@acarmisc/backstage-plugin-litellm-backend 0.23.0 → 0.25.0

package/dist/langfuse.d.ts

@@ -0,0 +1,32 @@
+import { Config } from '@backstage/config';
+/**
+ * Generic Langfuse Metrics API v2 integration (litellm.langfuse.*).
+ *
+ * Powers the "Quality scores" card on the Insights tab with independent
+ * answer-quality data. Nothing here is bound to a specific deployment:
+ * the server version and the trace↔user join key vary, so a misconfigured
+ * or v3 server degrades to `{configured:false}` instead of erroring.
+ */
+export interface LangfuseConfig {
+    /** Mount GET /insights/quality and query Langfuse. Default false. */
+    enabled: boolean;
+    /** Langfuse host, e.g. https://langfuse.example.com. */
+    baseUrl: string | null;
+    /** Langfuse public key (Basic-auth username). */
+    publicKey: string | null;
+    /** Langfuse secret key (Basic-auth password). */
+    secretKey: string | null;
+    /**
+     * The Langfuse observation field holding the LiteLLM user id, e.g.
+     * 'userId'. Deployments whose agents tag traces differently change this
+     * one key. Default 'userId'.
+     */
+    userIdField: string;
+}
+export declare function readLangfuseConfig(config: Config): LangfuseConfig;
+/** True only when the integration is enabled AND fully credentialed. */
+export declare function isLangfuseConfigured(cfg: LangfuseConfig): cfg is LangfuseConfig & {
+    baseUrl: string;
+    publicKey: string;
+    secretKey: string;
+};

package/dist/langfuse.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readLangfuseConfig = readLangfuseConfig;
+exports.isLangfuseConfigured = isLangfuseConfigured;
+function readLangfuseConfig(config) {
+    const enabled = config.getOptionalBoolean('litellm.langfuse.enabled') ?? false;
+    return {
+        enabled,
+        baseUrl: config.getOptionalString('litellm.langfuse.baseUrl') ?? null,
+        publicKey: config.getOptionalString('litellm.langfuse.publicKey') ?? null,
+        secretKey: config.getOptionalString('litellm.langfuse.secretKey') ?? null,
+        userIdField: config.getOptionalString('litellm.langfuse.userIdField') ?? 'userId',
+    };
+}
+/** True only when the integration is enabled AND fully credentialed. */
+function isLangfuseConfigured(cfg) {
+    return (cfg.enabled && !!cfg.baseUrl && !!cfg.publicKey && !!cfg.secretKey);
+}

package/dist/langfuseClient.d.ts

@@ -0,0 +1,23 @@
+import type { QualitySummary } from './types';
+import { type LangfuseConfig } from './langfuse';
+/** Typed error for failed Langfuse Metrics API responses. */
+export declare class LangfuseUpstreamError extends Error {
+    status: number;
+    constructor(status: number, statusText: string);
+}
+/**
+ * Runs one Langfuse Metrics API v2 query:
+ * GET {baseUrl}/api/public/v2/metrics with Basic auth (publicKey:secretKey)
+ * and `query` = the JSON query object.
+ */
+export declare function queryMetrics(baseUrl: string, publicKey: string, secretKey: string, queryObj: unknown, timeout?: number): Promise<any>;
+/**
+ * Returns the caller's quality summary, or null when Langfuse is disabled,
+ * unconfigured, unreachable, or a v3 server without the v2 metrics endpoint
+ * (non-2xx degrades to null — never throws).
+ */
+export declare function getQualitySummary(cfg: LangfuseConfig, opts: {
+    from: string;
+    to: string;
+    userId: string;
+}): Promise<QualitySummary | null>;

