@acarmisc/backstage-plugin-litellm-common 0.1.0 → 0.2.0

package/README.md

@@ -0,0 +1,26 @@
+# @acarmisc/backstage-plugin-litellm-common
+
+Shared code for the **Backstage LiteLLM Governance Plugin**: the `litellm.*`
+permission definitions, the request schemas used to validate key creation and
+updates, budget-status thresholds and the API types shared by the frontend and
+backend packages.
+
+You normally don't install it directly — it comes with
+[`@acarmisc/backstage-plugin-litellm`](https://www.npmjs.com/package/@acarmisc/backstage-plugin-litellm)
+and [`@acarmisc/backstage-plugin-litellm-backend`](https://www.npmjs.com/package/@acarmisc/backstage-plugin-litellm-backend).
+Import it when you write a permission policy that refers to the plugin's
+permissions:
+
+```ts
+import {
+  litellmKeyCreatePermission,
+  litellmTeamManagePermission,
+} from '@acarmisc/backstage-plugin-litellm-common';
+```
+
+See [docs/permissions.md](https://github.com/acarmisc/backstage-plugin-litellm-govai/blob/main/docs/permissions.md)
+for what each permission guards.
+
+## License
+
+Apache-2.0

package/dist/index.cjs.js

@@ -23,6 +23,7 @@ __export(index_exports, {
   ALL_PROXY_MODELS: () => ALL_PROXY_MODELS,
   BUDGET_DANGER_PCT: () => BUDGET_DANGER_PCT,
   BUDGET_WARNING_PCT: () => BUDGET_WARNING_PCT,
+  DEFAULT_KEY_BUDGET_DURATIONS: () => DEFAULT_KEY_BUDGET_DURATIONS,
   DEFAULT_KEY_DURATIONS: () => DEFAULT_KEY_DURATIONS,
   RESERVED_METADATA_KEYS: () => RESERVED_METADATA_KEYS,
   budgetStatusForPct: () => budgetStatusForPct,
@@ -43,6 +44,7 @@ __export(index_exports, {
   litellmTeamManagePermission: () => litellmTeamManagePermission,
   litellmTeamMcpManagePermission: () => litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission: () => litellmTeamMembersManagePermission,
+  litellmTeamUsageReadPermission: () => litellmTeamUsageReadPermission,
   reservedMetadataKeys: () => reservedMetadataKeys
 });
 module.exports = __toCommonJS(index_exports);
@@ -97,6 +99,10 @@ var litellmTeamDeletePermission = (0, import_plugin_permission_common.createPerm
   name: "litellm.team.delete",
   attributes: { action: "delete" }
 });
+var litellmTeamUsageReadPermission = (0, import_plugin_permission_common.createPermission)({
+  name: "litellm.team.usage.read",
+  attributes: { action: "read" }
+});
 var litellmPermissions = [
   litellmKeyCreatePermission,
   litellmKeyRevokePermission,
@@ -109,7 +115,8 @@ var litellmPermissions = [
   litellmTeamMembersManagePermission,
   litellmTeamKnowledgebaseManagePermission,
   litellmTeamMcpManagePermission,
-  litellmTeamDeletePermission
+  litellmTeamDeletePermission,
+  litellmTeamUsageReadPermission
 ];
 
 // src/keySchemas.ts
@@ -130,11 +137,21 @@ function createGenerateKeyInputSchema(config) {
   ) : import_zod.z.string().regex(/^\d+[smhdwy]$/, {
     message: 'duration must match format <number><unit> (e.g. "30d", "1h")'
   });
+  const budgetDurations = config.allowedBudgetDurations ?? DEFAULT_KEY_BUDGET_DURATIONS;
+  const budgetDurationSchema = budgetDurations.length > 0 ? import_zod.z.string().refine(
+    (val) => budgetDurations.includes(val),
+    {
+      message: `budget_duration must be one of: ${budgetDurations.join(", ")}`
+    }
+  ) : import_zod.z.string().regex(/^\d+(s|m|h|d|mo)$/, {
+    message: 'budget_duration must match format <number><unit> (e.g. "30d", "1mo")'
+  });
   return import_zod.z.object({
     alias: import_zod.z.string().trim().min(1, "alias is required").max(128, "alias must be at most 128 characters"),
     models: import_zod.z.array(import_zod.z.string()).max(100, "models array is too large").optional(),
     duration: durationSchema.optional(),
     max_budget: import_zod.z.number().positive("max_budget must be a positive number").max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`).nullable().optional(),
+    budget_duration: budgetDurationSchema.optional(),
     tpm_limit: import_zod.z.number().int("tpm_limit must be an integer").positive("tpm_limit must be a positive number").max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`).optional(),
     rpm_limit: import_zod.z.number().int("rpm_limit must be an integer").positive("rpm_limit must be a positive number").max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`).optional(),
     team_id: import_zod.z.string().optional(),
@@ -155,6 +172,7 @@ function createUpdateKeyInputSchema(config) {
   }).strict();
 }
 var DEFAULT_KEY_DURATIONS = ["1d", "7d", "30d", "90d"];
+var DEFAULT_KEY_BUDGET_DURATIONS = ["1d", "7d", "30d", "1mo"];
 
 // src/budgets.ts
 var BUDGET_WARNING_PCT = 80;
@@ -194,6 +212,7 @@ function isModelAllowed(model, allowed) {
   ALL_PROXY_MODELS,
   BUDGET_DANGER_PCT,
   BUDGET_WARNING_PCT,
+  DEFAULT_KEY_BUDGET_DURATIONS,
   DEFAULT_KEY_DURATIONS,
   RESERVED_METADATA_KEYS,
   budgetStatusForPct,
@@ -214,6 +233,7 @@ function isModelAllowed(model, allowed) {
   litellmTeamManagePermission,
   litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission,
+  litellmTeamUsageReadPermission,
   reservedMetadataKeys
 });
