@homeflare/alchemy 0.23.0 → 0.24.0

package/README.md

@@ -5,7 +5,7 @@ Custom [Alchemy](https://alchemy.run) providers for gaps the vendor SDK leaves.
 ```sh
 bun add @homeflare/alchemy alchemy@2.0.0-beta.79 effect@4.0.0-rc.115 \
         @effect/platform-node@4.0.0-rc.115 cloudflare@4.5.0 mime@4.1.0 \
-        @distilled.cloud/cloudflare@1.0.0-rc.12
+        @distilled.cloud/cloudflare@1.0.0-rc.12 @effect/sql-pg@4.0.0-rc.115
 ```
 
 ⛔ **Every one of those is required, and you also need an `overrides` block** — see
@@ -206,6 +206,12 @@ with `HostFile`; `caddyProviders()` provides the transport, `http://127.0.0.1:20
 - ★ **Managed Caddies run `--resume` with their own `XDG_CONFIG_HOME`**, so a restart runs the last
   config Caddy accepted — and after one, SIGUSR1 has no file to reload. Why, and the rest: same doc.
 
+## PostgreSQL — `@homeflare/alchemy/postgres`
+
+`Postgres.Database`: create-and-assert over a self-hosted PostgreSQL 18 cluster, over
+`@effect/sql-pg` — the same client upstream's own `alchemy/SQL/Postgres` binding uses. No
+`ALTER DATABASE`, no password prop, and `delete` always refuses: [docs/postgres.md](./docs/postgres.md).
+
 ## Proxmox — `@homeflare/alchemy/proxmox`
 
 PVE and PBS objects over the PVE API, `ProxmoxLxc` for containers, and the provisioning baseline
@@ -218,6 +224,14 @@ every cluster needs first. What it never does to a guest, and why: [docs/proxmox
 against a table generated from NetBox's own OpenAPI document before the request is built.
 ⛔ Adopt-first, `retain` on removal, and read/write shapes that differ: [docs/netbox.md](./docs/netbox.md).
 
+## LiteLLM — `@homeflare/alchemy/litellm`
+
+`LiteLLM.PassThroughEndpoint` declares one route on LiteLLM's proxy that forwards to an
+upstream target, generated from LiteLLM 1.100.0's own OpenAPI document. ⛔ Every pass-through
+endpoint lives in ONE `general_settings` field (a whole-list read-modify-write), a path already
+declared in `config.yaml` is refused rather than silently overridden, and a literal secret in a
+forwarded header is refused at plan: [docs/litellm.md](./docs/litellm.md).
+
 ## GitHub — `@homeflare/alchemy/github`
 
 `declareRepoPolicy` declares one repository's merge policy and its default-branch ruleset in a

