       const usage = await client.getUsage(
         start_date,
         end_date,
-        userId
+        res.locals.userId
       );
       res.json(usage);
     } catch (error) {
@@ -10514,11 +10553,11 @@ function registerOpencodeRoutes(router, ctx) {
         sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission);
         return null;
       }
-      const userId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
+      const computedUserId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
       const userInfo = await getOrProvisionUser(
         client,
         tokenEntityRef,
-        userId,
+        computedUserId,
         provisioningEnabled,
         provisioningDefaults,
         roleConfigs,
@@ -10540,7 +10579,7 @@ function registerOpencodeRoutes(router, ctx) {
         res.status(400).json({ error: "A team is required for this connection" });
         return null;
       }
-      return { tokenEntityRef, userId, userInfo, teamId, redirectUri };
+      return { tokenEntityRef, userId: effectiveUserId(computedUserId), userInfo, teamId, redirectUri };
     };
     router.get("/opencode/connect", async (req, res) => {
       try {
@@ -10676,6 +10715,10 @@ function registerOpencodeRoutes(router, ctx) {
 var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/http/respondTeam.ts
+function respondTeam(res, team, ctx, caller) {
+  const shouldHide = caller === "member" ? ctx.teamBudgetVisibility.hideTeamBudgetForMembers : ctx.teamBudgetVisibility.hideTeamBudgetForManagers;
+  res.json(shouldHide ? redactTeamBudget(team) : team);
+}
 function respondTeamList(res, teams, ctx, caller) {
   const shouldHide = caller === "member" ? ctx.teamBudgetVisibility.hideTeamBudgetForMembers : ctx.teamBudgetVisibility.hideTeamBudgetForManagers;
   res.json(shouldHide ? teams.map(redactTeamBudget) : teams);
@@ -10716,7 +10759,6 @@ function registerTeamsRoutes(router, ctx) {
     provisioningDefaults,
     roleConfigs,
     teamAdminCfg,
-    teamBudgetVisibility,
     requireTeamMgmt,
     sendTeamError,
     authorizeTeamSubresource
@@ -10796,7 +10838,7 @@ function registerTeamsRoutes(router, ctx) {
       logger.info(`Team creation already in flight for ${key} \u2014 joining`);
       try {
         const result = await pending;
-        res.json(result);
+        respondTeam(res, result, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -10828,9 +10870,7 @@ function registerTeamsRoutes(router, ctx) {
     teamCreateInFlight.set(key, createPromise);
     try {
       const result = await createPromise;
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(result) : result
-      );
+      respondTeam(res, result, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     } finally {
@@ -10873,9 +10913,7 @@ function registerTeamsRoutes(router, ctx) {
         teamId,
         owningGroup
       });
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(r) : r
-      );
+      respondTeam(res, r, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -10937,9 +10975,7 @@ function registerTeamsRoutes(router, ctx) {
       const owned = all.filter(
         (t) => typeof t.metadata?.owning_group === "string" && t.metadata.owning_group === teamAdminCfg.group
       );
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? owned.map(redactTeamBudget) : owned
-      );
+      respondTeamList(res, owned, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -11005,12 +11041,12 @@ function registerTeamsRoutes(router, ctx) {
         });
         return;
       }
-      const litellmUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
+      const computedUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
       try {
         await getOrProvisionUser(
           client,
           userEntityRef,
-          litellmUserId,
+          computedUserId,
           provisioningEnabled,
           provisioningDefaults,
           roleConfigs,
@@ -11025,6 +11061,7 @@ function registerTeamsRoutes(router, ctx) {
         }
         throw err;
       }
+      const litellmUserId = effectiveUserId(computedUserId);
       try {
         await client.teamMemberAdd({
           team_id: teamId,
@@ -11042,9 +11079,7 @@ function registerTeamsRoutes(router, ctx) {
           via
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11066,9 +11101,9 @@ function registerTeamsRoutes(router, ctx) {
         res.status(400).json({ error: "userEntityRef query parameter is required" });
         return;
       }
-      const litellmUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