package/dist/langfuseClient.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LangfuseUpstreamError = void 0;
+exports.queryMetrics = queryMetrics;
+exports.getQualitySummary = getQualitySummary;
+const langfuse_1 = require("./langfuse");
+const DEFAULT_TIMEOUT = 15000;
+/** Typed error for failed Langfuse Metrics API responses. */
+class LangfuseUpstreamError extends Error {
+    constructor(status, statusText) {
+        super(`Langfuse API error: ${status} ${statusText}`);
+        this.status = status;
+    }
+}
+exports.LangfuseUpstreamError = LangfuseUpstreamError;
+/**
+ * Runs one Langfuse Metrics API v2 query:
+ * GET {baseUrl}/api/public/v2/metrics with Basic auth (publicKey:secretKey)
+ * and `query` = the JSON query object.
+ */
+async function queryMetrics(baseUrl, publicKey, secretKey, queryObj, timeout = DEFAULT_TIMEOUT) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+        const url = `${baseUrl.replace(/\/$/, '')}/api/public/v2/metrics?query=${encodeURIComponent(JSON.stringify(queryObj))}`;
+        const response = await fetch(url, {
+            signal: controller.signal,
+            headers: {
+                Authorization: `Basic ${Buffer.from(`${publicKey}:${secretKey}`).toString('base64')}`,
+            },
+        });
+        if (!response.ok) {
+            throw new LangfuseUpstreamError(response.status, response.statusText);
+        }
+        return response.json();
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
+function toNum(v) {
+    if (typeof v === 'number')
+        return Number.isFinite(v) ? v : null;
+    if (typeof v === 'string' && v.trim() !== '') {
+        const n = Number(v);
+        return Number.isFinite(n) ? n : null;
+    }
+    return null;
+}
+/** First finite number found across the row, its metrics nest, and its dimensions nest. */
+function pick(row, names) {
+    const scopes = [row, row?.metrics, row?.dimensions];
+    for (const scope of scopes) {
+        if (!scope || typeof scope !== 'object')
+            continue;
+        for (const name of names) {
+            const n = toNum(scope[name]);
+            if (n !== null)
+                return n;
+        }
+    }
+    return null;
+}
+function pickText(row, names) {
+    const scopes = [row, row?.metrics, row?.dimensions];
+    for (const scope of scopes) {
+        if (!scope || typeof scope !== 'object')
+            continue;
+        for (const name of names) {
+            const v = scope[name];
+            if (typeof v === 'string' && v)
+                return v;
+        }
+    }
+    return null;
+}
+function metricRows(body) {
+    if (Array.isArray(body))
+        return body;
+    if (Array.isArray(body?.data))
+        return body.data;
+    if (Array.isArray(body?.results))
+        return body.results;
+    if (Array.isArray(body?.rows))
+        return body.rows;
+    return [];
+}
+function parseObservations(body) {
+    const byModel = metricRows(body)
+        .map(row => ({
+        model: pickText(row, ['providedModelName', 'model', 'modelName']) ?? '',
+        cost: pick(row, ['sum_totalCost', 'totalCost', 'sum_total_cost', 'cost', 'sum_cost']) ?? 0,
+        tokens: pick(row, ['sum_totalTokens', 'totalTokens', 'sum_total_tokens', 'tokens']) ?? 0,
+        avgLatencyMs: pick(row, ['avg_latency', 'latency', 'avg_latency_ms', 'latencyMs']),
+        requests: pick(row, ['count_id', 'count', 'id_count', 'requests', 'observations']) ?? 0,
+    }))
+        .filter((r) => r.model !== '');
+    byModel.sort((a, b) => b.cost - a.cost);
+    return byModel;
+}
+function parseScores(body) {
+    const scores = metricRows(body)
+        .map(row => ({
+        name: pickText(row, ['name', 'scoreName']) ?? '',
+        avg: pick(row, ['avg_value', 'value', 'avg']) ?? NaN,
+        count: pick(row, ['count_id', 'count', 'id_count', 'scores']) ?? 0,
+    }))
+        .filter(s => s.name !== '' && Number.isFinite(s.avg));
+    scores.sort((a, b) => a.name.localeCompare(b.name));
+    return scores;
+}
+function toTimestamp(day, endOfDay) {
+    if (/^\d{4}-\d{2}-\d{2}$/.test(day)) {
+        return endOfDay ? `${day}T23:59:59.999Z` : `${day}T00:00:00.000Z`;
+    }
+    return day;
+}
+/**
+ * Returns the caller's quality summary, or null when Langfuse is disabled,
+ * unconfigured, unreachable, or a v3 server without the v2 metrics endpoint
+ * (non-2xx degrades to null — never throws).
+ */
+async function getQualitySummary(cfg, opts) {
+    if (!(0, langfuse_1.isLangfuseConfigured)(cfg))
+        return null;
+    const { baseUrl, publicKey, secretKey, userIdField } = cfg;
+    const fromTimestamp = toTimestamp(opts.from, false);
+    const toTimestampValue = toTimestamp(opts.to, true);
+    try {
+        const observations = await queryMetrics(baseUrl, publicKey, secretKey, {
+            view: 'observations',
+            metrics: [
+                { measure: 'totalCost', aggregation: 'SUM' },
+                { measure: 'totalTokens', aggregation: 'SUM' },
+                { measure: 'latency', aggregation: 'AVG' },
+                { measure: 'id', aggregation: 'COUNT' },
+            ],
+            dimensions: [{ field: 'providedModelName' }],
+            filters: [
+                { column: userIdField, operator: '=', value: opts.userId, type: 'string' },
+            ],
+            fromTimestamp,
+            toTimestamp: toTimestampValue,
+            config: { row_limit: 50 },
+        });
+        // Scores are deployment-wide: the scores view does not reliably carry the
+        // trace user join key, so filtering it would silently drop every row.
+        let scores = [];
+        try {
+            const scoresBody = await queryMetrics(baseUrl, publicKey, secretKey, {
+                view: 'scores-numeric',
+                metrics: [
+                    { measure: 'value', aggregation: 'AVG' },
+                    { measure: 'id', aggregation: 'COUNT' },
+                ],
+                dimensions: [{ field: 'name' }],
+                fromTimestamp,
+                toTimestamp: toTimestampValue,
+                config: { row_limit: 50 },
+            });
+            scores = parseScores(scoresBody);
+        }
+        catch {
+            scores = [];
+        }
+        return { configured: true, byModel: parseObservations(observations), scores };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/plugin.js