package/dist/litellm/client.d.ts

@@ -0,0 +1,76 @@
+import * as Effect from 'effect/Effect';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
+import { LitellmCredentials, type LitellmCredentialsError } from './credentials.ts';
+import type { PassThroughGenericEndpoint } from './generated/pass-through.ts';
+export type LitellmRequirements = HttpClient.HttpClient | LitellmCredentials;
+/**
+ * The `litellm:<METHOD> <path>` operations this package writes to and reads from.
+ *
+ * ★ `codegen/litellm.ts` scans this FILE's text for these exact literals to pick which of
+ *   LiteLLM 1.100.0's 696 paths to generate types from (codegen/litellm.ts header). Keep each one
+ *   a literal string on one line; the generator matches text, it does not evaluate the object.
+ */
+export declare const LITELLM_OPERATIONS: {
+    readonly create: 'litellm:POST /config/pass_through_endpoint';
+    readonly delete: 'litellm:DELETE /config/pass_through_endpoint';
+    readonly list: 'litellm:GET /config/pass_through_endpoint';
+    readonly update: 'litellm:POST /config/pass_through_endpoint/{endpoint_id}';
+};
+declare const LitellmUnauthorizedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmUnauthorizedError";
+} & Readonly<A>;
+export declare class LitellmUnauthorizedError extends LitellmUnauthorizedError_base<{
+    readonly status: number;
+    readonly method: string;
+    readonly path: string;
+}> {
+}
+declare const LitellmBadRequestError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmBadRequestError";
+} & Readonly<A>;
+export declare class LitellmBadRequestError extends LitellmBadRequestError_base<{
+    readonly method: string;
+    readonly path: string;
+    readonly detail: string;
+}> {
+}
+declare const LitellmHttpError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmHttpError";
+} & Readonly<A>;
+export declare class LitellmHttpError extends LitellmHttpError_base<{
+    readonly status: number;
+    readonly method: string;
+    readonly path: string;
+    readonly detail: string;
+}> {
+}
+declare const LitellmTransportError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmTransportError";
+} & Readonly<A>;
+export declare class LitellmTransportError extends LitellmTransportError_base<{
+    readonly method: string;
+    readonly path: string;
+    readonly cause: string;
+}> {
+}
+export type LitellmError = LitellmUnauthorizedError | LitellmBadRequestError | LitellmHttpError | LitellmTransportError | LitellmCredentialsError;
+/** GET /config/pass_through_endpoint — every row, config-file and DB alike. Not under the semaphore: reads don't race the field. */
+export declare const listPassThroughEndpoints: () => Effect.Effect<readonly PassThroughGenericEndpoint[], LitellmError, LitellmRequirements>;
+/** POST /config/pass_through_endpoint. `body` carries `id` — see pass-through-endpoint.ts. */
+export declare const createPassThroughEndpoint: (body: PassThroughGenericEndpoint) => Effect.Effect<void, LitellmError, LitellmRequirements>;
+/** POST /config/pass_through_endpoint/{endpoint_id}. Merges with `exclude_none` — see pass-through-form.ts. */
+export declare const updatePassThroughEndpoint: (endpointId: string, body: Partial<PassThroughGenericEndpoint>) => Effect.Effect<void, LitellmError, LitellmRequirements>;
+/**
+ * DELETE /config/pass_through_endpoint?endpoint_id=… — idempotent BY THIS FUNCTION, not by the
+ * vendor. ⚠️ Measured at v1.100.0: deleting an id the list does not have raises `HTTPException(400)`
+ * from `pass_through_endpoint_delete` — but the SAME route also 400s `not_allowed_access` for a
+ * non-PROXY_ADMIN caller or a disconnected DB (`update_config_general_settings`,
+ * proxy_server.py:16389-16416), on a row that never got deleted. A 400 alone cannot tell the two
+ * apart, so THIS FUNCTION DOESN'T GUESS FROM THE STATUS ALONE: on 400 it re-lists (a GET — no
+ * PROXY_ADMIN required, proxy_server.py:3245-3251) and only treats the delete as already-done if
+ * `endpointId` is genuinely absent; otherwise the delete failed and this re-fails with the ORIGINAL
+ * error, not a message match (S21 — a status-and-a-real-read decision, never body text).
+ */
+export declare const deletePassThroughEndpoint: (endpointId: string) => Effect.Effect<void, LitellmError, LitellmRequirements>;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/litellm/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/litellm/client.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,6BAA6B,CAAC;AAErC,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,UAAU,GAAG,kBAAkB,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;aAC7B,MAAM,EAAE,4CAA4C;aACpD,MAAM,EAAE,8CAA8C;aACtD,IAAI,EAAE,2CAA2C;aACjD,MAAM,EAAE,0DAA0D;CAC1D,CAAC;;;;AAEX,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;CAAG;;;;AACL,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;;;;AACL,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;;;;AACL,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;CAAG;AAEL,MAAM,MAAM,YAAY,GACpB,wBAAwB,GACxB,sBAAsB,GACtB,gBAAgB,GAChB,qBAAqB,GACrB,uBAAuB,CAAC;AAwD5B,oIAAoI;AACpI,eAAO,MAAM,wBAAwB,QAAO,MAAM,CAAC,MAAM,CACvD,SAAS,0BAA0B,EAAE,EACrC,YAAY,EACZ,mBAAmB,CAIlB,CAAC;AASJ,8FAA8F;AAC9F,eAAO,MAAM,yBAAyB,SAC9B,0BAA0B,KAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,CACK,CAAC;AAE9D,+GAA+G;AAC/G,eAAO,MAAM,yBAAyB,eACxB,MAAM,QACZ,OAAO,CAAC,0BAA0B,CAAC,KACxC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,CACuC,CAAC;AAEhG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eACxB,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,CAcrD,CAAC"}

