@acarmisc/backstage-plugin-litellm-common 0.1.0

package/dist/budgets.d.ts

@@ -0,0 +1,16 @@
+/** Budget warning threshold (percent of cap). */
+export declare const BUDGET_WARNING_PCT = 80;
+/** Budget danger threshold (percent of cap, at or over cap). */
+export declare const BUDGET_DANGER_PCT = 100;
+/** Consumption status derived from spend vs. cap. */
+export type BudgetStatus = 'ok' | 'near' | 'over';
+/**
+ * Compute budget status from spend percentage of cap.
+ * Thresholds: near >= 80%, over >= 100%.
+ */
+export declare function budgetStatusForPct(pct: number): BudgetStatus;
+/**
+ * Format a duration string to a human-readable label.
+ * E.g., "1d" → "1 Day", "7d" → "7 Days".
+ */
+export declare function formatDurationLabel(duration: string): string;

package/dist/budgets.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUDGET_DANGER_PCT = exports.BUDGET_WARNING_PCT = void 0;
+exports.budgetStatusForPct = budgetStatusForPct;
+exports.formatDurationLabel = formatDurationLabel;
+/** Budget warning threshold (percent of cap). */
+exports.BUDGET_WARNING_PCT = 80;
+/** Budget danger threshold (percent of cap, at or over cap). */
+exports.BUDGET_DANGER_PCT = 100;
+/**
+ * Compute budget status from spend percentage of cap.
+ * Thresholds: near >= 80%, over >= 100%.
+ */
+function budgetStatusForPct(pct) {
+    if (pct >= exports.BUDGET_DANGER_PCT)
+        return 'over';
+    if (pct >= exports.BUDGET_WARNING_PCT)
+        return 'near';
+    return 'ok';
+}
+/**
+ * Format a duration string to a human-readable label.
+ * E.g., "1d" → "1 Day", "7d" → "7 Days".
+ */
+function formatDurationLabel(duration) {
+    const match = /^(\d+)([smhdwy])$/.exec(duration);
+    if (!match)
+        return duration;
+    const [, num, unit] = match;
+    const n = Number(num);
+    const unitLabels = {
+        s: 'Second',
+        m: 'Minute',
+        h: 'Hour',
+        d: 'Day',
+        w: 'Week',
+        y: 'Year',
+    };
+    const label = unitLabels[unit] || unit;
+    return n === 1 ? `1 ${label}` : `${n} ${label}s`;
+}