@@ -13,6 +13,7 @@ const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-li
 exports.BRIDGE_UNAUTHENTICATED_PATHS = [
     '/bridge/health',
     '/bridge/keys',
+    '/bridge/mcp',
     '/bridge/models',
     '/bridge/user/info',
 ];

package/dist/router.js

@@ -47,6 +47,7 @@ const teamAdmin_1 = require("./teamAdmin");
 const teamBudgetVisibility_1 = require("./teamBudgetVisibility");
 const opencode_1 = require("./opencode");
 const teamMemberUsage_1 = require("./teamMemberUsage");
+const langfuse_1 = require("./langfuse");
 const errors_2 = require("./errors");
 const withUser_1 = require("./routes/middleware/withUser");
 const userInfoCache_1 = require("./services/userInfoCache");
@@ -101,6 +102,7 @@ async function createRouter(options) {
     const teamBudgetVisibility = (0, teamBudgetVisibility_1.readTeamBudgetVisibility)(config);
     const opencodeCfg = (0, opencode_1.readOpencodeConfig)(config);
     const memberBreakdownCfg = (0, teamMemberUsage_1.readMemberBreakdownConfig)(config);
+    const langfuseCfg = (0, langfuse_1.readLangfuseConfig)(config);
     const catalogClient = options.catalogClient ?? new catalog_client_1.CatalogClient({ discoveryApi: discovery });
     if (provisioningEnabled) {
         logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length
@@ -147,6 +149,7 @@ async function createRouter(options) {
         teamBudgetVisibility,
         opencodeCfg,
         memberBreakdownCfg,
+        langfuseCfg,
         // Helper functions - defined inline below this object
         authorizeKeyAction: async (req, keyId) => {
             // Express middleware should have populated req.res.locals with user info