package/dist/litellm/credentials.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The lazy Auth service every LiteLLM call reads from, and nothing else reads the environment.
+ *
+ * ★ LITELLM'S OWN VARIABLE NAMES, NOT A HOUSE CHOICE. `LITELLM_PROXY_URL` and
+ *   `LITELLM_PROXY_API_KEY` are what LiteLLM's own CLI client reads
+ *   (litellm/proxy/client/cli/main.py:70,78 at tag v1.100.0) — using the vendor's own names means
+ *   a consumer who already has a `.env` for the `litellm` CLI needs nothing new for this package.
+ * ⛔ NO DEFAULT URL. A published package that fell back to a loopback address would let a
+ *   consumer who forgot the variable watch every call fail against a proxy that is not theirs,
+ *   instead of being told which variable is missing (S24/S25 — the house rule, not a vendor one).
+ * ⛔ THE KEY IS NEVER A PROP. Alchemy persists attributes unencrypted (S25); the master key that
+ *   `update_config_general_settings` requires (PROXY_ADMIN only, proxy_server.py:16411 at the
+ *   tag) is read fresh from the environment on every call, never stored in state.
+ * ★ LAZY: the service's VALUE is an `Effect` that resolves the credential, not the credential
+ *   itself — so a layer built once still reads the environment inside each operation
+ *   (`yield* yield* LitellmCredentials`), the idiom `alchemy/Auth`'s custom-auth-provider guide
+ *   describes for a credential a layer must not capture at build time.
+ */
+import * as Context from 'effect/Context';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+export declare const LITELLM_PROXY_URL_ENV = "LITELLM_PROXY_URL";
+export declare const LITELLM_PROXY_API_KEY_ENV = "LITELLM_PROXY_API_KEY";
+export interface LitellmCreds {
+    /** Trailing slash stripped. No default — see the header. */
+    readonly baseUrl: string;
+    /** LiteLLM's master (or a PROXY_ADMIN) key. Never logged, never an attribute. */
+    readonly apiKey: string;
+}
+declare const LitellmCredentialsError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmCredentialsError";
+} & Readonly<A>;
+export declare class LitellmCredentialsError extends LitellmCredentialsError_base<{
+    readonly message: string;
+}> {
+}
+/** Read at call time. Exported so a test can call it directly against `process.env`. */
+export declare const resolveCreds: Effect.Effect<LitellmCreds, LitellmCredentialsError>;
+declare const LitellmCredentials_base: Context.ServiceClass<LitellmCredentials, "homeflare/litellm/Credentials", Effect.Effect<LitellmCreds, LitellmCredentialsError, never>>;
+/** The Effect service a LiteLLM operation reads: `yield* yield* LitellmCredentials`. */
+export declare class LitellmCredentials extends LitellmCredentials_base {
+}
+/** The default layer: resolves from the environment, fresh, on every `yield*`. */
+export declare const litellmCredentialsLayer: Layer.Layer<LitellmCredentials>;
+/** For a test: a fixed credential, never touching the environment. */
+export declare const litellmCredentialsLayerFor: (creds: LitellmCreds) => Layer.Layer<LitellmCredentials>;
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/litellm/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/litellm/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;;;;AAED,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AASL,wFAAwF;AACxF,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,uBAAuB,CAW7E,CAAC;;AAEF,wFAAwF;AACxF,qBAAa,kBAAmB,SAAQ,uBAGJ;CAAG;AAEvC,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAGnE,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,0BAA0B,UAAW,YAAY,KAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CACrC,CAAC"}