package/dist/index.cjs.js

@@ -0,0 +1,219 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ALL_PROXY_MODELS: () => ALL_PROXY_MODELS,
+  BUDGET_DANGER_PCT: () => BUDGET_DANGER_PCT,
+  BUDGET_WARNING_PCT: () => BUDGET_WARNING_PCT,
+  DEFAULT_KEY_DURATIONS: () => DEFAULT_KEY_DURATIONS,
+  RESERVED_METADATA_KEYS: () => RESERVED_METADATA_KEYS,
+  budgetStatusForPct: () => budgetStatusForPct,
+  createGenerateKeyInputSchema: () => createGenerateKeyInputSchema,
+  createUpdateKeyInputSchema: () => createUpdateKeyInputSchema,
+  formatDurationLabel: () => formatDurationLabel,
+  isModelAllowed: () => isModelAllowed,
+  litellmAuditReadPermission: () => litellmAuditReadPermission,
+  litellmKeyCreatePermission: () => litellmKeyCreatePermission,
+  litellmKeyManagePermission: () => litellmKeyManagePermission,
+  litellmKeyResetSpendPermission: () => litellmKeyResetSpendPermission,
+  litellmKeyRevokePermission: () => litellmKeyRevokePermission,
+  litellmKeyUnblockPermission: () => litellmKeyUnblockPermission,
+  litellmPermissions: () => litellmPermissions,
+  litellmTeamCreatePermission: () => litellmTeamCreatePermission,
+  litellmTeamDeletePermission: () => litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission: () => litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission: () => litellmTeamManagePermission,
+  litellmTeamMcpManagePermission: () => litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission: () => litellmTeamMembersManagePermission,
+  reservedMetadataKeys: () => reservedMetadataKeys
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/permissions.ts
+var import_plugin_permission_common = require("@backstage/plugin-permission-common");
+var litellmKeyCreatePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.key.create",
+  attributes: { action: "create" }
+});
+var litellmKeyRevokePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.key.revoke",
+  attributes: { action: "delete" }
+});
+var litellmKeyManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.key.manage",
+  attributes: { action: "update" }
+});
+var litellmKeyResetSpendPermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.key.resetSpend",
+  attributes: { action: "update" }
+});
+var litellmKeyUnblockPermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.key.unblock",
+  attributes: { action: "update" }
+});
+var litellmAuditReadPermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.audit.read",
+  attributes: { action: "read" }
+});
+var litellmTeamCreatePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.create",
+  attributes: { action: "create" }
+});
+var litellmTeamManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.manage",
+  attributes: { action: "update" }
+});
+var litellmTeamMembersManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.members.manage",
+  attributes: { action: "update" }
+});
+var litellmTeamKnowledgebaseManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.knowledgebase.manage",
+  attributes: { action: "update" }
+});
+var litellmTeamMcpManagePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.mcp.manage",
+  attributes: { action: "update" }
+});
+var litellmTeamDeletePermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.delete",
+  attributes: { action: "delete" }
+});
+var litellmPermissions = [
+  litellmKeyCreatePermission,
+  litellmKeyRevokePermission,
+  litellmKeyManagePermission,
+  litellmKeyResetSpendPermission,
+  litellmKeyUnblockPermission,
+  litellmAuditReadPermission,
+  litellmTeamCreatePermission,
+  litellmTeamManagePermission,
+  litellmTeamMembersManagePermission,
+  litellmTeamKnowledgebaseManagePermission,
+  litellmTeamMcpManagePermission,
+  litellmTeamDeletePermission
+];
+
+// src/keySchemas.ts
+var import_zod = require("zod");
+var RESERVED_METADATA_KEYS = ["blocked_by", "blocked_at"];
+var RESERVED_METADATA_PREFIXES = ["created_", "updated_"];
+function reservedMetadataKeys(metadata) {
+  return Object.keys(metadata).filter(
+    (k) => RESERVED_METADATA_KEYS.includes(k) || RESERVED_METADATA_PREFIXES.some((p) => k.startsWith(p))
+  );
+}
+function createGenerateKeyInputSchema(config) {
+  const durationSchema = config.allowedDurations.length > 0 ? import_zod.z.string().refine(
+    (val) => config.allowedDurations.includes(val),
+    {
+      message: `duration must be one of: ${config.allowedDurations.join(", ")}`
+    }
+  ) : import_zod.z.string().regex(/^\d+[smhdwy]$/, {
+    message: 'duration must match format <number><unit> (e.g. "30d", "1h")'
+  });
+  return import_zod.z.object({
+    alias: import_zod.z.string().trim().min(1, "alias is required").max(128, "alias must be at most 128 characters"),
+    models: import_zod.z.array(import_zod.z.string()).max(100, "models array is too large").optional(),
+    duration: durationSchema.optional(),
+    max_budget: import_zod.z.number().positive("max_budget must be a positive number").max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`).nullable().optional(),
+    tpm_limit: import_zod.z.number().int("tpm_limit must be an integer").positive("tpm_limit must be a positive number").max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`).optional(),
+    rpm_limit: import_zod.z.number().int("rpm_limit must be an integer").positive("rpm_limit must be a positive number").max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`).optional(),
+    team_id: import_zod.z.string().optional(),
+    // The UI always sends 'llm_api'; no other key type may be requested.
+    key_type: import_zod.z.literal("llm_api").optional(),
+    metadata: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).refine((m) => reservedMetadataKeys(m).length === 0, {
+      message: "metadata may not set server-owned keys (blocked_by, blocked_at, created_*, updated_*)"
+    }).optional()
+  }).strict();
+}
+function createUpdateKeyInputSchema(config) {
+  return import_zod.z.object({
+    key_alias: import_zod.z.string().trim().min(1, "key_alias is required").max(128, "key_alias must be at most 128 characters").optional(),
+    models: import_zod.z.array(import_zod.z.string()).max(100, "models array is too large").optional(),
+    max_budget: import_zod.z.number().positive("max_budget must be a positive number").max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`).nullable().optional(),
+    tpm_limit: import_zod.z.number().int("tpm_limit must be an integer").positive("tpm_limit must be a positive number").max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`).optional(),
+    rpm_limit: import_zod.z.number().int("rpm_limit must be an integer").positive("rpm_limit must be a positive number").max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`).optional()
+  }).strict();
+}
+var DEFAULT_KEY_DURATIONS = ["1d", "7d", "30d", "90d"];
+
+// src/budgets.ts
+var BUDGET_WARNING_PCT = 80;
+var BUDGET_DANGER_PCT = 100;
+function budgetStatusForPct(pct) {
+  if (pct >= BUDGET_DANGER_PCT) return "over";
+  if (pct >= BUDGET_WARNING_PCT) return "near";
+  return "ok";
+}
+function formatDurationLabel(duration) {