 //# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts", "../src/permissions.ts", "../src/keySchemas.ts", "../src/budgets.ts", "../src/modelAccess.ts"],
-  "sourcesContent": ["export * from './permissions';\nexport * from './keySchemas';\nexport * from './types';\nexport * from './budgets';\nexport * from './modelAccess';\n", "import { createPermission } from '@backstage/plugin-permission-common';\n\nexport const litellmKeyCreatePermission = createPermission({\n  name: 'litellm.key.create',\n  attributes: { action: 'create' },\n});\n\nexport const litellmKeyRevokePermission = createPermission({\n  name: 'litellm.key.revoke',\n  attributes: { action: 'delete' },\n});\n\nexport const litellmKeyManagePermission = createPermission({\n  name: 'litellm.key.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmKeyResetSpendPermission = createPermission({\n  name: 'litellm.key.resetSpend',\n  attributes: { action: 'update' },\n});\n\nexport const litellmKeyUnblockPermission = createPermission({\n  name: 'litellm.key.unblock',\n  attributes: { action: 'update' },\n});\n\nexport const litellmAuditReadPermission = createPermission({\n  name: 'litellm.audit.read',\n  attributes: { action: 'read' },\n});\n\n// Team-management permissions \u2014 delegated to litellm-team-admins group\nexport const litellmTeamCreatePermission = createPermission({\n  name: 'litellm.team.create',\n  attributes: { action: 'create' },\n});\n\nexport const litellmTeamManagePermission = createPermission({\n  name: 'litellm.team.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamMembersManagePermission = createPermission({\n  name: 'litellm.team.members.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamKnowledgebaseManagePermission = createPermission({\n  name: 'litellm.team.knowledgebase.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamMcpManagePermission = createPermission({\n  name: 'litellm.team.mcp.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamDeletePermission = createPermission({\n  name: 'litellm.team.delete',\n  attributes: { action: 'delete' },\n});\n\nexport const litellmPermissions = [\n  litellmKeyCreatePermission,\n  litellmKeyRevokePermission,\n  litellmKeyManagePermission,\n  litellmKeyResetSpendPermission,\n  litellmKeyUnblockPermission,\n  litellmAuditReadPermission,\n  litellmTeamCreatePermission,\n  litellmTeamManagePermission,\n  litellmTeamMembersManagePermission,\n  litellmTeamKnowledgebaseManagePermission,\n  litellmTeamMcpManagePermission,\n  litellmTeamDeletePermission,\n];\n", "import { z } from 'zod';\n\n/**\n * Configuration for key validation ceilings and allowed values.\n */\n/**\n * Metadata keys the server owns. Clients must not set them: `blocked_by` /\n * `blocked_at` decide who may unblock a key, and `created_*` / `updated_*`\n * record provenance.\n */\nexport const RESERVED_METADATA_KEYS = ['blocked_by', 'blocked_at'] as const;\nconst RESERVED_METADATA_PREFIXES = ['created_', 'updated_'] as const;\n\nexport function reservedMetadataKeys(metadata: Record<string, unknown>): string[] {\n  return Object.keys(metadata).filter(\n    k =>\n      (RESERVED_METADATA_KEYS as readonly string[]).includes(k) ||\n      RESERVED_METADATA_PREFIXES.some(p => k.startsWith(p)),\n  );\n}\n\nexport interface KeyValidationConfig {\n  maxBudget: number;\n  maxTpm: number;\n  maxRpm: number;\n  allowedDurations: string[];\n}\n\n/**\n * Creates a strict Zod schema for GenerateKeyInput validation.\n * Rejects unknown fields and enforces server-side ceilings.\n *\n * @param config Server configuration with ceiling values and allowed durations\n * @returns A Zod object schema that validates the input\n */\nexport function createGenerateKeyInputSchema(config: KeyValidationConfig) {\n  // When allowedDurations is set, restrict to that list.\n  // Otherwise, allow any string matching the duration format regex.\n  const durationSchema = config.allowedDurations.length > 0\n    ? z.string().refine(\n        (val) => config.allowedDurations.includes(val),\n        {\n          message: `duration must be one of: ${config.allowedDurations.join(', ')}`,\n        },\n      )\n    : z.string().regex(/^\\d+[smhdwy]$/, {\n        message: 'duration must match format <number><unit> (e.g. \"30d\", \"1h\")',\n      });\n\n  return z\n    .object({\n      alias: z\n        .string()\n        .trim()\n        .min(1, 'alias is required')\n        .max(128, 'alias must be at most 128 characters'),\n      models: z\n        .array(z.string())\n        .max(100, 'models array is too large')\n        .optional(),\n      duration: durationSchema.optional(),\n      max_budget: z\n        .number()\n        .positive('max_budget must be a positive number')\n        .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)\n        .nullable()\n        .optional(),\n      tpm_limit: z\n        .number()\n        .int('tpm_limit must be an integer')\n        .positive('tpm_limit must be a positive number')\n        .max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`)\n        .optional(),\n      rpm_limit: z\n        .number()\n        .int('rpm_limit must be an integer')\n        .positive('rpm_limit must be a positive number')\n        .max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`)\n        .optional(),\n      team_id: z.string().optional(),\n      // The UI always sends 'llm_api'; no other key type may be requested.