package/dist/litellm/fake-litellm.d.ts

@@ -0,0 +1,36 @@
+/**
+ * A loopback `Bun.serve` fake of LiteLLM's `/config/pass_through_endpoint` routes — TEST ONLY,
+ * never imported by `index.ts` (the netbox/proxmox house convention for test-only helpers).
+ *
+ * ★ MODELS THE WHOLE-FIELD READ-MODIFY-WRITE ON PURPOSE. `general_settings.pass_through_endpoints`
+ *   is ONE field (client.ts's header), so every mutation here reads the CURRENT row list, waits
+ *   (so two concurrent requests can interleave), then writes back what it captured — not what is
+ *   there by the time it writes. Two `create` calls that race lose one row, exactly like the
+ *   vendor field would without the client's per-base-URL semaphore serialising them.
+ * ⚠️ WHAT THIS FAKE DOES NOT MODEL: PROXY_ADMIN vs. a lesser role for most routes (any correct
+ *   bearer token is accepted); and update-of-a-missing-id, which is not measured at the tag — this
+ *   fake 400s it, the same status a missing delete gets, as a documented TEST SIMPLIFICATION, not a
+ *   vendor fact (docs/litellm.md says so too). `forbidDelete` is the one exception: it models the
+ *   real asymmetry client.ts's header describes — `DELETE` routes through
+ *   `update_config_general_settings`, which 400s `not_allowed_access` for a non-PROXY_ADMIN caller
+ *   (or a disconnected DB) on a row that is genuinely still live, the SAME status a missing-id
+ *   delete gets (proxy_server.py:16389-16416 at v1.100.0).
+ */
+import type { PassThroughGenericEndpoint } from './generated/pass-through.ts';
+export interface FakeRequest {
+    readonly method: string;
+    readonly path: string;
+}
+export interface FakeLitellm {
+    readonly url: string;
+    readonly rows: () => readonly PassThroughGenericEndpoint[];
+    readonly requests: () => readonly FakeRequest[];
+    readonly stop: () => void;
+}
+export declare const startFakeLitellm: (options?: {
+    readonly masterKey?: string;
+    readonly seed?: readonly PassThroughGenericEndpoint[];
+    /** Every `DELETE` 400s `not_allowed_access`, whether or not the row exists — see the file header. */
+    readonly forbidDelete?: boolean;
+}) => FakeLitellm;
+//# sourceMappingURL=fake-litellm.d.ts.map

package/dist/litellm/fake-litellm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,0BAA0B,EAAE,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,WAAW,EAAE,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC3B;AAKD,eAAO,MAAM,gBAAgB,aAAc;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,qGAAqG;IACrG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,KAAG,WAyEH,CAAC"}

package/dist/litellm/fake-stack.d.ts

@@ -0,0 +1,30 @@
+import * as Effect from 'effect/Effect';
+import { type LitellmCreds } from './credentials.ts';
+/** The planned action for each resource, deletions included, keyed by FQN. */
+export type Planned = Readonly<Record<string, string>>;
+/** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
+export type StackBody = Effect.Effect<unknown, unknown, unknown>;
+/** What the CLI would set for one deploy: `adopt` is `--adopt` (the AdoptPolicy service). */
+export type DeployOptions = {
+    readonly adopt?: boolean;
+};
+export interface FakeStack {
+    /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
+    readonly deploy: (body: StackBody, options?: DeployOptions) => Promise<Planned>;
+}
+/**
+ * ⚠️ CREDENTIALS/HTTPCLIENT ARE PROVIDED AROUND `deploy`, NOT BAKED INTO THE PROVIDER LAYER.
+ *   `Provider.effect`'s own construction effect is `Effect.succeed(...)` (pass-through-endpoint.ts)
+ *   — it never actually reads `LitellmCredentials`/`HttpClient`; only the HANDLERS it returns do,
+ *   and those run later, whenever `Apply.ts` calls `provider.reconcile`/`read`/`delete`. Effect
+ *   resolves a `yield*`'s service from whatever ambient context wraps the CALL SITE, so the layers
+ *   those handlers need must wrap the whole plan+apply pipeline below, exactly where openbao's
+ *   fake-stack.ts wraps `BaoEnv` around its own `deploy`.
+ */
+export declare const fakeStack: (creds: LitellmCreds, name?: string) => FakeStack;
+/** Every call that changed something, as `METHOD path`, in order. */
+export declare const writesOf: (requests: readonly {
+    readonly method: string;
+    readonly path: string;
+}[]) => string[];
+//# sourceMappingURL=fake-stack.d.ts.map