+      const litellmUserId = await ctx.resolveMemberUserId(userEntityRef);
       if (via === "teamRole") {
-        if (litellmUserId === toLiteLLMUserId(actor, userIdDomain)) {
+        if (litellmUserId === await ctx.resolveMemberUserId(actor)) {
           res.status(400).json({ error: "You cannot remove yourself from the team" });
           return;
         }
@@ -11095,9 +11130,7 @@ function registerTeamsRoutes(router, ctx) {
           via
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11115,7 +11148,6 @@ function registerObjectPermissionsRoutes(router, ctx) {
     permissions,
     logger,
     teamAdminCfg,
-    teamBudgetVisibility,
     requireObjectPerms,
     sendTeamError,
     authorizeTeamSubresource
@@ -11196,9 +11228,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
           owningGroup,
           vector_stores: requested
         });
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11282,9 +11312,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
           before,
           after: requested
         });
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11293,15 +11321,13 @@ function registerObjectPermissionsRoutes(router, ctx) {
 }
 
 // src/routes/teamUsage.ts
+var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerTeamUsageRoutes(router, ctx) {
   const {
     client,
     catalogClient,
     auth,
     logger,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs,
     teamBudgetVisibility
   } = ctx;
   const requireUser = createRequireUser(ctx);
@@ -11314,18 +11340,7 @@ function registerTeamUsageRoutes(router, ctx) {
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
-      const userId = res.locals.userId;
-      const userInfo = await getOrProvisionUser(
-        client,
-        tokenEntityRef,
-        userId,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        catalogClient,
-        auth,
-        logger
-      );
+      const userInfo = await getProvisionedUser(ctx, res);
       const isMember = userInfo?.teams?.includes(teamId) ?? false;
       let isManager = false;
       const managerCheckNeeded = ctx.teamMgmtEnabled && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
@@ -11369,6 +11384,95 @@ function registerTeamUsageRoutes(router, ctx) {
       sendError(res, error, logger, "fetch team usage");
     }
   });
+  router.get("/teams/:teamId/usage/members", requireUser, async (req, res) => {
+    const cfg = ctx.memberBreakdownCfg;
+    if (!cfg.enabled) {
+      res.status(404).json({ error: "Not found" });
+      return;
+    }
+    try {
+      const { teamId } = req.params;
+      const { start_date, end_date } = req.query;
+      if (!start_date || !end_date) {
+        res.status(400).json({ error: "start_date and end_date are required" });
+        return;
+      }
+      const tokenEntityRef = res.locals.tokenEntityRef;
+      const userInfo = await getProvisionedUser(ctx, res);
+      const callerId = res.locals.userId;
+      const isMember = userInfo?.teams?.includes(teamId) ?? false;
+      let team;
+      try {
+        team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
+      } catch (err) {
+        if (err instanceof LiteLLMUpstreamError && err.status === 404) {
+          res.status(404).json({ error: "Team not found" });
+          return;
+        }
+        throw err;
+      }
+      const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
+      const isManager = ctx.teamMgmtEnabled && !!owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger);
+      if (!isMember && !isManager) {
+        res.status(404).json({ error: "Team not found" });
+        return;
+      }
+      const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
+      const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
+      const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common7.litellmTeamUsageReadPermission);
+      if (!allowed) {
+        res.status(403).json({
+          error: "Access denied: viewing per-member usage needs a team role or permission"
+        });
+        return;
+      }
+      const [usage, keys] = await Promise.all([
+        client.getTeamUsage(teamId, start_date, end_date),
+        client.listTeamKeys(teamId)
+      ]);
+      const profiles = await lookupProfiles(memberEmails(team, keys));
+      const breakdown = buildTeamMemberUsage(teamId, usage, keys, team, profiles);
+      let via = "permission";
+      if (isManager) via = "manager";
+      else if (viaRole) via = "teamRole";
+      logger.info("team.usage.members.read", { actor: tokenEntityRef, teamId, via });