\n      key_type: z.literal('llm_api').optional(),\n      metadata: z\n        .record(z.string(), z.string())\n        .refine(m => reservedMetadataKeys(m).length === 0, {\n          message:\n            'metadata may not set server-owned keys (blocked_by, blocked_at, created_*, updated_*)',\n        })\n        .optional(),\n    })\n    .strict();\n}\n\nexport type GenerateKeyInput = z.infer<\n  ReturnType<typeof createGenerateKeyInputSchema>\n>;\n\n/**\n * Creates a strict Zod schema for UpdateKeyInput validation.\n * Only allows key_alias, models, max_budget, tpm_limit, and rpm_limit fields.\n * Rejects all other fields including team_id, user_id, spend, blocked, key, and budget_duration.\n *\n * @param config Server configuration with ceiling values\n * @returns A Zod object schema that validates the input\n */\nexport function createUpdateKeyInputSchema(config: KeyValidationConfig) {\n  return z\n    .object({\n      key_alias: z\n        .string()\n        .trim()\n        .min(1, 'key_alias is required')\n        .max(128, 'key_alias must be at most 128 characters')\n        .optional(),\n      models: z\n        .array(z.string())\n        .max(100, 'models array is too large')\n        .optional(),\n      max_budget: z\n        .number()\n        .positive('max_budget must be a positive number')\n        .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)\n        .nullable()\n        .optional(),\n      tpm_limit: z\n        .number()\n        .int('tpm_limit must be an integer')\n        .positive('tpm_limit must be a positive number')\n        .max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`)\n        .optional(),\n      rpm_limit: z\n        .number()\n        .int('rpm_limit must be an integer')\n        .positive('rpm_limit must be a positive number')\n        .max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`)\n        .optional(),\n    })\n    .strict();\n}\n\nexport type UpdateKeyInput = z.infer<\n  ReturnType<typeof createUpdateKeyInputSchema>\n>;\n\n/**\n * Default key duration presets. Used as server-side defaults and UI options.\n */\nexport const DEFAULT_KEY_DURATIONS = ['1d', '7d', '30d', '90d'];\n", "/** Budget warning threshold (percent of cap). */\nexport const BUDGET_WARNING_PCT = 80;\n\n/** Budget danger threshold (percent of cap, at or over cap). */\nexport const BUDGET_DANGER_PCT = 100;\n\n/** Consumption status derived from spend vs. cap. */\nexport type BudgetStatus = 'ok' | 'near' | 'over';\n\n/**\n * Compute budget status from spend percentage of cap.\n * Thresholds: near >= 80%, over >= 100%.\n */\nexport function budgetStatusForPct(pct: number): BudgetStatus {\n  if (pct >= BUDGET_DANGER_PCT) return 'over';\n  if (pct >= BUDGET_WARNING_PCT) return 'near';\n  return 'ok';\n}\n\n/**\n * Format a duration string to a human-readable label.\n * E.g., \"1d\" \u2192 \"1 Day\", \"7d\" \u2192 \"7 Days\".\n */\nexport function formatDurationLabel(duration: string): string {\n  const match = /^(\\d+)([smhdwy])$/.exec(duration);\n  if (!match) return duration;\n\n  const [, num, unit] = match;\n  const n = Number(num);\n\n  const unitLabels: Record<string, string> = {\n    s: 'Second',\n    m: 'Minute',\n    h: 'Hour',\n    d: 'Day',\n    w: 'Week',\n    y: 'Year',\n  };\n\n  const label = unitLabels[unit] || unit;\n  return n === 1 ? `1 ${label}` : `${n} ${label}s`;\n}\n", "/**\n * LiteLLM sentinel: a team's (or user's) `models` list is `[\"all-proxy-models\"]`\n * when it isn't restricted to specific models.\n */\nexport const ALL_PROXY_MODELS = 'all-proxy-models';\n\n/**\n * Whether a model is allowed by an allow-list. The list is unrestricted when it\n * is empty/missing or contains the `all-proxy-models` sentinel. Entries may be\n * literal model names OR access-group names (litellm model_info.access_groups),\n * so a model also passes when one of its access groups is listed.\n */\nexport function isModelAllowed(\n  model: { model_name: string; access_groups?: string[] },\n  allowed?: string[],\n): boolean {\n  if (!allowed || allowed.length === 0) return true;\n  if (allowed.includes(ALL_PROXY_MODELS)) return true;\n  if (allowed.includes(model.model_name)) return true;\n  return !!model.access_groups?.some(group => allowed.includes(group));\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,sCAAiC;AAE1B,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,qCAAiC,kDAAiB;AAAA,EAC7D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,OAAO;AAC/B,CAAC;AAGM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,yCAAqC,kDAAiB;AAAA,EACjE,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,+CAA2C,kDAAiB;AAAA,EACvE,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,qCAAiC,kDAAiB;AAAA,EAC7D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AC5EA,iBAAkB;AAUX,IAAM,yBAAyB,CAAC,cAAc,YAAY;AACjE,IAAM,6BAA6B,CAAC,YAAY,UAAU;AAEnD,SAAS,qBAAqB,UAA6C;AAChF,SAAO,OAAO,KAAK,QAAQ,EAAE;AAAA,IAC3B,OACG,uBAA6C,SAAS,CAAC,KACxD,2BAA2B,KAAK,OAAK,EAAE,WAAW,CAAC,CAAC;AAAA,EACxD;AACF;AAgBO,SAAS,6BAA6B,QAA6B;AAGxE,QAAM,iBAAiB,OAAO,iBAAiB,SAAS,IACpD,aAAE,OAAO,EAAE;AAAA,IACT,CAAC,QAAQ,OAAO,iBAAiB,SAAS,GAAG;AAAA,IAC7C;AAAA,MACE,SAAS,4BAA4B,OAAO,iBAAiB,KAAK,IAAI,CAAC;AAAA,IACzE;AAAA,EACF,IACA,aAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,IAChC,SAAS;AAAA,EACX,CAAC;AAEL,SAAO,aACJ,OAAO;AAAA,IACN,OAAO,aACJ,OAAO,EACP,KAAK,EACL,IAAI,GAAG,mBAAmB,EAC1B,IAAI,KAAK,sCAAsC;AAAA,IAClD,QAAQ,aACL,MAAM,aAAE,OAAO,CAAC,EAChB,IAAI,KAAK,2BAA2B,EACpC,SAAS;AAAA,IACZ,UAAU,eAAe,SAAS;AAAA,IAClC,YAAY,aACT,OAAO,EACP,SAAS,sCAAsC,EAC/C,IAAI,OAAO,WAAW,8BAA8B,OAAO,SAAS,EAAE,EACtE,SAAS,EACT,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAE7B,UAAU,aAAE,QAAQ,SAAS,EAAE,SAAS;AAAA,IACxC,UAAU,aACP,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAC7B,OAAO,OAAK,qBAAqB,CAAC,EAAE,WAAW,GAAG;AAAA,MACjD,SACE;AAAA,IACJ,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,OAAO;AACZ;AAcO,SAAS,2BAA2B,QAA6B;AACtE,SAAO,aACJ,OAAO;AAAA,IACN,WAAW,aACR,OAAO,EACP,KAAK,EACL,IAAI,GAAG,uBAAuB,EAC9B,IAAI,KAAK,0CAA0C,EACnD,SAAS;AAAA,IACZ,QAAQ,aACL,MAAM,aAAE,OAAO,CAAC,EAChB,IAAI,KAAK,2BAA2B,EACpC,SAAS;AAAA,IACZ,YAAY,aACT,OAAO,EACP,SAAS,sCAAsC,EAC/C,IAAI,OAAO,WAAW,8BAA8B,OAAO,SAAS,EAAE,EACtE,SAAS,EACT,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,EACd,CAAC,EACA,OAAO;AACZ;AASO,IAAM,wBAAwB,CAAC,MAAM,MAAM,OAAO,KAAK;;;AClJvD,IAAM,qBAAqB;AAG3B,IAAM,oBAAoB;AAS1B,SAAS,mBAAmB,KAA2B;AAC5D,MAAI,OAAO,kBAAmB,QAAO;AACrC,MAAI,OAAO,mBAAoB,QAAO;AACtC,SAAO;AACT;AAMO,SAAS,oBAAoB,UAA0B;AAC5D,QAAM,QAAQ,oBAAoB,KAAK,QAAQ;AAC/C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,KAAK,IAAI,IAAI;AACtB,QAAM,IAAI,OAAO,GAAG;AAEpB,QAAM,aAAqC;AAAA,IACzC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,QAAM,QAAQ,WAAW,IAAI,KAAK;AAClC,SAAO,MAAM,IAAI,KAAK,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK;AAC/C;;;ACrCO,IAAM,mBAAmB;AAQzB,SAAS,eACd,OACA,SACS;AACT,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAC7C,MAAI,QAAQ,SAAS,gBAAgB,EAAG,QAAO;AAC/C,MAAI,QAAQ,SAAS,MAAM,UAAU,EAAG,QAAO;AAC/C,SAAO,CAAC,CAAC,MAAM,eAAe,KAAK,WAAS,QAAQ,SAAS,KAAK,CAAC;AACrE;",
+  "sourcesContent": ["export * from './permissions';\nexport * from './keySchemas';\nexport * from './types';\nexport * from './budgets';\nexport * from './modelAccess';\n", "import { createPermission } from '@backstage/plugin-permission-common';\n\nexport const litellmKeyCreatePermission = createPermission({\n  name: 'litellm.key.create',\n  attributes: { action: 'create' },\n});\n\nexport const litellmKeyRevokePermission = createPermission({\n  name: 'litellm.key.revoke',\n  attributes: { action: 'delete' },\n});\n\nexport const litellmKeyManagePermission = createPermission({\n  name: 'litellm.key.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmKeyResetSpendPermission = createPermission({\n  name: 'litellm.key.resetSpend',\n  attributes: { action: 'update' },\n});\n\nexport const litellmKeyUnblockPermission = createPermission({\n  name: 'litellm.key.unblock',\n  attributes: { action: 'update' },\n});\n\nexport const litellmAuditReadPermission = createPermission({\n  name: 'litellm.audit.read',\n  attributes: { action: 'read' },\n});\n\n// Team-management permissions \u2014 delegated to litellm-team-admins group\nexport const litellmTeamCreatePermission = createPermission({\n  name: 'litellm.team.create',\n  attributes: { action: 'create' },\n});\n\nexport const litellmTeamManagePermission = createPermission({\n  name: 'litellm.team.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamMembersManagePermission = createPermission({\n  name: 'litellm.team.members.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamKnowledgebaseManagePermission = createPermission({\n  name: 'litellm.team.knowledgebase.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamMcpManagePermission = createPermission({\n  name: 'litellm.team.mcp.manage',\n  attributes: { action: 'update' },\n});\n\nexport const litellmTeamDeletePermission = createPermission({\n  name: 'litellm.team.delete',\n  attributes: { action: 'delete' },\n});\n\n/**\n * Read the per-member usage breakdown of a team the caller belongs to.\n * Only consulted when `litellm.teamUsage.memberBreakdown.enabled` is true and\n * the permission framework is enabled.\n */\nexport const litellmTeamUsageReadPermission = createPermission({\n  name: 'litellm.team.usage.read',\n  attributes: { action: 'read' },\n});\n\nexport const litellmPermissions = [\n  litellmKeyCreatePermission,\n  litellmKeyRevokePermission,\n  litellmKeyManagePermission,\n  litellmKeyResetSpendPermission,\n  litellmKeyUnblockPermission,\n  litellmAuditReadPermission,\n  litellmTeamCreatePermission,\n  litellmTeamManagePermission,\n  litellmTeamMembersManagePermission,\n  litellmTeamKnowledgebaseManagePermission,\n  litellmTeamMcpManagePermission,\n  litellmTeamDeletePermission,\n  litellmTeamUsageReadPermission,\n];\n", "import { z } from 'zod';\n\n/**\n * Configuration for key validation ceilings and allowed values.\n */\n/**\n * Metadata keys the server owns. Clients must not set them: `blocked_by` /\n * `blocked_at` decide who may unblock a key, and `created_*` / `updated_*`\n * record provenance.