package/dist/routes/bridge.js

@@ -4,6 +4,7 @@ exports.registerBridgeRoutes = registerBridgeRoutes;
 const provisioning_1 = require("../provisioning");
 const bridge_1 = require("../bridge");
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+const mcpAccess_1 = require("../services/mcpAccess");
 const keyService_1 = require("../services/keyService");
 const errors_1 = require("../errors");
 const backstage_plugin_litellm_common_2 = require("@acarmisc/backstage-plugin-litellm-common");
@@ -175,6 +176,29 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                 handleBridgeError(error, res);
             }
         });
+        // MCP servers the caller's team may use, for CLI clients that let the user
+        // pick which to attach to a new key. team_id is required: unlike models
+        // there is no meaningful unscoped catalogue to hand out.
+        router.get('/bridge/mcp', async (req, res) => {
+            try {
+                const claims = await requireClaims(req);
+                const teamId = typeof req.query.team_id === 'string' ? req.query.team_id : '';
+                if (!teamId) {
+                    res.status(400).json({ error: 'team_id is required' });
+                    return;
+                }
+                const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
+                if (!(user.teams ?? []).includes(teamId)) {
+                    res.status(403).json({ error: 'Access denied: team is not one of your teams', team_id: teamId });
+                    return;
+                }
+                const names = (0, mcpAccess_1.teamMcpServers)(await client.getTeamInfo(teamId));
+                res.json(names.map(server_name => ({ server_name })));
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
     }
     else if (bridgeCfg.enabled) {
         logger.warn('litellm.bridge.enabled is true but no verifier could be built — bridge endpoints not mounted');

package/dist/routes/context.d.ts

@@ -9,6 +9,7 @@ import type { KeyValidationConfig } from '@acarmisc/backstage-plugin-litellm-com
 import { TeamBudgetVisibility } from '../teamBudgetVisibility';
 import { OpencodeConfig } from '../opencode';
 import { MemberBreakdownConfig } from '../teamMemberUsage';
+import { LangfuseConfig } from '../langfuse';
 /**
  * Shared runtime context for all route handlers. Holds config-derived
  * constants, service clients, and helper functions needed by routes.
@@ -37,6 +38,7 @@ export interface RouterContext {
     teamBudgetVisibility: TeamBudgetVisibility;
     opencodeCfg: OpencodeConfig;
     memberBreakdownCfg: MemberBreakdownConfig;
+    langfuseCfg: LangfuseConfig;
     /**
      * LiteLLM user id of a Backstage user: the computed id, or the id of an
      * existing LiteLLM user with the same catalog email.

package/dist/routes/insights.js

@@ -4,6 +4,8 @@ exports.registerInsightsRoutes = registerInsightsRoutes;
 const provisioning_1 = require("../provisioning");
 const errors_1 = require("../errors");
 const withUser_1 = require("./middleware/withUser");
+const langfuse_1 = require("../langfuse");
+const langfuseClient_1 = require("../langfuseClient");
 function registerInsightsRoutes(router, ctx) {
     const { client, catalogClient, auth, logger, auditGroup } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
@@ -40,4 +42,39 @@ function registerInsightsRoutes(router, ctx) {
             (0, errors_1.sendError)(res, error, logger, 'fetch spend logs');
         }
     });
+    router.get('/insights/quality', requireUser, async (req, res) => {
+        try {
+            const { start_date, end_date, userId } = req.query;
+            if (!start_date || !end_date) {
+                res.status(400).json({ error: 'start_date and end_date are required' });
+                return;
+            }
+            const tokenEntityRef = res.locals.tokenEntityRef;
+            await (0, withUser_1.getProvisionedUser)(ctx, res);
+            const callerId = res.locals.userId;
+            const isAudit = auditGroup
+                ? await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, auditGroup, catalogClient, auth, logger)
+                : false;
+            if (!(0, langfuse_1.isLangfuseConfigured)(ctx.langfuseCfg)) {
+                res.json({ configured: false });
+                return;
+            }
+            // Server-side scoping, same as spend-logs: only audit-group members
+            // may query other users — everyone else is forced to their own user_id.
+            // Unreachable / v3 servers degrade to {configured:false}, never a 500.
+            const summary = await (0, langfuseClient_1.getQualitySummary)(ctx.langfuseCfg, {
+                from: start_date,
+                to: end_date,
+                userId: isAudit ? userId || callerId : callerId,
+            });
+            res.json(summary ?? { configured: false });
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            (0, errors_1.sendError)(res, error, logger, 'fetch quality summary');
+        }
+    });
 }