+      const hide = isManager ? teamBudgetVisibility.hideTeamBudgetForManagers : teamBudgetVisibility.hideTeamBudgetForMembers;
+      res.json(hide ? redactTeamMemberUsage(breakdown) : breakdown);
+    } catch (error) {
+      if (error instanceof ProvisioningError) {
+        res.status(error.status).json(error.body);
+        return;
+      }
+      sendError(res, error, logger, "fetch team member usage");
+    }
+  });
+  async function lookupProfiles(emails) {
+    const profiles = /* @__PURE__ */ new Map();
+    if (!emails.length) return profiles;
+    try {
+      const { token } = await auth.getPluginRequestToken({
+        onBehalfOf: await auth.getOwnServiceCredentials(),
+        targetPluginId: "catalog"
+      });
+      const { items } = await catalogClient.getEntities(
+        {
+          filter: { kind: "User", "spec.profile.email": emails },
+          fields: ["spec.profile"]
+        },
+        { token }
+      );
+      for (const entity of items) {
+        const profile = entity.spec?.profile ?? {};
+        if (typeof profile.email === "string") {
+          profiles.set(profile.email.toLowerCase(), { displayName: profile.displayName });
+        }
+      }
+    } catch (err) {
+      const message2 = err instanceof Error ? err.message : String(err);
+      logger.warn(`Catalog lookup for team member names failed: ${message2}`);
+    }
+    return profiles;
+  }
 }
 
 // node_modules/jose/dist/node/esm/runtime/base64url.js
@@ -12784,18 +12888,17 @@ function newDefaultVerifier(cfg) {
   return new KeycloakJWTVerifier({ issuer: cfg.issuer, clientId: cfg.clientId });
 }
 function normalizeIdentityOptions(opts) {
-  const o = typeof opts === "string" ? { userIdDomain: opts } : opts ?? {};
   let domains = [];
-  if (o.trustedEmailDomains?.length) {
-    domains = o.trustedEmailDomains;
-  } else if (o.userIdDomain) {
-    domains = [o.userIdDomain];
+  if (opts.trustedEmailDomains?.length) {
+    domains = opts.trustedEmailDomains;
+  } else if (opts.userIdDomain) {
+    domains = [opts.userIdDomain];
   }
   const trusted = domains.map((d) => d.toLowerCase());
-  return { userIdDomain: o.userIdDomain, trusted };
+  return { userIdDomain: opts.userIdDomain, trusted };
 }
 function resolveBridgeUserId(claims, identity) {
-  const { userIdDomain, trusted } = normalizeIdentityOptions(identity);
+  const { userIdDomain, trusted } = normalizeIdentityOptions(identity ?? {});
   if (trusted.length === 0) {
     throw new BridgeIdentityError(
       "set litellm.bridge.allowedEmailDomains (or litellm.userIdDomain) to use the CLI bridge"
@@ -12830,8 +12933,8 @@ function resolveBridgeUserId(claims, identity) {
   name = name || emailLocalPart;
   return toLiteLLMUserId(name, userIdDomain);
 }
-async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
-  const userId = resolveBridgeUserId(claims, userIdDomain);
+async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, identity) {
+  const userId = resolveBridgeUserId(claims, identity);
   const existing = await client.getUserInfo(userId);
   if (existing) return existing;
   if (claims.email) {
@@ -12872,42 +12975,21 @@ async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled,
   }
   return created;
 }
-async function bridgeListKeys(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
+async function bridgeListKeys(client, claims, provisioningEnabled, provisioningDefaults, logger, identity) {
   const user = await getOrProvisionUserFromClaims(
     client,
     claims,
     provisioningEnabled,
     provisioningDefaults,
     logger,
-    userIdDomain
+    identity
   );
   return client.listKeys(user.user_id);
 }
-async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, request, userIdDomain) {
-  const user = await getOrProvisionUserFromClaims(
-    client,
-    claims,
-    provisioningEnabled,
-    provisioningDefaults,
-    logger,
-    userIdDomain
-  );
-  const enriched = {
-    ...request,
-    user_id: user.user_id,
-    metadata: {
-      ...request.metadata ?? {},
-      created_via: "abby-cli",
-      created_by: user.user_id,
-      created_at_iso: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  };
-  return client.generateKey(enriched);
-}
 
 // src/routes/bridge.ts
-var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
 var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
   const {
     client,
@@ -12915,13 +12997,12 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
     userIdDomain,
     provisioningEnabled,
     provisioningDefaults,
-    roleConfigs,
     allowUnlimitedBudget,
     teamRequired,
     keyValidationConfig