\n */\nexport const RESERVED_METADATA_KEYS = ['blocked_by', 'blocked_at'] as const;\nconst RESERVED_METADATA_PREFIXES = ['created_', 'updated_'] as const;\n\nexport function reservedMetadataKeys(metadata: Record<string, unknown>): string[] {\n  return Object.keys(metadata).filter(\n    k =>\n      (RESERVED_METADATA_KEYS as readonly string[]).includes(k) ||\n      RESERVED_METADATA_PREFIXES.some(p => k.startsWith(p)),\n  );\n}\n\nexport interface KeyValidationConfig {\n  maxBudget: number;\n  maxTpm: number;\n  maxRpm: number;\n  allowedDurations: string[];\n  /**\n   * Allowed `budget_duration` values (how often a key's spend resets). An\n   * empty list allows any value matching `<n><s|m|h|d|mo>`. Omitted means\n   * {@link DEFAULT_KEY_BUDGET_DURATIONS}.\n   */\n  allowedBudgetDurations?: string[];\n}\n\n/**\n * Creates a strict Zod schema for GenerateKeyInput validation.\n * Rejects unknown fields and enforces server-side ceilings.\n *\n * @param config Server configuration with ceiling values and allowed durations\n * @returns A Zod object schema that validates the input\n */\nexport function createGenerateKeyInputSchema(config: KeyValidationConfig) {\n  // When allowedDurations is set, restrict to that list.\n  // Otherwise, allow any string matching the duration format regex.\n  const durationSchema = config.allowedDurations.length > 0\n    ? z.string().refine(\n        (val) => config.allowedDurations.includes(val),\n        {\n          message: `duration must be one of: ${config.allowedDurations.join(', ')}`,\n        },\n      )\n    : z.string().regex(/^\\d+[smhdwy]$/, {\n        message: 'duration must match format <number><unit> (e.g. \"30d\", \"1h\")',\n      });\n\n  const budgetDurations = config.allowedBudgetDurations ?? DEFAULT_KEY_BUDGET_DURATIONS;\n  const budgetDurationSchema = budgetDurations.length > 0\n    ? z.string().refine(\n        (val) => budgetDurations.includes(val),\n        {\n          message: `budget_duration must be one of: ${budgetDurations.join(', ')}`,\n        },\n      )\n    : z.string().regex(/^\\d+(s|m|h|d|mo)$/, {\n        message: 'budget_duration must match format <number><unit> (e.g. \"30d\", \"1mo\")',\n      });\n\n  return z\n    .object({\n      alias: z\n        .string()\n        .trim()\n        .min(1, 'alias is required')\n        .max(128, 'alias must be at most 128 characters'),\n      models: z\n        .array(z.string())\n        .max(100, 'models array is too large')\n        .optional(),\n      duration: durationSchema.optional(),\n      max_budget: z\n        .number()\n        .positive('max_budget must be a positive number')\n        .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)\n        .nullable()\n        .optional(),\n      budget_duration: budgetDurationSchema.optional(),\n      tpm_limit: z\n        .number()\n        .int('tpm_limit must be an integer')\n        .positive('tpm_limit must be a positive number')\n        .max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`)\n        .optional(),\n      rpm_limit: z\n        .number()\n        .int('rpm_limit must be an integer')\n        .positive('rpm_limit must be a positive number')\n        .max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`)\n        .optional(),\n      team_id: z.string().optional(),\n      // The UI always sends 'llm_api'; no other key type may be requested.\n      key_type: z.literal('llm_api').optional(),\n      metadata: z\n        .record(z.string(), z.string())\n        .refine(m => reservedMetadataKeys(m).length === 0, {\n          message:\n            'metadata may not set server-owned keys (blocked_by, blocked_at, created_*, updated_*)',\n        })\n        .optional(),\n    })\n    .strict();\n}\n\nexport type GenerateKeyInput = z.infer<\n  ReturnType<typeof createGenerateKeyInputSchema>\n>;\n\n/**\n * Creates a strict Zod schema for UpdateKeyInput validation.\n * Only allows key_alias, models, max_budget, tpm_limit, and rpm_limit fields.\n * Rejects all other fields including team_id, user_id, spend, blocked, key, and budget_duration.\n *\n * @param config Server configuration with ceiling values\n * @returns A Zod object schema that validates the input\n */\nexport function createUpdateKeyInputSchema(config: KeyValidationConfig) {\n  return z\n    .object({\n      key_alias: z\n        .string()\n        .trim()\n        .min(1, 'key_alias is required')\n        .max(128, 'key_alias must be at most 128 characters')\n        .optional(),\n      models: z\n        .array(z.string())\n        .max(100, 'models array is too large')\n        .optional(),\n      max_budget: z\n        .number()\n        .positive('max_budget must be a positive number')\n        .