package/dist/services/keyService.js

@@ -11,6 +11,7 @@ exports.KeyServiceError = void 0;
 exports.createKeyForUser = createKeyForUser;
 const provisioning_1 = require("../provisioning");
 const modelAccess_1 = require("./modelAccess");
+const mcpAccess_1 = require("./mcpAccess");
 /** Error thrown during key creation — maps to HTTP responses. */
 class KeyServiceError extends Error {
     constructor(status, body, message) {
@@ -58,6 +59,9 @@ async function createKeyForUser(user, input, ctx) {
             });
         }
     }
+    // The team is read at most once per mint, and only if a check needs it.
+    let teamPromise;
+    const getTeam = (teamId) => (teamPromise ?? (teamPromise = client.getTeamInfo(teamId)));
     // ── Validate models are subset of allowed ────────────────────────────
     if (input.models && input.models.length > 0) {
         // When team_id is set, use team's models; otherwise use user's models.
@@ -67,7 +71,7 @@ async function createKeyForUser(user, input, ctx) {
             // Fetch team info to get its allowed models.
             // Fail closed: if the team can't be fetched the error propagates
             // rather than silently skipping the model check.
-            const teamInfo = await client.getTeamInfo(input.team_id);
+            const teamInfo = await getTeam(input.team_id);
             allowedModels = teamInfo?.models ?? [];
         }
         else {
@@ -106,6 +110,23 @@ async function createKeyForUser(user, input, ctx) {
         ...clientMetadata,
         ...serverMetadata,
     };
+    // ── Validate MCP servers are a subset of the team's ──────────────────
+    // [] is "no MCP servers" and needs no team; any name needs a team to be
+    // checked against, so a client cannot grant itself servers it has no
+    // ceiling for.
+    const mcpServers = input.mcp_servers ? [...new Set(input.mcp_servers)] : undefined;
+    if (mcpServers && mcpServers.length > 0) {
+        if (!input.team_id) {
+            throw new KeyServiceError(400, { error: 'team_id is required when mcp_servers is set' });
+        }
+        const disallowed = (0, mcpAccess_1.findDisallowedMcpServers)(mcpServers, (0, mcpAccess_1.teamMcpServers)(await getTeam(input.team_id)));
+        if (disallowed.length > 0) {
+            throw new KeyServiceError(403, {
+                error: 'One or more requested MCP servers are not allowed',
+                disallowed_mcp_servers: disallowed,
+            });
+        }
+    }
     // ── Build upstream request EXPLICITLY from parsed fields ──────────────
     // Never spread the raw body; only include fields we've explicitly validated.
     const upstreamRequest = {
@@ -139,6 +160,11 @@ async function createKeyForUser(user, input, ctx) {
     if (input.key_type !== undefined) {
         upstreamRequest.key_type = input.key_type;
     }
+    if (mcpServers) {
+        upstreamRequest.object_permission = {
+            mcp_servers: mcpServers.length > 0 ? mcpServers : [mcpAccess_1.NO_MCP_SERVERS],
+        };
+    }
     upstreamRequest.metadata = enrichedMetadata;
     // ── Call upstream LiteLLM ───────────────────────────────────────────
     const result = await client.generateKey(upstreamRequest);

package/dist/services/mcpAccess.d.ts

@@ -0,0 +1,20 @@
+/** LiteLLM's documented value that denies every MCP server. */
+export declare const NO_MCP_SERVERS = "no-mcp-servers";
+/**
+ * MCP servers a team may bind to a key: exactly the team's own list, as stored
+ * (LiteLLM accepts a server's name or id interchangeably when enforcing). A team
+ * with no list gets nothing: "empty" means unrestricted to LiteLLM, but a key
+ * list is a grant, so an unrestricted team must not let a member name servers it
+ * was never given. Entries the mint schema would reject are dropped so the
+ * picker never offers an unselectable name.
+ *
+ * shortcut: team `mcp_access_groups` are not expanded into server names; add
+ * that when a team grants MCP access only through groups.
+ */
+export declare function teamMcpServers(team: {
+    object_permission?: {
+        mcp_servers?: string[];
+    };
+} | undefined): string[];
+/** Requested names that are not in `allowed`, de-duplicated. */
+export declare function findDisallowedMcpServers(requested: string[], allowed: string[]): string[];