   } = ctx;
   const { config } = bridgeOpts;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common8.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common9.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
   const bridgeCfg = readBridgeConfig(config);
   const bridgeIdentity = {
     userIdDomain,
@@ -13000,26 +13081,25 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         if (!allowUnlimitedBudget && input.max_budget === void 0) {
           input.max_budget = provisioningDefaults.maxBudget;
         }
-        const userId = resolveBridgeUserId(claims, bridgeIdentity);
+        const userInfo = await getOrProvisionUserFromClaims(
+          client,
+          claims,
+          provisioningEnabled,
+          provisioningDefaults,
+          logger,
+          bridgeIdentity
+        );
         const keyCreateCtx = {
           client,
           config: {
             allowUnlimitedBudget,
             teamRequired
           },
-          // Bridge does not have Backstage catalogClient/auth
-          // so provisioning from JWT claims only (no Backstage profile enrichment)
-          catalogClient: void 0,
-          auth: void 0,
           logger,
-          keyValidationConfig,
-          provisioningEnabled,
-          provisioningDefaults,
-          roleConfigs,
-          userIdDomain
+          keyValidationConfig
         };
         const result = await createKeyForUser(
-          { userId },
+          { userInfo, createdVia: "abby-cli" },
           input,
           keyCreateCtx
         );
@@ -13040,20 +13120,21 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
           bridgeIdentity
         );
         const teamIds = user.teams ?? [];
-        const teamMetadata = [];
-        for (const teamId of teamIds) {
-          try {
-            const teamInfo = await client.getTeamInfo(teamId);
-            teamMetadata.push({
-              id: teamId,
-              name: teamInfo.team_alias || teamId
-              // Use alias as display name, fallback to ID
-            });
-          } catch (e) {
-            logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
-            teamMetadata.push({ id: teamId });
-          }
-        }
+        const teamMetadata = await Promise.all(
+          teamIds.map(async (teamId) => {
+            try {
+              const teamInfo = await client.getTeamInfo(teamId);
+              return {
+                id: teamId,
+                name: teamInfo.team_alias || teamId
+                // Use alias as display name, fallback to ID
+              };
+            } catch (e) {
+              logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
+              return { id: teamId };
+            }
+          })
+        );
         res.json({ user_id: user.user_id, teams: teamIds, team_metadata: teamMetadata });
       } catch (error) {
         handleBridgeError(error, res);
@@ -13082,11 +13163,11 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         }
         const team = await client.getTeamInfo(teamId);
         const allowed = team.models;
-        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common7.ALL_PROXY_MODELS)) {
+        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common8.ALL_PROXY_MODELS)) {
           res.json(models);
           return;
         }
-        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common7.isModelAllowed)(m, allowed)));
+        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common8.isModelAllowed)(m, allowed)));
       } catch (error) {
         handleBridgeError(error, res);
       }
@@ -13118,18 +13199,20 @@ async function createRouter(options) {
   const keyMaxBudget = config.getOptionalNumber("litellm.keys.maxBudget") ?? 100;
   const keyMaxTpm = config.getOptionalNumber("litellm.keys.maxTpm") ?? 1e5;
   const keyMaxRpm = config.getOptionalNumber("litellm.keys.maxRpm") ?? 1e3;
-  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common9.DEFAULT_KEY_DURATIONS;
+  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common10.DEFAULT_KEY_DURATIONS;
   const keyValidationConfig = {
     maxBudget: keyMaxBudget,
     maxTpm: keyMaxTpm,
     maxRpm: keyMaxRpm,
-    allowedDurations: keyAllowedDurations
+    allowedDurations: keyAllowedDurations,
+    allowedBudgetDurations: config.getOptionalStringArray("litellm.keys.allowedBudgetDurations") ?? import_backstage_plugin_litellm_common10.DEFAULT_KEY_BUDGET_DURATIONS
   };
   const teamMgmtEnabled = isTeamManagementEnabled(config);
   const objectPermsEnabled = isObjectPermissionsEnabled(config);