package/dist/litellm/fake-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-stack.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,YAAY,EAA8B,MAAM,kBAAkB,CAAC;AAGjF,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAiBD;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,UAAW,YAAY,oBAA8B,SAgC1E,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,aACT,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KACtE,MAAM,EACsF,CAAC"}

package/dist/litellm/generated/pass-through.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Generated from LiteLLM 1.100.0's OpenAPI document -- DO NOT EDIT BY HAND.
+ *
+ * Run: bun codegen/litellm.ts    (`--check` compares without writing)
+ * Manifest entry: `litellm-openapi` -- LiteLLM Proxy (app.openapi()) 1.100.0
+ *   sha256 1b3e4d23da6aea92..., read from codegen/manifest.json's own note on how this document
+ *   was produced (the vendor's own generator, cross-checked byte-identically — not a live read).
+ *
+ * Covers the 4 pass-through operations this package writes to:
+ *   litellm:DELETE /config/pass_through_endpoint
+ *   litellm:GET /config/pass_through_endpoint
+ *   litellm:POST /config/pass_through_endpoint
+ *   litellm:POST /config/pass_through_endpoint/{endpoint_id}
+ *
+ * Does NOT cover the other 692 paths LiteLLM 1.100.0 publishes — this generator is
+ * consumer-driven (codegen/litellm.ts), not exhaustive. See codegen/README.md.
+ */
+export interface PassThroughEndpointResponse {
+    readonly endpoints: readonly PassThroughGenericEndpoint[];
+}
+export interface PassThroughGenericEndpoint {
+    /**
+     * Whether authentication is required for the pass-through endpoint. Defaults to True so a pass-through silently created without an explicit value still requires a valid LiteLLM API key — set to False only if the endpoint is meant to be a public forwarder (e.g. an unauthenticated webhook target).
+     * @default true
+     */
+    readonly auth?: boolean;
+    /**
+     * The USD cost per request to the target endpoint. This is used to calculate the cost of the request to the target endpoint.
+     * @default 0
+     */
+    readonly cost_per_request?: number;
+    /**
+     * Key-value pairs of default query parameters to be sent with every request to this endpoint. These can be overridden by client-provided query parameters. For example: {'key': 'default_value', 'api_version': '2023-01'}
+     * @default {}
+     */
+    readonly default_query_params?: Record<string, unknown>;
+    /** Guardrails configuration for this passthrough endpoint. Dict keys are guardrail names, values are optional settings for field targeting. When set, all org/team/key level guardrails will also execute. Defaults to None (no guardrails execute). */
+    readonly guardrails?: Record<string, PassThroughGuardrailSettings | null> | null;
+    /**
+     * Key-value pairs of headers to be forwarded with the request. You can set any key value pair here and it will be forwarded to your target endpoint
+     * @default {}
+     */
+    readonly headers?: Record<string, unknown>;
+    /** Optional unique identifier for the pass-through endpoint. If not provided, endpoints will be identified by path for backwards compatibility. */
+    readonly id?: string | null;
+    /**
+     * If True, requests to subpaths of the path will be forwarded to the target endpoint. For example, if the path is /bria and include_subpath is True, requests to /bria/v1/text-to-image/base/2.3 will be forwarded to the target endpoint.
+     * @default false
+     */
+    readonly include_subpath?: boolean;
+    /**
+     * True if this endpoint is defined in the config file, False if from DB. Config-defined endpoints cannot be edited via the UI.
+     * @default false
+     */
+    readonly is_from_config?: boolean;
+    /** List of HTTP methods this endpoint handles (e.g., ['GET', 'POST']). If None or empty, all methods (GET, POST, PUT, DELETE, PATCH) are supported for backward compatibility. This allows the same path to have different targets for different HTTP methods. */
+    readonly methods?: readonly string[] | null;
+    /** The route to be added to the LiteLLM Proxy Server. */
+    readonly path: string;
+    /** The URL to which requests for this path should be forwarded. */
+    readonly target: string;
+    /** Upstream request timeout in seconds for this pass-through endpoint. If unset, uses general_settings.pass_through_request_timeout (default 600). */
+    readonly timeout?: number | null;
+}
+export interface PassThroughGuardrailSettings {
+    /** JSONPath expressions for input field targeting (pre_call). Examples: 'query', 'documents[*].text', 'messages[*].content'. If not specified, guardrail runs on entire request payload. */
+    readonly request_fields?: readonly string[] | null;
+    /** JSONPath expressions for output field targeting (post_call). Examples: 'results[*].text', 'output'. If not specified, guardrail runs on entire response payload. */
+    readonly response_fields?: readonly string[] | null;
+}
+//# sourceMappingURL=pass-through.d.ts.map

