@acarmisc/backstage-plugin-litellm-backend 0.31.0 → 0.32.0

package/config.d.ts

@@ -44,16 +44,29 @@ export interface Config {
       enabled?: boolean;
 
       defaults?: {
+        /**
+         * Leave first-visit user budgets to LiteLLM. When true, maxBudget and
+         * budgetDuration have no built-in fallback: each is sent on /user/new
+         * only if set here or on the matching roles[] entry. Otherwise LiteLLM's
+         * litellm_settings.max_internal_user_budget /
+         * internal_user_budget_duration apply (LiteLLM applies those to
+         * user_role internal_user only).
+         * @default false
+         */
+        useGatewayBudgetDefaults?: boolean;
+
         /**
          * Max lifetime spend in USD before the account is blocked.
-         * Set a conservative value; null means no hard cap.
+         * Set a conservative value. When unset, 10 is used unless
+         * useGatewayBudgetDefaults is true (a YAML null counts as unset).
          * @default 10
          */
         maxBudget?: number;
 
         /**
          * Spend-reset period for maxBudget (e.g. "30d", "7d", "1h").
-         * After this period the spend counter resets.
+         * After this period the spend counter resets. When unset, "30d" is
+         * used unless useGatewayBudgetDefaults is true.
          * @default "30d"
          */
         budgetDuration?: string;
@@ -167,6 +180,9 @@ export interface Config {
        * Allowed duration presets for keys (e.g. "1d", "7d", "30d", "90d").
        * Requests with a duration not in this list are rejected with a 400 error.
        * An empty array allows any duration matching the format /^\d+[smhdwy]$/.
+       * List "never" to offer keys that never expire: such a key is sent to
+       * LiteLLM with no duration. "never" is never the default and is only
+       * accepted when listed here.
        * @default ["1d", "7d", "30d", "90d"]
        */
       allowedDurations?: string[];

package/dist/index.cjs.js

@@ -7986,20 +7986,20 @@ __export(index_exports, {
   getOrProvisionUser: () => getOrProvisionUser,
   getOrProvisionUserFromClaims: () => getOrProvisionUserFromClaims,
   isTeamManagementEnabled: () => isTeamManagementEnabled,
-  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common13.litellmAuditReadPermission,
-  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common13.litellmKeyCreatePermission,
-  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common13.litellmKeyManagePermission,
-  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common13.litellmKeyResetSpendPermission,
-  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common13.litellmKeyRevokePermission,
-  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common13.litellmKeyUnblockPermission,
-  litellmPermissions: () => import_backstage_plugin_litellm_common13.litellmPermissions,
+  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common14.litellmAuditReadPermission,
+  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common14.litellmKeyCreatePermission,
+  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common14.litellmKeyManagePermission,
+  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common14.litellmKeyResetSpendPermission,
+  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common14.litellmKeyRevokePermission,
+  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common14.litellmKeyUnblockPermission,
+  litellmPermissions: () => import_backstage_plugin_litellm_common14.litellmPermissions,
   litellmPlugin: () => litellmPlugin,
-  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common13.litellmTeamCreatePermission,
-  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common13.litellmTeamDeletePermission,
-  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamKnowledgebaseManagePermission,
-  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamManagePermission,
-  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamMcpManagePermission,
-  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamMembersManagePermission,
+  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common14.litellmTeamCreatePermission,
+  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common14.litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common14.litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common14.litellmTeamManagePermission,
+  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common14.litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common14.litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
@@ -8889,11 +8889,18 @@ function applyRoleOverrides(defaults, role) {
 }
 function readProvisioningDefaults(config) {
   const enabled = config.getOptionalBoolean("litellm.provisioning.enabled") ?? false;
+  const useGatewayBudgetDefaults = config.getOptionalBoolean(
+    "litellm.provisioning.defaults.useGatewayBudgetDefaults"
+  ) ?? false;
+  const maxBudget = config.getOptionalNumber(
+    "litellm.provisioning.defaults.maxBudget"
+  );
+  const budgetDuration = config.getOptionalString(
+    "litellm.provisioning.defaults.budgetDuration"
+  );
   const defaults = {
-    maxBudget: config.getOptionalNumber("litellm.provisioning.defaults.maxBudget") ?? 10,
-    budgetDuration: config.getOptionalString(
-      "litellm.provisioning.defaults.budgetDuration"
-    ) ?? "30d",
+    maxBudget: maxBudget ?? (useGatewayBudgetDefaults ? void 0 : 10),
+    budgetDuration: budgetDuration ?? (useGatewayBudgetDefaults ? void 0 : "30d"),
     models: config.getOptionalStringArray("litellm.provisioning.defaults.models") ?? [],
     teams: config.getOptionalStringArray("litellm.provisioning.defaults.teams") ?? [],
     tpmLimit: config.getOptionalNumber(
@@ -8958,8 +8965,11 @@ async function provisionUser(client, userId, defaults, profile, backstageEntity,
     user_id: userId,
     ...profile.email && { user_email: profile.email },
     ...profile.displayName && { user_alias: profile.displayName },
-    max_budget: defaults.maxBudget,
-    budget_duration: defaults.budgetDuration,
+    // Undefined = left out, so LiteLLM's internal-user defaults apply.
+    ...defaults.maxBudget !== void 0 && { max_budget: defaults.maxBudget },
+    ...defaults.budgetDuration !== void 0 && {
+      budget_duration: defaults.budgetDuration
+    },
     models: defaults.models,
     teams: defaults.teams,
     ...defaults.tpmLimit !== void 0 && { tpm_limit: defaults.tpmLimit },
@@ -9192,7 +9202,7 @@ function parseKeySnippetTabs(raw) {
 }
 