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)\n        .nullable()\n        .optional(),\n      tpm_limit: z\n        .number()\n        .int('tpm_limit must be an integer')\n        .positive('tpm_limit must be a positive number')\n        .max(config.maxTpm, `tpm_limit must not exceed ${config.maxTpm}`)\n        .optional(),\n      rpm_limit: z\n        .number()\n        .int('rpm_limit must be an integer')\n        .positive('rpm_limit must be a positive number')\n        .max(config.maxRpm, `rpm_limit must not exceed ${config.maxRpm}`)\n        .optional(),\n    })\n    .strict();\n}\n\nexport type UpdateKeyInput = z.infer<\n  ReturnType<typeof createUpdateKeyInputSchema>\n>;\n\n/**\n * Default key duration presets. Used as server-side defaults and UI options.\n */\nexport const DEFAULT_KEY_DURATIONS = ['1d', '7d', '30d', '90d'];\n\n/**\n * Default `budget_duration` values a key may be generated with.\n */\nexport const DEFAULT_KEY_BUDGET_DURATIONS = ['1d', '7d', '30d', '1mo'];\n", "/** Budget warning threshold (percent of cap). */\nexport const BUDGET_WARNING_PCT = 80;\n\n/** Budget danger threshold (percent of cap, at or over cap). */\nexport const BUDGET_DANGER_PCT = 100;\n\n/** Consumption status derived from spend vs. cap. */\nexport type BudgetStatus = 'ok' | 'near' | 'over';\n\n/**\n * Compute budget status from spend percentage of cap.\n * Thresholds: near >= 80%, over >= 100%.\n */\nexport function budgetStatusForPct(pct: number): BudgetStatus {\n  if (pct >= BUDGET_DANGER_PCT) return 'over';\n  if (pct >= BUDGET_WARNING_PCT) return 'near';\n  return 'ok';\n}\n\n/**\n * Format a duration string to a human-readable label.\n * E.g., \"1d\" \u2192 \"1 Day\", \"7d\" \u2192 \"7 Days\".\n */\nexport function formatDurationLabel(duration: string): string {\n  const match = /^(\\d+)([smhdwy])$/.exec(duration);\n  if (!match) return duration;\n\n  const [, num, unit] = match;\n  const n = Number(num);\n\n  const unitLabels: Record<string, string> = {\n    s: 'Second',\n    m: 'Minute',\n    h: 'Hour',\n    d: 'Day',\n    w: 'Week',\n    y: 'Year',\n  };\n\n  const label = unitLabels[unit] || unit;\n  return n === 1 ? `1 ${label}` : `${n} ${label}s`;\n}\n", "/**\n * LiteLLM sentinel: a team's (or user's) `models` list is `[\"all-proxy-models\"]`\n * when it isn't restricted to specific models.\n */\nexport const ALL_PROXY_MODELS = 'all-proxy-models';\n\n/**\n * Whether a model is allowed by an allow-list. The list is unrestricted when it\n * is empty/missing or contains the `all-proxy-models` sentinel. Entries may be\n * literal model names OR access-group names (litellm model_info.access_groups),\n * so a model also passes when one of its access groups is listed.\n */\nexport function isModelAllowed(\n  model: { model_name: string; access_groups?: string[] },\n  allowed?: string[],\n): boolean {\n  if (!allowed || allowed.length === 0) return true;\n  if (allowed.includes(ALL_PROXY_MODELS)) return true;\n  if (allowed.includes(model.model_name)) return true;\n  return !!model.access_groups?.some(group => allowed.includes(group));\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,sCAAiC;AAE1B,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,qCAAiC,kDAAiB;AAAA,EAC7D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,iCAA6B,kDAAiB;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,OAAO;AAC/B,CAAC;AAGM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,yCAAqC,kDAAiB;AAAA,EACjE,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,+CAA2C,kDAAiB;AAAA,EACvE,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,qCAAiC,kDAAiB;AAAA,EAC7D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAEM,IAAM,kCAA8B,kDAAiB;AAAA,EAC1D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,SAAS;AACjC,CAAC;AAOM,IAAM,qCAAiC,kDAAiB;AAAA,EAC7D,MAAM;AAAA,EACN,YAAY,EAAE,QAAQ,OAAO;AAC/B,CAAC;AAEM,IAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACvFA,iBAAkB;AAUX,IAAM,yBAAyB,CAAC,cAAc,YAAY;AACjE,IAAM,6BAA6B,CAAC,YAAY,UAAU;AAEnD,SAAS,qBAAqB,UAA6C;AAChF,SAAO,OAAO,KAAK,QAAQ,EAAE;AAAA,IAC3B,OACG,uBAA6C,SAAS,CAAC,KACxD,2BAA2B,KAAK,OAAK,EAAE,WAAW,CAAC,CAAC;AAAA,EACxD;AACF;AAsBO,SAAS,6BAA6B,QAA6B;AAGxE,QAAM,iBAAiB,OAAO,iBAAiB,SAAS,IACpD,aAAE,OAAO,EAAE;AAAA,IACT,CAAC,QAAQ,OAAO,iBAAiB,SAAS,GAAG;AAAA,IAC7C;AAAA,MACE,SAAS,4BAA4B,OAAO,iBAAiB,KAAK,IAAI,CAAC;AAAA,IACzE;AAAA,EACF,IACA,aAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,IAChC,SAAS;AAAA,EACX,CAAC;AAEL,QAAM,kBAAkB,OAAO,0BAA0B;AACzD,QAAM,uBAAuB,gBAAgB,SAAS,IAClD,aAAE,OAAO,EAAE;AAAA,IACT,CAAC,QAAQ,gBAAgB,SAAS,GAAG;AAAA,IACrC;AAAA,MACE,SAAS,mCAAmC,gBAAgB,KAAK,IAAI,CAAC;AAAA,IACxE;AAAA,EACF,IACA,aAAE,OAAO,EAAE,MAAM,qBAAqB;AAAA,IACpC,SAAS;AAAA,EACX,CAAC;AAEL,SAAO,aACJ,OAAO;AAAA,IACN,OAAO,aACJ,OAAO,EACP,KAAK,EACL,IAAI,GAAG,mBAAmB,EAC1B,IAAI,KAAK,sCAAsC;AAAA,IAClD,QAAQ,aACL,MAAM,aAAE,OAAO,CAAC,EAChB,IAAI,KAAK,2BAA2B,EACpC,SAAS;AAAA,IACZ,UAAU,eAAe,SAAS;AAAA,IAClC,YAAY,aACT,OAAO,EACP,SAAS,sCAAsC,EAC/C,IAAI,OAAO,WAAW,8BAA8B,OAAO,SAAS,EAAE,EACtE,SAAS,EACT,SAAS;AAAA,IACZ,iBAAiB,qBAAqB,SAAS;AAAA,IAC/C,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAE7B,UAAU,aAAE,QAAQ,SAAS,EAAE,SAAS;AAAA,IACxC,UAAU,aACP,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAC7B,OAAO,OAAK,qBAAqB,CAAC,EAAE,WAAW,GAAG;AAAA,MACjD,SACE;AAAA,IACJ,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,OAAO;AACZ;AAcO,SAAS,2BAA2B,QAA6B;AACtE,SAAO,aACJ,OAAO;AAAA,IACN,WAAW,aACR,OAAO,EACP,KAAK,EACL,IAAI,GAAG,uBAAuB,EAC9B,IAAI,KAAK,0CAA0C