+  const match = /^(\d+)([smhdwy])$/.exec(duration);
+  if (!match) return duration;
+  const [, num, unit] = match;
+  const n = Number(num);
+  const unitLabels = {
+    s: "Second",
+    m: "Minute",
+    h: "Hour",
+    d: "Day",
+    w: "Week",
+    y: "Year"
+  };
+  const label = unitLabels[unit] || unit;
+  return n === 1 ? `1 ${label}` : `${n} ${label}s`;
+}
+
+// src/modelAccess.ts
+var ALL_PROXY_MODELS = "all-proxy-models";
+function isModelAllowed(model, allowed) {
+  if (!allowed || allowed.length === 0) return true;
+  if (allowed.includes(ALL_PROXY_MODELS)) return true;
+  if (allowed.includes(model.model_name)) return true;
+  return !!model.access_groups?.some((group) => allowed.includes(group));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ALL_PROXY_MODELS,
+  BUDGET_DANGER_PCT,
+  BUDGET_WARNING_PCT,
+  DEFAULT_KEY_DURATIONS,
+  RESERVED_METADATA_KEYS,
+  budgetStatusForPct,
+  createGenerateKeyInputSchema,
+  createUpdateKeyInputSchema,
+  formatDurationLabel,
+  isModelAllowed,
+  litellmAuditReadPermission,
+  litellmKeyCreatePermission,
+  litellmKeyManagePermission,
+  litellmKeyResetSpendPermission,
+  litellmKeyRevokePermission,
+  litellmKeyUnblockPermission,
+  litellmPermissions,
+  litellmTeamCreatePermission,
+  litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission,
+  litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission,
+  reservedMetadataKeys
+});
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts", "../src/permissions.ts", "../src/keySchemas.ts", "../src/budgets.ts", "../src/modelAccess.ts"],
+  "sourcesContent": ["export * from './permissions';\nexport * from './keySchemas';\nexport * from './types';\nexport * from './budgets';\nexport * from './modelAccess';\n", "import { createPermission } from '@backstage/plugin-permission-common';\n\nexport const litellmKeyCreatePermission = createPermission({\n  name: 'litellm.key.create',\n  attributes: { action: 'create' },\n});\n\nexport const litellmKeyRevokePermission = createPermission({\n  name: 'litellm.key.revoke',\n  attributes: { action: 'delete' },\n});\n\nexport const litellmKeyManagePermission = createPermission({\n  name: 'litellm.key.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmKeyResetSpendPermission = createPermission({\n  name: 'litellm.key.resetSpend',\n  attributes: { action: 'update' },\n});\n\nexport const litellmKeyUnblockPermission = createPermission({\n  name: 'litellm.key.unblock',\n  attributes: { action: 'update' },\n});\n\nexport const litellmAuditReadPermission = createPermission({\n  name: 'litellm.audit.read',\n  attributes: { action: 'read' },\n});\n\n// Team-management permissions \u2014 delegated to litellm-team-admins group\nexport const litellmTeamCreatePermission = createPermission({\n  name: 'litellm.team.create',\n  attributes: { action: 'create' },\n});\n\nexport const litellmTeamManagePermission = createPermission({\n  name: 'litellm.team.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamMembersManagePermission = createPermission({\n  name: 'litellm.team.members.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamKnowledgebaseManagePermission = createPermission({\n  name: 'litellm.team.knowledgebase.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamMcpManagePermission = createPermission({\n  name: 'litellm.team.mcp.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamDeletePermission = createPermission({\n  name: 'litellm.team.delete',\n  attributes: { action: 'delete' },\n});\n\nexport const litellmPermissions = [\n  litellmKeyCreatePermission,\n  litellmKeyRevokePermission,\n  litellmKeyManagePermission,\n  litellmKeyResetSpendPermission,\n  litellmKeyUnblockPermission,\n  litellmAuditReadPermission,\n  litellmTeamCreatePermission,\n  litellmTeamManagePermission,\n  litellmTeamMembersManagePermission,\n  litellmTeamKnowledgebaseManagePermission,\n  litellmTeamMcpManagePermission,\n  litellmTeamDeletePermission,\n];\n", "import { z } from 'zod';\n\n/**\n * Configuration for key validation ceilings and allowed values.\n */\n/**\n * Metadata keys the server owns. Clients must not set them: `blocked_by` /\n * `blocked_at` decide who may unblock a key, and `created_*` / `updated_*`\n * record provenance.\n */\nexport const RESERVED_METADATA_KEYS = ['blocked_by', 'blocked_at'] as const;\nconst RESERVED_METADATA_PREFIXES = ['created_', 'updated_'] as const;\n\nexport function reservedMetadataKeys(metadata: Record<string, unknown>): string[] {\n  return Object.keys(metadata).filter(\n    k =>\n      (RESERVED_METADATA_KEYS as readonly string[]).includes(k) ||\n      RESERVED_METADATA_PREFIXES.some(p => k.startsWith(p)),\n  );\n}\n\nexport interface KeyValidationConfig {\n  maxBudget: number;\n  maxTpm: number;\n  maxRpm: number;\n  allowedDurations: string[];\n}\n\n/**\n * Creates a strict Zod schema for GenerateKeyInput validation.\n * Rejects unknown fields and enforces server-side ceilings.\n *\n * @param config Server configuration with ceiling values and allowed durations\n * @returns A Zod object schema that validates the input\n */\nexport function createGenerateKeyInputSchema(config: KeyValidationConfig) {\n  // When allowedDurations is set, restrict to that list.\n  // Otherwise, allow any string matching the duration format regex.\n  const durationSchema = config.allowedDurations.length > 0\n    ? z.string().refine(\n        (val) => config.allowedDurations.includes(val),\n        {\n          message: `duration must be one of: ${config.allowedDurations.join(', ')}`,\n        },\n      )\n    : z.string().regex(/^\\d+[smhdwy]$/, {\n        message: 'duration must match format <number><unit> (e.g. \"30d\", \"1h\")',\n      });\n\n  return z\n    .object({\n      alias: z\n        .string()\n        .trim()\n        .min(1, 'alias is required')\n        .max(128, 'alias must be at most 128 characters'),\n      models: z\n        .array(z.string())\n        .max(100, 'models array is too large')\n        .optional(),\n      duration: durationSchema.optional(),\n      max_budget: z\n        .number()\n        .positive('max_budget must be a positive number')\n        .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)\n        .nullable()\n        .optional(),\n      tpm_limit: z\n        .number()\n        .int('tpm_limit must be an integer')\n        .positive('tpm_limit must be a positive number')\n        .max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`)\n        .optional(),\n      rpm_limit: z\n        .number()\n        .int('rpm_limit must be an integer')\n        .positive('rpm_limit must be a positive number')\n        .max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`)\n        .optional(),\n      team_id: z.string().optional(),\n      // The UI always sends 'llm_api'; no other key type may be requested.