 // src/router.ts
-var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common12 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/teamAdmin.ts
 var import_plugin_permission_common = __toESM(require_index_cjs2());
@@ -9805,6 +9815,7 @@ var openApiSpec = {
             content: { "application/json": { schema: { type: "object", properties: {
               baseUrl: { type: "string" },
               keyGeneration: { type: "object", properties: {
+                allowedDurations: { type: "array", items: { type: "string" }, description: 'Durations a new key may have (litellm.keys.allowedDurations); "never" means no expiry' },
                 allowUnlimitedBudget: { type: "boolean" },
                 teamRequired: { type: "boolean" }
               } },
@@ -10064,7 +10075,11 @@ function registerConfigRoutes(router, ctx) {
     res.json({
       baseUrl: ctx.publicBaseUrl,
       supportContact: ctx.supportContact,
-      keyGeneration: { allowUnlimitedBudget: ctx.allowUnlimitedBudget, teamRequired: ctx.teamRequired },
+      keyGeneration: {
+        allowUnlimitedBudget: ctx.allowUnlimitedBudget,
+        teamRequired: ctx.teamRequired,
+        allowedDurations: ctx.keyValidationConfig.allowedDurations
+      },
       keyActions: { allowOwnerResetSpend: ctx.allowOwnerResetSpend },
       opencode: { enabled: ctx.opencodeCfg.enabled },
       teamManagement: {
@@ -10139,6 +10154,9 @@ function registerConfigRoutes(router, ctx) {
 }
 