package/dist/litellm/generated/pass-through.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pass-through.d.ts","sourceRoot":"","sources":["../../../src/litellm/generated/pass-through.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAC3D;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,wPAAwP;IACxP,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACjF;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,kQAAkQ;IAClQ,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sJAAsJ;IACtJ,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,4LAA4L;IAC5L,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACnD,uKAAuK;IACvK,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACrD"}

package/dist/litellm/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * LiteLLM providers for Alchemy.
+ *
+ * ⛔ THIS BARREL IS THE PUBLIC API, deliberately smaller than the directory — `fake-litellm.ts`
+ *   and the internals `pass-through-form.ts`/`client.ts` need but a consumer should not depend on
+ *   directly are not re-exported here (netbox/index.ts's own rule).
+ */
+export { LITELLM_PROXY_API_KEY_ENV, LITELLM_PROXY_URL_ENV, LitellmCredentials, type LitellmCreds, LitellmCredentialsError, litellmCredentialsLayer, litellmCredentialsLayerFor, } from './credentials.ts';
+export { LITELLM_OPERATIONS, LitellmBadRequestError, type LitellmError, LitellmHttpError, type LitellmRequirements, LitellmTransportError, LitellmUnauthorizedError, } from './client.ts';
+export type { PassThroughEndpointResponse, PassThroughGenericEndpoint, PassThroughGuardrailSettings, } from './generated/pass-through.ts';
+export { LiteLLMPassThroughEndpoint, LiteLLMPassThroughEndpointProvider, LitellmConfigPathConflictError, LitellmLiteralSecretHeaderError, LitellmUnaddressableRowError, isLiteLLMPassThroughEndpoint, type PassThroughEndpointAttributes, type PassThroughEndpointError, type PassThroughEndpointProps, } from './pass-through-endpoint.ts';
+export { litellmProviders } from './providers.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/litellm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/litellm/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,YAAY,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,EAClC,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/litellm/index.js