,EACnD,SAAS;AAAA,IACZ,QAAQ,aACL,MAAM,aAAE,OAAO,CAAC,EAChB,IAAI,KAAK,2BAA2B,EACpC,SAAS;AAAA,IACZ,YAAY,aACT,OAAO,EACP,SAAS,sCAAsC,EAC/C,IAAI,OAAO,WAAW,8BAA8B,OAAO,SAAS,EAAE,EACtE,SAAS,EACT,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,IACZ,WAAW,aACR,OAAO,EACP,IAAI,8BAA8B,EAClC,SAAS,qCAAqC,EAC9C,IAAI,OAAO,QAAQ,6BAA6B,OAAO,MAAM,EAAE,EAC/D,SAAS;AAAA,EACd,CAAC,EACA,OAAO;AACZ;AASO,IAAM,wBAAwB,CAAC,MAAM,MAAM,OAAO,KAAK;AAKvD,IAAM,+BAA+B,CAAC,MAAM,MAAM,OAAO,KAAK;;;AC1K9D,IAAM,qBAAqB;AAG3B,IAAM,oBAAoB;AAS1B,SAAS,mBAAmB,KAA2B;AAC5D,MAAI,OAAO,kBAAmB,QAAO;AACrC,MAAI,OAAO,mBAAoB,QAAO;AACtC,SAAO;AACT;AAMO,SAAS,oBAAoB,UAA0B;AAC5D,QAAM,QAAQ,oBAAoB,KAAK,QAAQ;AAC/C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,KAAK,IAAI,IAAI;AACtB,QAAM,IAAI,OAAO,GAAG;AAEpB,QAAM,aAAqC;AAAA,IACzC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAEA,QAAM,QAAQ,WAAW,IAAI,KAAK;AAClC,SAAO,MAAM,IAAI,KAAK,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK;AAC/C;;;ACrCO,IAAM,mBAAmB;AAQzB,SAAS,eACd,OACA,SACS;AACT,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAC7C,MAAI,QAAQ,SAAS,gBAAgB,EAAG,QAAO;AAC/C,MAAI,QAAQ,SAAS,MAAM,UAAU,EAAG,QAAO;AAC/C,SAAO,CAAC,CAAC,MAAM,eAAe,KAAK,WAAS,QAAQ,SAAS,KAAK,CAAC;AACrE;",
   "names": []
 }

package/dist/keySchemas.d.ts

@@ -14,6 +14,12 @@ export interface KeyValidationConfig {
     maxTpm: number;
     maxRpm: number;
     allowedDurations: string[];
+    /**
+     * Allowed `budget_duration` values (how often a key's spend resets). An
+     * empty list allows any value matching `<n><s|m|h|d|mo>`. Omitted means
+     * {@link DEFAULT_KEY_BUDGET_DURATIONS}.
+     */
+    allowedBudgetDurations?: string[];
 }
 /**
  * Creates a strict Zod schema for GenerateKeyInput validation.
@@ -27,6 +33,7 @@ export declare function createGenerateKeyInputSchema(config: KeyValidationConfig
     models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     duration: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>> | z.ZodOptional<z.ZodString>;
     max_budget: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    budget_duration: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>> | z.ZodOptional<z.ZodString>;
     tpm_limit: z.ZodOptional<z.ZodNumber>;
     rpm_limit: z.ZodOptional<z.ZodNumber>;
     team_id: z.ZodOptional<z.ZodString>;
@@ -37,6 +44,7 @@ export declare function createGenerateKeyInputSchema(config: KeyValidationConfig
     models?: string[] | undefined;
     duration?: string | undefined;
     max_budget?: number | null | undefined;
+    budget_duration?: string | undefined;
     tpm_limit?: number | undefined;
     rpm_limit?: number | undefined;
     team_id?: string | undefined;
@@ -47,6 +55,7 @@ export declare function createGenerateKeyInputSchema(config: KeyValidationConfig
     models?: string[] | undefined;
     duration?: string | undefined;
     max_budget?: number | null | undefined;
+    budget_duration?: string | undefined;
     tpm_limit?: number | undefined;
     rpm_limit?: number | undefined;
     team_id?: string | undefined;
@@ -86,3 +95,7 @@ export type UpdateKeyInput = z.infer<ReturnType<typeof createUpdateKeyInputSchem
  * Default key duration presets. Used as server-side defaults and UI options.
  */
 export declare const DEFAULT_KEY_DURATIONS: string[];
+/**
+ * Default `budget_duration` values a key may be generated with.
+ */
+export declare const DEFAULT_KEY_BUDGET_DURATIONS: string[];

package/dist/keySchemas.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_KEY_DURATIONS = exports.RESERVED_METADATA_KEYS = void 0;
+exports.DEFAULT_KEY_BUDGET_DURATIONS = exports.DEFAULT_KEY_DURATIONS = exports.RESERVED_METADATA_KEYS = void 0;
 exports.reservedMetadataKeys = reservedMetadataKeys;
 exports.createGenerateKeyInputSchema = createGenerateKeyInputSchema;
 exports.createUpdateKeyInputSchema = createUpdateKeyInputSchema;
@@ -36,6 +36,14 @@ function createGenerateKeyInputSchema(config) {
         : zod_1.z.string().regex(/^\d+[smhdwy]$/, {
             message: 'duration must match format <number><unit> (e.g. "30d", "1h")',
         });
+    const budgetDurations = config.allowedBudgetDurations ?? exports.DEFAULT_KEY_BUDGET_DURATIONS;
+    const budgetDurationSchema = budgetDurations.length > 0
+        ? zod_1.z.string().refine((val) => budgetDurations.includes(val), {
+            message: `budget_duration must be one of: ${budgetDurations.join(', ')}`,
+        })
+        : zod_1.z.string().regex(/^\d+(s|m|h|d|mo)$/, {
+            message: 'budget_duration must match format <number><unit> (e.g. "30d", "1mo")',
+        });
     return zod_1.z
         .object({
         alias: zod_1.z
@@ -54,6 +62,7 @@ function createGenerateKeyInputSchema(config) {
             .max(config.maxBudget, `max_budget must not exceed ${config.maxBudget}`)
             .nullable()
             .optional(),
+        budget_duration: budgetDurationSchema.optional(),
         tpm_limit: zod_1.z
             .number()
             .int('tpm_limit must be an integer')
@@ -124,3 +133,7 @@ function createUpdateKeyInputSchema(config) {
  * Default key duration presets. Used as server-side defaults and UI options.