   const teamAdminCfg = readTeamAdminConfig(config);
   const teamBudgetVisibility = readTeamBudgetVisibility(config);
   const opencodeCfg = readOpencodeConfig(config);
+  const memberBreakdownCfg = readMemberBreakdownConfig(config);
   const catalogClient = options.catalogClient ?? new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
@@ -13146,7 +13229,13 @@ async function createRouter(options) {
       `LiteLLM team budget hiding enabled \u2014 members: ${teamBudgetVisibility.hideTeamBudgetForMembers}, managers: ${teamBudgetVisibility.hideTeamBudgetForManagers}`
     );
   }
+  const resolveMemberUserId = async (userEntityRef) => {
+    const computed = toLiteLLMUserId(userEntityRef, userIdDomain);
+    await findLiteLLMUser(client, userEntityRef, computed, catalogClient, auth, logger);
+    return effectiveUserId(computed);
+  };
   const ctx = {
+    resolveMemberUserId,
     client,
     catalogClient,
     auth,
@@ -13169,34 +13258,21 @@ async function createRouter(options) {
     teamAdminCfg,
     teamBudgetVisibility,
     opencodeCfg,
+    memberBreakdownCfg,
     // Helper functions - defined inline below this object
     authorizeKeyAction: async (req, keyId) => {
       if (!req.res || !req.res.locals.tokenEntityRef || !req.res.locals.userId) {
-        throw new import_errors20.NotAllowedError("User identity not found in request");
+        throw new import_errors21.NotAllowedError("User identity not found in request");
       }
       const tokenEntityRef = req.res.locals.tokenEntityRef;
-      const userId = req.res.locals.userId;
+      const userId = await resolveMemberUserId(tokenEntityRef);
       const ownKeys = await client.listKeys(userId);
       const key = ownKeys.find((k) => (k.token ?? k.key) === keyId);
       if (!key) {
-        throw new import_errors20.NotAllowedError("Access denied: key does not belong to the caller");
+        throw new import_errors21.NotAllowedError("Access denied: key does not belong to the caller");
       }
       return { tokenEntityRef, userId, key };
     },
-    sendOwnershipError: (err, res) => {
-      if (err instanceof import_errors20.NotAllowedError) {
-        res.status(403).json({ error: err.message });
-        return true;
-      }
-      if (err && typeof err === "object" && "status" in err && "body" in err) {
-        const errObj = err;
-        if (typeof errObj.status === "number" && errObj.body) {
-          res.status(errObj.status).json(errObj.body);
-          return true;
-        }
-      }
-      return false;
-    },
     assertPermission: async (req, permission) => {
       const credentials = await resolveCredentials(req, auth);
       if (!credentials) return false;
@@ -13305,7 +13381,7 @@ async function createRouter(options) {
       }
       if (teamRoleEligible) {
         const actor = await resolveUserId(req, auth);
-        const litellmUserId = actor && toLiteLLMUserId(actor, userIdDomain);
+        const litellmUserId = actor && await resolveMemberUserId(actor);
         const role = existing.members_with_roles?.find(
           (m) => m.user_id === litellmUserId
         )?.role;
@@ -13339,7 +13415,7 @@ async function createRouter(options) {
 }
 
 // src/plugin.ts
-var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
 var BRIDGE_UNAUTHENTICATED_PATHS = [
   "/bridge/health",
   "/bridge/keys",
@@ -13368,7 +13444,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
         permissions,
         permissionsRegistry
       }) {
-        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common10.litellmPermissions);
+        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common11.litellmPermissions);
         const router = await createRouter({
           config,
           logger,
@@ -13388,7 +13464,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
 });
 
 // src/index.ts
-var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common12 = require("@acarmisc/backstage-plugin-litellm-common");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   KeycloakJWTVerifier,
@@ -13396,7 +13472,6 @@ var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plug
   ProvisioningError,
   applyRoleOverrides,
   assertTeamAdmin,
-  bridgeGenerateKey,
   bridgeListKeys,
   createRouter,
   getOrProvisionUser,
@@ -13417,7 +13492,6 @@ var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plug
   litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission,
   newDefaultVerifier,
-  normalizeRequestTags,
   provisionUser,
   readBridgeConfig,
   readProvisioningDefaults,