 // src/routes/keys.ts
+var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
+
+// src/services/keyService.ts
 var import_backstage_plugin_litellm_common4 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/services/modelAccess.ts
@@ -10281,8 +10299,14 @@ async function createKeyForUser(user, input, ctx) {
     upstreamRequest.models = input.models;
   }
   const durations = ctx.keyValidationConfig.allowedDurations;
-  const defaultDuration = durations.length === 0 || durations.includes("30d") ? "30d" : durations[0];
-  upstreamRequest.duration = input.duration ?? defaultDuration;
+  const defaultDuration = durations.length === 0 || durations.includes("30d") ? "30d" : durations.find((d) => d !== import_backstage_plugin_litellm_common4.NEVER_KEY_DURATION);
+  const duration = input.duration ?? defaultDuration;
+  if (duration === void 0) {
+    throw new KeyServiceError(400, { error: "duration is required" });
+  }
+  if (duration !== import_backstage_plugin_litellm_common4.NEVER_KEY_DURATION) {
+    upstreamRequest.duration = duration;
+  }
   if (input.max_budget !== void 0) {
     upstreamRequest.max_budget = input.max_budget ?? void 0;
   }
@@ -10328,8 +10352,8 @@ function registerKeysRoutes(router, ctx) {
     assertPermission,
     sendPermissionDenied
   } = ctx;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common4.createGenerateKeyInputSchema)(keyValidationConfig);
-  const updateKeyInputSchema = (0, import_backstage_plugin_litellm_common4.createUpdateKeyInputSchema)(keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common5.createGenerateKeyInputSchema)(keyValidationConfig);
+  const updateKeyInputSchema = (0, import_backstage_plugin_litellm_common5.createUpdateKeyInputSchema)(keyValidationConfig);
   router.get("/user/info", async (_req, res) => {
     try {
       const tokenEntityRef = res.locals.tokenEntityRef;
@@ -10366,8 +10390,8 @@ function registerKeysRoutes(router, ctx) {
   });
   router.post("/keys/prune-expired", async (_req, res) => {
     try {
-      if (!await assertPermission(_req, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission);
+      if (!await assertPermission(_req, import_backstage_plugin_litellm_common5.litellmKeyRevokePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyRevokePermission);
         return;
       }
       await getProvisionedUser(ctx, res);
@@ -10431,8 +10455,8 @@ function registerKeysRoutes(router, ctx) {
         return;
       }
       const input = parseResult.data;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyCreatePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyCreatePermission);
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
@@ -10481,8 +10505,8 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyManagePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyManagePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyManagePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyManagePermission);
         return;
       }
       const { tokenEntityRef, userId, key } = await authorizeKeyAction(req, keyId);
@@ -10559,8 +10583,8 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyRevokePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyRevokePermission);
         return;
       }
       const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
@@ -10574,8 +10598,8 @@ function registerKeysRoutes(router, ctx) {
   router.post("/keys/:keyId/block", async (req, res) => {
     try {
       const { keyId } = req.params;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyManagePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyManagePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyManagePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyManagePermission);
         return;
       }
       const { tokenEntityRef, key } = await authorizeKeyAction(req, keyId);
@@ -10603,8 +10627,8 @@ function registerKeysRoutes(router, ctx) {
     try {
       const { keyId } = req.params;
       const { tokenEntityRef, key } = await authorizeKeyAction(req, keyId);
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyUnblockPermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyUnblockPermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyUnblockPermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyUnblockPermission);
         return;
       }
       await client.unblockKey(keyId);
@@ -10632,8 +10656,8 @@ function registerKeysRoutes(router, ctx) {
         });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyResetSpendPermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyResetSpendPermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyResetSpendPermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyResetSpendPermission);
         return;
       }
       const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
@@ -10665,8 +10689,8 @@ function registerKeysRoutes(router, ctx) {
       res.status(403).json({ error: "Access denied: not a member of the audit group" });
       return;
     }
-    if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmAuditReadPermission)) {
-      sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmAuditReadPermission);
+    if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmAuditReadPermission)) {
+      sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmAuditReadPermission);
       return;
     }
     try {
@@ -10718,7 +10742,7 @@ function registerKeysRoutes(router, ctx) {
 }
 