\n      key_type: z.literal('llm_api').optional(),\n      metadata: z\n        .record(z.string(), z.string())\n        .refine(m => reservedMetadataKeys(m).length === 0, {\n          message:\n            'metadata may not set server-owned keys (blocked_by, blocked_at, created_*, updated_*)',\n        })\n        .optional(),\n    })\n    .strict();\n}\n\nexport type GenerateKeyInput = z.infer<\n  ReturnType<typeof createGenerateKeyInputSchema>\n>;\n\n/**\n * Creates a strict Zod schema for UpdateKeyInput validation.\n * Only allows key_alias, models, max_budget, tpm_limit, and rpm_limit fields.\n * Rejects all other fields including team_id, user_id, spend, blocked, key, and budget_duration.\n *\n * @param config Server configuration with ceiling values\n * @returns A Zod object schema that validates the input\n */\nexport function createUpdateKeyInputSchema(config: KeyValidationConfig) {\n  return z\n    .object({\n      key_alias: z\n        .string()\n        .trim()\n        .min(1, 'key_alias is required')\n        .max(128, 'key_alias must be at most 128 characters')\n        .optional(),\n      models: z\n        .array(z.string())\n        .max(100, 'models array is too large')\n        .optional(),\n      max_budget: z\n        .number()\n        .positive('max_budget must be a positive number')\n        .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)\n        .nullable()\n        .optional(),\n      tpm_limit: z\n        .number()\n        .int('tpm_limit must be an integer')\n        .positive('tpm_limit must be a positive number')\n        .max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`)\n        .optional(),\n      rpm_limit: z\n        .number()\n        .int('rpm_limit must be an integer')\n        .positive('rpm_limit must be a positive number')\n        .max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`)\n        .optional(),\n    })\n    .strict();\n}\n\nexport type UpdateKeyInput = z.infer<\n  ReturnType<typeof createUpdateKeyInputSchema>\n>;\n\n/**\n * Default key duration presets. Used as server-side defaults and UI options.\n */\nexport const DEFAULT_KEY_DURATIONS = ['1d', '7d', '30d', '90d'];\n", "/** Budget warning threshold (percent of cap). */\nexport const BUDGET_WARNING_PCT = 80;\n\n/** Budget danger threshold (percent of cap, at or over cap). */\nexport const BUDGET_DANGER_PCT = 100;\n\n/** Consumption status derived from spend vs. cap. */\nexport type BudgetStatus = 'ok' | 'near' | 'over';\n\n/**\n * Compute budget status from spend percentage of cap.\n * Thresholds: near >= 80%, over >= 100%.\n */\nexport function budgetStatusForPct(pct: number): BudgetStatus {\n  if (pct >= BUDGET_DANGER_PCT) return 'over';\n  if (pct >= BUDGET_WARNING_PCT) return 'near';\n  return 'ok';\n}\n\n/**\n * Format a duration string to a human-readable label.\n * E.g., \"1d\" \u2192 \"1 Day\", \"7d\" \u2192 \"7 Days\".\n */\nexport function formatDurationLabel(duration: string): string {\n  const match = /^(\\d+)([smhdwy])$/.exec(duration);\n  if (!match) return duration;\n\n  const [, num, unit] = match;\n  const n = Number(num);\n\n  const unitLabels: Record<string, string> = {\n    s: 'Second',\n    m: 'Minute',\n    h: 'Hour',\n    d: 'Day',\n    w: 'Week',\n    y: 'Year',\n  };\n\n  const label = unitLabels[unit] || unit;\n  return n === 1 ? `1 ${label}` : `${n} ${label}s`;\n}\n", "/**\n * LiteLLM sentinel: a team's (or user's) `models` list is `[\"all-proxy-models\"]`\n * when it isn't restricted to specific models.\n */\nexport const ALL_PROXY_MODELS = 'all-proxy-models';\n\n/**\n * Whether a model is allowed by an allow-list. The list is unrestricted when it\n * is empty/missing or contains the `all-proxy-models` sentinel. Entries may be\n * literal model names OR access-group names (litellm model_info.access_groups),\n * so a model also passes when one of its access groups is listed.\n */\nexport function isModelAllowed(\n  model: { model_name: string; access_groups?: string[] },\n  allowed?: string[],\n): boolean {\n  if (!allowed || allowed.length === 0) return true;\n  if (allowed.includes(ALL_PROXY_MODELS)) return true;\n  if (allowed.includes(model.model_name)) return true;\n  return !!model.access_groups?.some(group => allowed.includes(group));\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,sCAAiC;AAE1B,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,qCAAiC,kDAAiB;AAAA,EAC7D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,OAAO;AAC/B,CAAC;AAGM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,yCAAqC,kDAAiB;AAAA,EACjE,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,+CAA2C,kDAAiB;AAAA,EACvE,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,qCAAiC,kDAAiB;AAAA,EAC7D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AC5EA,iBAAkB;AAUX,IAAM,yBAAyB,CAAC,cAAc,YAAY;AACjE,IAAM,6BAA6B,CAAC,YAAY,UAAU;AAEnD,SAAS,qBAAqB,UAA6C;AAChF,SAAO,OAAO,KAAK,QAAQ,EAAE;AAAA,IAC3B,OACG,uBAA6C,SAAS,CAAC,KACxD,2BAA2B,KAAK,OAAK,EAAE,WAAW,CAAC,CAAC;AAAA,EACxD;AACF;AAgBO,SAAS,6BAA6B,QAA6B;AAGxE,QAAM,iBAAiB,OAAO,iBAAiB,SAAS,IACpD,aAAE,OAAO,EAAE;AAAA,IACT,CAAC,QAAQ,OAAO,iBAAiB,SAAS,GAAG;AAAA,IAC7C;AAAA,MACE,SAAS,4BAA4B,OAAO,iBAAiB,KAAK,IAAI,CAAC;AAAA,IACzE;AAAA,EACF,IACA,aAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,IAChC,SAAS;AAAA,EACX,CAAC;AAEL,SAAO,aACJ,OAAO;AAAA,IACN,OAAO,aACJ,OAAO,EACP,KAAK,EACL,IAAI,GAAG,mBAAmB,EAC1B,IAAI,KAAK,sCAAsC;AAAA,IAClD,QAAQ,aACL,MAAM,aAAE,OAAO,CAAC,EAChB,IAAI,KAAK,2BAA2B,EACpC,SAAS;AAAA,IACZ,UAAU,eAAe,SAAS;AAAA,IAClC,YAAY,aACT,OAAO,EACP,SAAS,sCAAsC,EAC/C,IAAI,OAAO,WAAW,8BAA8B,OAAO,SAAS,EAAE,EACtE,SAAS,EACT,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAE7B,UAAU,aAAE,QAAQ,SAAS,EAAE,SAAS;AAAA,IACxC,UAAU,aACP,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAC7B,OAAO,OAAK,qBAAqB,CAAC,EAAE,WAAW,GAAG;AAAA,MACjD,SACE;AAAA,IACJ,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,OAAO;AACZ;AAcO,SAAS,2BAA2B,QAA6B;AACtE,SAAO,aACJ,OAAO;AAAA,IACN,WAAW,aACR,OAAO,EACP,KAAK,EACL,IAAI,GAAG,uBAAuB,EAC9B,IAAI,KAAK,0CAA0C,EACnD,SAAS;AAAA,IACZ,QAAQ,aACL,MAAM,aAAE,OAAO,CAAC,EAChB,IAAI,KAAK,2BAA2B,EACpC,SAAS;AAAA,IACZ,YAAY,aACT,OAAO,EACP,SAAS,sCAAsC,EAC/C,IAAI,OAAO,WAAW,8BAA8B,OAAO,SAAS,EAAE,EACtE,SAAS,EACT,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,EACd,CAAC,EACA,OAAO;AACZ;AASO,IAAM,wBAAwB,CAAC,MAAM,MAAM,OAAO,KAAK;;;AClJvD,IAAM,qBAAqB;AAG3B,IAAM,oBAAoB;AAS1B,SAAS,mBAAmB,KAA2B;AAC5D,MAAI,OAAO,kBAAmB,QAAO;AACrC,MAAI,OAAO,mBAAoB,QAAO;AACtC,SAAO;AACT;AAMO,SAAS,oBAAoB,UAA0B;AAC5D,QAAM,QAAQ,oBAAoB,KAAK,QAAQ;AAC/C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,KAAK,IAAI,IAAI;AACtB,QAAM,IAAI,OAAO,GAAG;AAEpB,QAAM,aAAqC;AAAA,IACzC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,QAAM,QAAQ,WAAW,IAAI,KAAK;AAClC,SAAO,MAAM,IAAI,KAAK,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK;AAC/C;;;ACrCO,IAAM,mBAAmB;AAQzB,SAAS,eACd,OACA,SACS;AACT,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAC7C,MAAI,QAAQ,SAAS,gBAAgB,EAAG,QAAO;AAC/C,MAAI,QAAQ,SAAS,MAAM,UAAU,EAAG,QAAO;AAC/C,SAAO,CAAC,CAAC,MAAM,eAAe,KAAK,WAAS,QAAQ,SAAS,KAAK,CAAC;AACrE;",
+  "names": []
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './permissions';
+export * from './keySchemas';
+export * from './types';
+export * from './budgets';
+export * from './modelAccess';