  */
 exports.DEFAULT_KEY_DURATIONS = ['1d', '7d', '30d', '90d'];
+/**
+ * Default `budget_duration` values a key may be generated with.
+ */
+exports.DEFAULT_KEY_BUDGET_DURATIONS = ['1d', '7d', '30d', '1mo'];

package/dist/permissions.d.ts

@@ -10,4 +10,10 @@ export declare const litellmTeamMembersManagePermission: import("@backstage/plug
 export declare const litellmTeamKnowledgebaseManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
 export declare const litellmTeamMcpManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
 export declare const litellmTeamDeletePermission: import("@backstage/plugin-permission-common").BasicPermission;
+/**
+ * Read the per-member usage breakdown of a team the caller belongs to.
+ * Only consulted when `litellm.teamUsage.memberBreakdown.enabled` is true and
+ * the permission framework is enabled.
+ */
+export declare const litellmTeamUsageReadPermission: import("@backstage/plugin-permission-common").BasicPermission;
 export declare const litellmPermissions: import("@backstage/plugin-permission-common").BasicPermission[];

package/dist/permissions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.litellmPermissions = exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyUnblockPermission = exports.litellmKeyResetSpendPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = void 0;
+exports.litellmPermissions = exports.litellmTeamUsageReadPermission = exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyUnblockPermission = exports.litellmKeyResetSpendPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = void 0;
 const plugin_permission_common_1 = require("@backstage/plugin-permission-common");
 exports.litellmKeyCreatePermission = (0, plugin_permission_common_1.createPermission)({
     name: 'litellm.key.create',
@@ -51,6 +51,15 @@ exports.litellmTeamDeletePermission = (0, plugin_permission_common_1.createPermi
     name: 'litellm.team.delete',
     attributes: { action: 'delete' },
 });
+/**
+ * Read the per-member usage breakdown of a team the caller belongs to.
+ * Only consulted when `litellm.teamUsage.memberBreakdown.enabled` is true and
+ * the permission framework is enabled.
+ */
+exports.litellmTeamUsageReadPermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.usage.read',
+    attributes: { action: 'read' },
+});
 exports.litellmPermissions = [
     exports.litellmKeyCreatePermission,
     exports.litellmKeyRevokePermission,
@@ -64,4 +73,5 @@ exports.litellmPermissions = [
     exports.litellmTeamKnowledgebaseManagePermission,
     exports.litellmTeamMcpManagePermission,
     exports.litellmTeamDeletePermission,
+    exports.litellmTeamUsageReadPermission,
 ];

package/dist/types.d.ts

@@ -145,6 +145,40 @@ export interface UsageMetrics {
     daily_usage: UsageDailyPoint[];
     daily_by_model: UsageDailyModelPoint[];
 }
+/** One member's share of a team's usage over a period. */
+export interface TeamMemberUsageRow {
+    /** LiteLLM user id; null groups activity no current key owner accounts for (deleted or ownerless keys). */
+    user_id: string | null;
+    user_email?: string;
+    /** From the Backstage catalog when a User entity has the member's email. */
+    display_name?: string;
+    /** LiteLLM team role, when the user is a team member. */
+    role?: string;
+    /** USD; 0 when `budget_hidden` is set on the response. */
+    spend: number;
+    /** Share of the team's spend in the period, 0–100. */
+    spend_share_pct: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+    /** successful / (successful + failed) as 0–100; null without requests. */
+    success_rate: number | null;
+    /** Team keys the user owns. */
+    key_count: number;
+}
+/** Response of `GET /teams/:teamId/usage/members`. */
+export interface TeamMemberUsage {
+    team_id: string;
+    /** USD; 0 when `budget_hidden` is set. */
+    total_spend: number;
+    /** Dollars are hidden for the caller: compare members by `spend_share_pct`. */
+    budget_hidden?: boolean;
+    /** Sorted by spend, highest first. */
+    members: TeamMemberUsageRow[];
+}
 export interface GenerateKeyRequest {
     alias?: string;
     models?: string[];
@@ -152,6 +186,8 @@ export interface GenerateKeyRequest {
     duration?: string;
     /** Positive number caps spend; null/undefined means unlimited. */
     max_budget?: number | null;
+    /** How often the key's spend resets, e.g. "30d" or "1mo". */
+    budget_duration?: string;
     tpm_limit?: number;
     rpm_limit?: number;
     key_type?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-common",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Shared types, permissions, and schemas for the LiteLLM Backstage plugin",
   "backstage": {
     "role": "common-library",
@@ -29,8 +29,7 @@
   "scripts": {
     "build": "node build.js && tsc -p tsconfig.json",
     "test": "tsc -p tsconfig.test.json && node --test \"dist-test/**/*.test.js\"",
-    "prepack": "npm run build",
-    "postpack": ""
+    "prepack": "npm run build"
   },
   "dependencies": {
     "@backstage/plugin-permission-common": "^0.9.10",