 // src/routes/opencode.ts
-var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common6 = require("@acarmisc/backstage-plugin-litellm-common");
 function isValidRedirectUri(uri) {
   if (!uri) return false;
   try {
@@ -10760,8 +10784,8 @@ function registerOpencodeRoutes(router, ctx) {
         return null;
       }
       const redirectUri = redirectUriParam;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyCreatePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyCreatePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common6.litellmKeyCreatePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common6.litellmKeyCreatePermission);
         return null;
       }
       const computedUserId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
@@ -10929,7 +10953,7 @@ function registerOpencodeRoutes(router, ctx) {
 }
 
 // src/routes/teams.ts
-var import_backstage_plugin_litellm_common6 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/http/respondTeam.ts
 function respondTeam(res, team, ctx, caller) {
@@ -11024,7 +11048,7 @@ function registerTeamsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common6.litellmTeamCreatePermission,
+      permission: import_backstage_plugin_litellm_common7.litellmTeamCreatePermission,
       logger
     });
     if (!check.ok) {
@@ -11098,7 +11122,7 @@ function registerTeamsRoutes(router, ctx) {
     const authz = await authorizeTeamSubresource(
       req,
       res,
-      import_backstage_plugin_litellm_common6.litellmTeamManagePermission
+      import_backstage_plugin_litellm_common7.litellmTeamManagePermission
     );
     if (!authz) return;
     const { teamId, owningGroup, actor, team: existing } = authz;
@@ -11139,7 +11163,7 @@ function registerTeamsRoutes(router, ctx) {
     const authz = await authorizeTeamSubresource(
       req,
       res,
-      import_backstage_plugin_litellm_common6.litellmTeamDeletePermission
+      import_backstage_plugin_litellm_common7.litellmTeamDeletePermission
     );
     if (!authz) return;
     const { teamId, owningGroup, actor } = authz;
@@ -11180,7 +11204,7 @@ function registerTeamsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common6.litellmTeamManagePermission,
+      permission: import_backstage_plugin_litellm_common7.litellmTeamManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11203,7 +11227,7 @@ function registerTeamsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common6.litellmTeamMembersManagePermission,
+        import_backstage_plugin_litellm_common7.litellmTeamMembersManagePermission,
         { allowTeamRole: true }
       );
       if (!authz) return;
@@ -11308,7 +11332,7 @@ function registerTeamsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common6.litellmTeamMembersManagePermission,
+        import_backstage_plugin_litellm_common7.litellmTeamMembersManagePermission,
         { allowTeamRole: true }
       );
       if (!authz) return;
@@ -11356,7 +11380,7 @@ function registerTeamsRoutes(router, ctx) {
 }
 
 // src/routes/objectPermissions.ts
-var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerObjectPermissionsRoutes(router, ctx) {
   const {
     client,
@@ -11391,7 +11415,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common7.litellmTeamKnowledgebaseManagePermission,
+      permission: import_backstage_plugin_litellm_common8.litellmTeamKnowledgebaseManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11413,7 +11437,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common7.litellmTeamKnowledgebaseManagePermission
+        import_backstage_plugin_litellm_common8.litellmTeamKnowledgebaseManagePermission
       );
       if (!authz) return;
       const { teamId, owningGroup, actor, team } = authz;
@@ -11473,7 +11497,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common7.litellmTeamMcpManagePermission,
+      permission: import_backstage_plugin_litellm_common8.litellmTeamMcpManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11495,7 +11519,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common7.litellmTeamMcpManagePermission
+        import_backstage_plugin_litellm_common8.litellmTeamMcpManagePermission
       );
       if (!authz) return;
       const { teamId, owningGroup, actor, team } = authz;
@@ -11548,7 +11572,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
 }
 
 // src/routes/teamUsage.ts
-var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerTeamUsageRoutes(router, ctx) {
   const {
     client,
@@ -11651,7 +11675,7 @@ function registerTeamUsageRoutes(router, ctx) {
     }
     const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
     const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
-    const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common8.litellmTeamUsageReadPermission);
+    const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common9.litellmTeamUsageReadPermission);
     if (!allowed) {
       res.status(403).json({
         error: "Access denied: viewing per-member usage needs a team role or permission"
@@ -13475,8 +13499,8 @@ async function bridgeListKeys(client, claims, provisioningEnabled, provisioningD
 }
 