package/dist/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./permissions"), exports);
+__exportStar(require("./keySchemas"), exports);
+__exportStar(require("./types"), exports);
+__exportStar(require("./budgets"), exports);
+__exportStar(require("./modelAccess"), exports);

package/dist/keySchemas.d.ts

@@ -0,0 +1,88 @@
+import { z } from 'zod';
+/**
+ * Configuration for key validation ceilings and allowed values.
+ */
+/**
+ * Metadata keys the server owns. Clients must not set them: `blocked_by` /
+ * `blocked_at` decide who may unblock a key, and `created_*` / `updated_*`
+ * record provenance.
+ */
+export declare const RESERVED_METADATA_KEYS: readonly ["blocked_by", "blocked_at"];
+export declare function reservedMetadataKeys(metadata: Record<string, unknown>): string[];
+export interface KeyValidationConfig {
+    maxBudget: number;
+    maxTpm: number;
+    maxRpm: number;
+    allowedDurations: string[];
+}
+/**
+ * Creates a strict Zod schema for GenerateKeyInput validation.
+ * Rejects unknown fields and enforces server-side ceilings.
+ *
+ * @param config Server configuration with ceiling values and allowed durations
+ * @returns A Zod object schema that validates the input
+ */
+export declare function createGenerateKeyInputSchema(config: KeyValidationConfig): z.ZodObject<{
+    alias: z.ZodString;
+    models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    duration: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>> | z.ZodOptional<z.ZodString>;
+    max_budget: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    tpm_limit: z.ZodOptional<z.ZodNumber>;
+    rpm_limit: z.ZodOptional<z.ZodNumber>;
+    team_id: z.ZodOptional<z.ZodString>;
+    key_type: z.ZodOptional<z.ZodLiteral<"llm_api">>;
+    metadata: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>>;
+}, "strict", z.ZodTypeAny, {
+    alias: string;
+    models?: string[] | undefined;
+    duration?: string | undefined;
+    max_budget?: number | null | undefined;
+    tpm_limit?: number | undefined;
+    rpm_limit?: number | undefined;
+    team_id?: string | undefined;
+    key_type?: "llm_api" | undefined;
+    metadata?: Record<string, string> | undefined;
+}, {
+    alias: string;
+    models?: string[] | undefined;
+    duration?: string | undefined;
+    max_budget?: number | null | undefined;
+    tpm_limit?: number | undefined;
+    rpm_limit?: number | undefined;
+    team_id?: string | undefined;
+    key_type?: "llm_api" | undefined;
+    metadata?: Record<string, string> | undefined;
+}>;
+export type GenerateKeyInput = z.infer<ReturnType<typeof createGenerateKeyInputSchema>>;
+/**
+ * Creates a strict Zod schema for UpdateKeyInput validation.
+ * Only allows key_alias, models, max_budget, tpm_limit, and rpm_limit fields.
+ * Rejects all other fields including team_id, user_id, spend, blocked, key, and budget_duration.
+ *
+ * @param config Server configuration with ceiling values
+ * @returns A Zod object schema that validates the input
+ */
+export declare function createUpdateKeyInputSchema(config: KeyValidationConfig): z.ZodObject<{
+    key_alias: z.ZodOptional<z.ZodString>;
+    models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    max_budget: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    tpm_limit: z.ZodOptional<z.ZodNumber>;
+    rpm_limit: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    models?: string[] | undefined;
+    max_budget?: number | null | undefined;
+    tpm_limit?: number | undefined;
+    rpm_limit?: number | undefined;
+    key_alias?: string | undefined;
+}, {
+    models?: string[] | undefined;
+    max_budget?: number | null | undefined;
+    tpm_limit?: number | undefined;
+    rpm_limit?: number | undefined;
+    key_alias?: string | undefined;
+}>;
+export type UpdateKeyInput = z.infer<ReturnType<typeof createUpdateKeyInputSchema>>;
+/**
+ * Default key duration presets. Used as server-side defaults and UI options.
+ */
+export declare const DEFAULT_KEY_DURATIONS: string[];