package/dist/services/mcpAccess.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_MCP_SERVERS = void 0;
+exports.teamMcpServers = teamMcpServers;
+exports.findDisallowedMcpServers = findDisallowedMcpServers;
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+/** LiteLLM's documented value that denies every MCP server. */
+exports.NO_MCP_SERVERS = 'no-mcp-servers';
+/**
+ * MCP servers a team may bind to a key: exactly the team's own list, as stored
+ * (LiteLLM accepts a server's name or id interchangeably when enforcing). A team
+ * with no list gets nothing: "empty" means unrestricted to LiteLLM, but a key
+ * list is a grant, so an unrestricted team must not let a member name servers it
+ * was never given. Entries the mint schema would reject are dropped so the
+ * picker never offers an unselectable name.
+ *
+ * shortcut: team `mcp_access_groups` are not expanded into server names; add
+ * that when a team grants MCP access only through groups.
+ */
+function teamMcpServers(team) {
+    const listed = team?.object_permission?.mcp_servers ?? [];
+    return [...new Set(listed)].filter(n => backstage_plugin_litellm_common_1.MCP_SERVER_NAME_RE.test(n));
+}
+/** Requested names that are not in `allowed`, de-duplicated. */
+function findDisallowedMcpServers(requested, allowed) {
+    const ok = new Set(allowed);
+    return [...new Set(requested)].filter(n => !ok.has(n));
+}

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type TeamMemberUsage,\n  type TeamMemberUsageRow,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n  type SpendLogEntry,\n  type SpendLogsParams,\n  type PaginatedSpendLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type TeamMemberUsage,\n  type TeamMemberUsageRow,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n  type SpendLogEntry,\n  type SpendLogsParams,\n  type PaginatedSpendLogs,\n  type QualityByModel,\n  type QualityScore,\n  type QualitySummary,\n  type QualityResponse,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export { type UserInfo, type TeamMember, type TeamObjectPermission, type TeamInfo, type CreateTeamResponse, type VirtualKey, type ModelInfo, type UsageModelBreakdown, type UsageKeyBreakdown, type UsageDailyPoint, type UsageDailyModelPoint, type UsageMetrics, type TeamMemberUsage, type TeamMemberUsageRow, type GenerateKeyRequest, type UpdateKeyRequest, type GenerateKeyResponse, type AuditLogEntry, type PaginatedAuditLogs, type SpendLogEntry, type SpendLogsParams, type PaginatedSpendLogs, } from '@acarmisc/backstage-plugin-litellm-common';
+export { type UserInfo, type TeamMember, type TeamObjectPermission, type TeamInfo, type CreateTeamResponse, type VirtualKey, type ModelInfo, type UsageModelBreakdown, type UsageKeyBreakdown, type UsageDailyPoint, type UsageDailyModelPoint, type UsageMetrics, type TeamMemberUsage, type TeamMemberUsageRow, type GenerateKeyRequest, type UpdateKeyRequest, type GenerateKeyResponse, type AuditLogEntry, type PaginatedAuditLogs, type SpendLogEntry, type SpendLogsParams, type PaginatedSpendLogs, type QualityByModel, type QualityScore, type QualitySummary, type QualityResponse, } from '@acarmisc/backstage-plugin-litellm-common';
 export interface CreateTeamRequest {
     team_alias: string;
     models?: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -35,7 +35,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@acarmisc/backstage-plugin-litellm-common": "0.3.0",
+    "@acarmisc/backstage-plugin-litellm-common": "0.5.0",
     "@backstage/backend-plugin-api": "^1.9.1",
     "@backstage/catalog-client": "^1.9.0",
     "@backstage/config": "^1.3.0",