 // src/routes/bridge.ts
-var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
 var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
   const {
     client,
@@ -13489,7 +13513,7 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
     keyValidationConfig
   } = ctx;
   const { config } = bridgeOpts;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common10.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common11.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
   const bridgeCfg = readBridgeConfig(config);
   const bridgeIdentity = {
     userIdDomain,
@@ -13650,11 +13674,11 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         }
         const team = await client.getTeamInfo(teamId);
         const allowed = team.models;
-        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common9.ALL_PROXY_MODELS)) {
+        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common10.ALL_PROXY_MODELS)) {
           res.json(models);
           return;
         }
-        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common9.isModelAllowed)(m, allowed)));
+        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common10.isModelAllowed)(m, allowed)));
       } catch (error) {
         handleBridgeError(error, res);
       }
@@ -13720,13 +13744,13 @@ async function createRouter(options) {
   const keyMaxBudget = config.getOptionalNumber("litellm.keys.maxBudget") ?? 100;
   const keyMaxTpm = config.getOptionalNumber("litellm.keys.maxTpm") ?? 1e5;
   const keyMaxRpm = config.getOptionalNumber("litellm.keys.maxRpm") ?? 1e3;
-  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common11.DEFAULT_KEY_DURATIONS;
+  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common12.DEFAULT_KEY_DURATIONS;
   const keyValidationConfig = {
     maxBudget: keyMaxBudget,
     maxTpm: keyMaxTpm,
     maxRpm: keyMaxRpm,
     allowedDurations: keyAllowedDurations,
-    allowedBudgetDurations: config.getOptionalStringArray("litellm.keys.allowedBudgetDurations") ?? import_backstage_plugin_litellm_common11.DEFAULT_KEY_BUDGET_DURATIONS
+    allowedBudgetDurations: config.getOptionalStringArray("litellm.keys.allowedBudgetDurations") ?? import_backstage_plugin_litellm_common12.DEFAULT_KEY_BUDGET_DURATIONS
   };
   const teamMgmtEnabled = isTeamManagementEnabled(config);
   const objectPermsEnabled = isObjectPermissionsEnabled(config);
@@ -13738,7 +13762,7 @@ async function createRouter(options) {
   const catalogClient = options.catalogClient ?? new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
-      `LiteLLM auto-provisioning enabled \u2014 defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length ? provisioningDefaults.models.join(",") : "all"}, teams=[${provisioningDefaults.teams.join(",")}]`
+      `LiteLLM auto-provisioning enabled \u2014 defaults: budget=${provisioningDefaults.maxBudget === void 0 ? "gateway default" : `$${provisioningDefaults.maxBudget}`}/${provisioningDefaults.budgetDuration ?? "gateway default"}, models=${provisioningDefaults.models.length ? provisioningDefaults.models.join(",") : "all"}, teams=[${provisioningDefaults.teams.join(",")}]`
     );
   }
   if (config.getOptional("litellm.teamAdmin") && !teamMgmtEnabled) {
@@ -13941,7 +13965,7 @@ async function createRouter(options) {
 }
 
 // src/plugin.ts
-var import_backstage_plugin_litellm_common12 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common13 = require("@acarmisc/backstage-plugin-litellm-common");
 var BRIDGE_UNAUTHENTICATED_PATHS = [
   "/bridge/health",
   "/bridge/keys",
@@ -13971,7 +13995,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
         permissions,
         permissionsRegistry
       }) {
-        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common12.litellmPermissions);
+        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common13.litellmPermissions);
         const router = await createRouter({
           config,
           logger,
@@ -13991,7 +14015,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
 });
 
 // src/index.ts
-var import_backstage_plugin_litellm_common13 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common14 = require("@acarmisc/backstage-plugin-litellm-common");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   KeycloakJWTVerifier,