package/dist/keySchemas.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_KEY_DURATIONS = exports.RESERVED_METADATA_KEYS = void 0;
+exports.reservedMetadataKeys = reservedMetadataKeys;
+exports.createGenerateKeyInputSchema = createGenerateKeyInputSchema;
+exports.createUpdateKeyInputSchema = createUpdateKeyInputSchema;
+const zod_1 = require("zod");
+/**
+ * Configuration for key validation ceilings and allowed values.
+ */
+/**
+ * Metadata keys the server owns. Clients must not set them: `blocked_by` /
+ * `blocked_at` decide who may unblock a key, and `created_*` / `updated_*`
+ * record provenance.
+ */
+exports.RESERVED_METADATA_KEYS = ['blocked_by', 'blocked_at'];
+const RESERVED_METADATA_PREFIXES = ['created_', 'updated_'];
+function reservedMetadataKeys(metadata) {
+    return Object.keys(metadata).filter(k => exports.RESERVED_METADATA_KEYS.includes(k) ||
+        RESERVED_METADATA_PREFIXES.some(p => k.startsWith(p)));
+}
+/**
+ * Creates a strict Zod schema for GenerateKeyInput validation.
+ * Rejects unknown fields and enforces server-side ceilings.
+ *
+ * @param config Server configuration with ceiling values and allowed durations
+ * @returns A Zod object schema that validates the input
+ */
+function createGenerateKeyInputSchema(config) {
+    // When allowedDurations is set, restrict to that list.
+    // Otherwise, allow any string matching the duration format regex.
+    const durationSchema = config.allowedDurations.length > 0
+        ? zod_1.z.string().refine((val) => config.allowedDurations.includes(val), {
+            message: `duration must be one of: ${config.allowedDurations.join(', ')}`,
+        })
+        : zod_1.z.string().regex(/^\d+[smhdwy]$/, {
+            message: 'duration must match format <number><unit> (e.g. "30d", "1h")',
+        });
+    return zod_1.z
+        .object({
+        alias: zod_1.z
+            .string()
+            .trim()
+            .min(1, 'alias is required')
+            .max(128, 'alias must be at most 128 characters'),
+        models: zod_1.z
+            .array(zod_1.z.string())
+            .max(100, 'models array is too large')
+            .optional(),
+        duration: durationSchema.optional(),
+        max_budget: zod_1.z
+            .number()
+            .positive('max_budget must be a positive number')
+            .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)
+            .nullable()
+            .optional(),
+        tpm_limit: zod_1.z
+            .number()
+            .int('tpm_limit must be an integer')
+            .positive('tpm_limit must be a positive number')
+            .max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`)
+            .optional(),
+        rpm_limit: zod_1.z
+            .number()
+            .int('rpm_limit must be an integer')
+            .positive('rpm_limit must be a positive number')
+            .max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`)
+            .optional(),
+        team_id: zod_1.z.string().optional(),
+        // The UI always sends 'llm_api'; no other key type may be requested.
+        key_type: zod_1.z.literal('llm_api').optional(),
+        metadata: zod_1.z
+            .record(zod_1.z.string(), zod_1.z.string())
+            .refine(m => reservedMetadataKeys(m).length === 0, {
+            message: 'metadata may not set server-owned keys (blocked_by, blocked_at, created_*, updated_*)',
+        })
+            .optional(),
+    })
+        .strict();
+}
+/**
+ * Creates a strict Zod schema for UpdateKeyInput validation.
+ * Only allows key_alias, models, max_budget, tpm_limit, and rpm_limit fields.
+ * Rejects all other fields including team_id, user_id, spend, blocked, key, and budget_duration.
+ *
+ * @param config Server configuration with ceiling values
+ * @returns A Zod object schema that validates the input
+ */
+function createUpdateKeyInputSchema(config) {
+    return zod_1.z
+        .object({
+        key_alias: zod_1.z
+            .string()
+            .trim()
+            .min(1, 'key_alias is required')
+            .max(128, 'key_alias must be at most 128 characters')
+            .optional(),
+        models: zod_1.z
+            .array(zod_1.z.string())
+            .max(100, 'models array is too large')
+            .optional(),
+        max_budget: zod_1.z
+            .number()
+            .positive('max_budget must be a positive number')
+            .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)
+            .nullable()
+            .optional(),
+        tpm_limit: zod_1.z
+            .number()
+            .int('tpm_limit must be an integer')
+            .positive('tpm_limit must be a positive number')
+            .max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`)
+            .optional(),
+        rpm_limit: zod_1.z
+            .number()
+            .int('rpm_limit must be an integer')
+            .positive('rpm_limit must be a positive number')
+            .max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`)
+            .optional(),
+    })
+        .strict();
+}
+/**
+ * Default key duration presets. Used as server-side defaults and UI options.
+ */
+exports.DEFAULT_KEY_DURATIONS = ['1d', '7d', '30d', '90d'];

package/dist/modelAccess.d.ts

@@ -0,0 +1,15 @@
+/**
+ * LiteLLM sentinel: a team's (or user's) `models` list is `["all-proxy-models"]`
+ * when it isn't restricted to specific models.
+ */
+export declare const ALL_PROXY_MODELS = "all-proxy-models";
+/**
+ * Whether a model is allowed by an allow-list. The list is unrestricted when it
+ * is empty/missing or contains the `all-proxy-models` sentinel. Entries may be
+ * literal model names OR access-group names (litellm model_info.access_groups),
+ * so a model also passes when one of its access groups is listed.
+ */
+export declare function isModelAllowed(model: {
+    model_name: string;
+    access_groups?: string[];
+}, allowed?: string[]): boolean;

package/dist/modelAccess.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_PROXY_MODELS = void 0;
+exports.isModelAllowed = isModelAllowed;
+/**
+ * LiteLLM sentinel: a team's (or user's) `models` list is `["all-proxy-models"]`
+ * when it isn't restricted to specific models.
+ */
+exports.ALL_PROXY_MODELS = 'all-proxy-models';
+/**
+ * Whether a model is allowed by an allow-list. The list is unrestricted when it
+ * is empty/missing or contains the `all-proxy-models` sentinel. Entries may be
+ * literal model names OR access-group names (litellm model_info.access_groups),
+ * so a model also passes when one of its access groups is listed.
+ */
+function isModelAllowed(model, allowed) {
+    if (!allowed || allowed.length === 0)
+        return true;
+    if (allowed.includes(exports.ALL_PROXY_MODELS))
+        return true;
+    if (allowed.includes(model.model_name))
+        return true;
+    return !!model.access_groups?.some(group => allowed.includes(group));
+}

package/dist/permissions.d.ts

@@ -0,0 +1,13 @@
+export declare const litellmKeyCreatePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmKeyRevokePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmKeyManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmKeyResetSpendPermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmKeyUnblockPermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmAuditReadPermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamCreatePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamMembersManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamKnowledgebaseManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamMcpManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamDeletePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmPermissions: import("@backstage/plugin-permission-common").BasicPermission[];

package/dist/permissions.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.litellmPermissions = exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyUnblockPermission = exports.litellmKeyResetSpendPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = void 0;
+const plugin_permission_common_1 = require("@backstage/plugin-permission-common");
+exports.litellmKeyCreatePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.key.create',
+    attributes: { action: 'create' },
+});
+exports.litellmKeyRevokePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.key.revoke',
+    attributes: { action: 'delete' },
+});
+exports.litellmKeyManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.key.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmKeyResetSpendPermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.key.resetSpend',
+    attributes: { action: 'update' },
+});
+exports.litellmKeyUnblockPermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.key.unblock',
+    attributes: { action: 'update' },
+});
+exports.litellmAuditReadPermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.audit.read',
+    attributes: { action: 'read' },
+});
+// Team-management permissions — delegated to litellm-team-admins group
+exports.litellmTeamCreatePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.create',
+    attributes: { action: 'create' },
+});
+exports.litellmTeamManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmTeamMembersManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.members.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmTeamKnowledgebaseManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.knowledgebase.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmTeamMcpManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.mcp.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmTeamDeletePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.delete',
+    attributes: { action: 'delete' },
+});
+exports.litellmPermissions = [
+    exports.litellmKeyCreatePermission,
+    exports.litellmKeyRevokePermission,
+    exports.litellmKeyManagePermission,
+    exports.litellmKeyResetSpendPermission,
+    exports.litellmKeyUnblockPermission,
+    exports.litellmAuditReadPermission,
+    exports.litellmTeamCreatePermission,
+    exports.litellmTeamManagePermission,
+    exports.litellmTeamMembersManagePermission,
+    exports.litellmTeamKnowledgebaseManagePermission,
+    exports.litellmTeamMcpManagePermission,
+    exports.litellmTeamDeletePermission,
+];

package/dist/types.d.ts

@@ -0,0 +1,216 @@
+export interface UserInfo {
+    user_id: string;
+    user_email?: string;
+    email?: string;
+    teams?: string[];
+    models?: string[];
+    max_budget?: number;
+    spend?: number;
+    current_spend?: number;
+    soft_limit?: number;
+    hard_limit?: number;
+    /** Spend-reset period for max_budget, e.g. "30d". */
+    budget_duration?: string;
+    /** ISO timestamp when max_budget next resets (set when budget_duration is). */
+    budget_reset_at?: string;
+    /** Backstage-computed: true when the user is a member of litellm.audit.group */
+    can_view_audit?: boolean;
+}
+export interface TeamMember {
+    user_id: string;
+    user_email?: string;
+    role: 'admin' | 'user';
+}
+export interface TeamObjectPermission {
+    /** Vector store ids/names attached to the team. */
+    vector_stores?: string[];
+    /** MCP server ids/names attached to the team. */
+    mcp_servers?: string[];
+    /** MCP access group names attached to the team. */
+    mcp_access_groups?: string[];
+}
+export interface TeamInfo {
+    team_id: string;
+    team_alias?: string;
+    max_budget?: number;
+    /** Spend-reset period for max_budget, e.g. "30d". */
+    budget_duration?: string;
+    spend: number;
+    /**
+     * Share of max_budget consumed (0-100), present only on redacted records.
+     * Set by the backend when litellm.display.hideTeamBudgetFor* is enabled so
+     * clients can render the consumption level without dollar amounts.
+     */
+    budget_pct?: number;
+    /** ok | near (>=80%) | over (>=100%), present only on redacted records. */
+    budget_status?: 'ok' | 'near' | 'over';
+    /** True when max_budget/spend were stripped by budget hiding. */
+    budget_hidden?: boolean;
+    members_with_roles?: TeamMember[];
+    models?: string[];
+    tpm_limit?: number;
+    rpm_limit?: number;
+    /** Arbitrary metadata stored on the team record. */
+    metadata?: Record<string, unknown>;
+    /** Knowledge bases (vector stores) and MCP servers attached to the team. */
+    object_permission?: TeamObjectPermission;
+    /** Whether the team is blocked/deactivated. */
+    blocked?: boolean;
+    /** Max budget available to individual team members (if set per-member). */
+    team_member_budget?: number;
+}
+export interface VirtualKey {
+    key: string;
+    token?: string;
+    key_alias?: string;
+    created_at: string;
+    expires_at?: string;
+    spend: number;
+    max_budget?: number;
+    budget_duration?: string;
+    tpm_limit?: number;
+    rpm_limit?: number;
+    models?: string[];
+    user_id?: string;
+    /** Team the key is bound to, when any (used to scope the model picker). */
+    team_id?: string;
+    blocked?: boolean;
+    /** Arbitrary metadata stored on the key record. */
+    metadata?: Record<string, unknown>;
+}
+export interface ModelInfo {
+    model_name: string;
+    mode: string;
+    supports_function_calling?: boolean;
+    supports_vision?: boolean;
+    input_cost_per_token?: number;
+    output_cost_per_token?: number;
+    max_input_tokens?: number;
+    max_output_tokens?: number;
+    /** Access group names this model belongs to (litellm.model_info.access_groups). A team's `models` list can reference a group name instead of a literal model_name. */
+    access_groups?: string[];
+}
+export interface UsageModelBreakdown {
+    total_spend: number;
+    total_tokens: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+}
+export interface UsageKeyBreakdown {
+    key_alias?: string;
+    team_id?: string | null;
+    models: string[];
+    total_spend: number;
+    total_tokens: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+}
+export interface UsageDailyPoint {
+    date: string;
+    spend: number;
+    total_tokens: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+}
+export interface UsageDailyModelPoint {
+    date: string;
+    model: string;
+    spend: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+}
+export interface UsageMetrics {
+    total_spend: number;
+    total_tokens: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+    usage_by_model: Record<string, UsageModelBreakdown>;
+    usage_by_key: Record<string, UsageKeyBreakdown>;
+    daily_usage: UsageDailyPoint[];
+    daily_by_model: UsageDailyModelPoint[];
+}
+export interface GenerateKeyRequest {
+    alias?: string;
+    models?: string[];
+    team_id?: string;
+    duration?: string;
+    /** Positive number caps spend; null/undefined means unlimited. */
+    max_budget?: number | null;
+    tpm_limit?: number;
+    rpm_limit?: number;
+    key_type?: string;
+    metadata?: Record<string, string>;
+    /** Backend-only: user ID for the key owner (set from authenticated principal). */
+    user_id?: string;
+}
+export interface UpdateKeyRequest {
+    key?: string;
+    key_alias?: string;
+    models?: string[];
+    /** Positive number caps spend; null clears it (unlimited, gated by allowUnlimitedBudget). */
+    max_budget?: number | null;
+    tpm_limit?: number;
+    rpm_limit?: number;
+    team_id?: string;
+    duration?: string;
+    /** Arbitrary metadata to merge with the existing record. */
+    metadata?: Record<string, unknown>;
+}
+export interface GenerateKeyResponse {
+    key: string;
+    key_alias?: string;
+    expires_at?: string;
+    max_budget?: number;
+    tpm_limit?: number;
+    rpm_limit?: number;
+    models?: string[];
+}
+export interface AuditLogEntry {
+    id: string;
+    updated_at: string;
+    changed_by?: string;
+    changed_by_api_key?: string;
+    action?: string;
+    table_name?: string;
+    object_id?: string;
+    before_value?: Record<string, unknown> | null;
+    updated_values?: Record<string, unknown> | null;
+}
+export interface PaginatedAuditLogs {
+    audit_logs: AuditLogEntry[];
+    total: number;
+    page: number;
+    page_size: number;
+    total_pages: number;
+}
+export interface AuditLogsParams {
+    page?: number;
+    page_size?: number;
+    start_date?: string;
+    end_date?: string;
+    action?: string;
+    table_name?: string;
+    changed_by?: string;
+    sort_by?: string;
+    sort_order?: 'asc' | 'desc';
+}
+export interface CreateTeamResponse {
+    team_id: string;
+    team_alias?: string;
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@acarmisc/backstage-plugin-litellm-common",
+  "version": "0.1.0",
+  "description": "Shared types, permissions, and schemas for the LiteLLM Backstage plugin",
+  "backstage": {
+    "role": "common-library",
+    "pluginId": "litellm"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/acarmisc/backstage-plugin-litellm-govai"
+  },
+  "homepage": "https://github.com/acarmisc/backstage-plugin-litellm-govai#readme",
+  "license": "Apache-2.0",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.cjs.js"
+    }
+  },
+  "main": "dist/index.cjs.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "node build.js && tsc -p tsconfig.json",
+    "test": "tsc -p tsconfig.test.json && node --test \"dist-test/**/*.test.js\"",
+    "prepack": "npm run build",
+    "postpack": ""
+  },
+  "dependencies": {
+    "@backstage/plugin-permission-common": "^0.9.10",
+    "zod": "^3.22.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "esbuild": "^0.28.0",
+    "typescript": "^5.9.3"
+  }
+}