@@ -0,0 +1,270 @@
+// src/litellm/credentials.ts
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+var LITELLM_PROXY_URL_ENV = "LITELLM_PROXY_URL";
+var LITELLM_PROXY_API_KEY_ENV = "LITELLM_PROXY_API_KEY";
+
+class LitellmCredentialsError extends Data.TaggedError("LitellmCredentialsError") {
+}
+var missing = (name) => new LitellmCredentialsError({
+  message: `${name} is not set. Export it — the same variable LiteLLM's own \`litellm\` CLI ` + "reads — before running a stack that declares a LiteLLM.PassThroughEndpoint."
+});
+var resolveCreds = Effect.gen(function* () {
+  const rawUrl = process.env[LITELLM_PROXY_URL_ENV];
+  if (rawUrl === undefined || rawUrl.trim() === "")
+    return yield* Effect.fail(missing(LITELLM_PROXY_URL_ENV));
+  const rawKey = process.env[LITELLM_PROXY_API_KEY_ENV];
+  if (rawKey === undefined || rawKey.trim() === "") {
+    return yield* Effect.fail(missing(LITELLM_PROXY_API_KEY_ENV));
+  }
+  return { baseUrl: rawUrl.trim().replace(/\/$/, ""), apiKey: rawKey.trim() };
+});
+
+class LitellmCredentials extends Context.Service()("homeflare/litellm/Credentials") {
+}
+var litellmCredentialsLayer = Layer.succeed(LitellmCredentials, resolveCreds);
+var litellmCredentialsLayerFor = (creds) => Layer.succeed(LitellmCredentials, Effect.succeed(creds));
+// src/litellm/client.ts
+import * as Data2 from "effect/Data";
+import * as Effect2 from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as Semaphore from "effect/Semaphore";
+var LITELLM_OPERATIONS = {
+  create: "litellm:POST /config/pass_through_endpoint",
+  delete: "litellm:DELETE /config/pass_through_endpoint",
+  list: "litellm:GET /config/pass_through_endpoint",
+  update: "litellm:POST /config/pass_through_endpoint/{endpoint_id}"
+};
+
+class LitellmUnauthorizedError extends Data2.TaggedError("LitellmUnauthorizedError") {
+}
+
+class LitellmBadRequestError extends Data2.TaggedError("LitellmBadRequestError") {
+}
+
+class LitellmHttpError extends Data2.TaggedError("LitellmHttpError") {
+}
+
+class LitellmTransportError extends Data2.TaggedError("LitellmTransportError") {
+}
+var semaphores = new Map;
+var semaphoreFor = (baseUrl) => Effect2.sync(() => {
+  const existing = semaphores.get(baseUrl);
+  if (existing !== undefined)
+    return existing;
+  const created = Semaphore.makeUnsafe(1);
+  semaphores.set(baseUrl, created);
+  return created;
+});
+var call = (method, path, body) => Effect2.gen(function* () {
+  const creds = yield* yield* LitellmCredentials;
+  const client = yield* HttpClient.HttpClient;
+  const url = `${creds.baseUrl}${path}`;
+  const request = HttpClientRequest.make(method)(url).pipe(HttpClientRequest.setHeaders({
+    Accept: "application/json",
+    Authorization: `Bearer ${creds.apiKey}`
+  }), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
+  const response = yield* client.execute(request).pipe(Effect2.mapError((cause) => new LitellmTransportError({ cause: String(cause), method, path })));
+  const text = yield* response.text.pipe(Effect2.mapError((cause) => new LitellmTransportError({ cause: String(cause), method, path })));
+  if (response.status === 401 || response.status === 403) {
+    return yield* Effect2.fail(new LitellmUnauthorizedError({ method, path, status: response.status }));
+  }
+  if (response.status === 400) {
+    return yield* Effect2.fail(new LitellmBadRequestError({ detail: text.slice(0, 300), method, path }));
+  }
+  if (response.status < 200 || response.status >= 300) {
+    return yield* Effect2.fail(new LitellmHttpError({ detail: text.slice(0, 300), method, path, status: response.status }));
+  }
+  return text === "" ? undefined : JSON.parse(text);
+});
+var listPassThroughEndpoints = () => call("GET", "/config/pass_through_endpoint").pipe(Effect2.map((body) => body.endpoints));
+var mutate = (io) => Effect2.gen(function* () {
+  const creds = yield* yield* LitellmCredentials;
+  const semaphore = yield* semaphoreFor(creds.baseUrl);
+  return yield* semaphore.withPermits(1)(io);
+});
+var createPassThroughEndpoint = (body) => mutate(call("POST", "/config/pass_through_endpoint", body));
+var updatePassThroughEndpoint = (endpointId, body) => mutate(call("POST", `/config/pass_through_endpoint/${encodeURIComponent(endpointId)}`, body));
+var deletePassThroughEndpoint = (endpointId) => mutate(call("DELETE", `/config/pass_through_endpoint?endpoint_id=${encodeURIComponent(endpointId)}`).pipe(Effect2.catchTag("LitellmBadRequestError", (original) => Effect2.gen(function* () {
+  const rows = yield* listPassThroughEndpoints();
+  if (rows.some((row) => row.id === endpointId))
+    return yield* Effect2.fail(original);
+})), Effect2.asVoid));
+// src/litellm/pass-through-endpoint.ts
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import * as Data3 from "effect/Data";
+import * as Effect3 from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+
+// src/litellm/pass-through-form.ts
+import { deepEqual } from "alchemy/Diff";
+var settled = (props) => ({
+  auth: props.auth ?? true,
+  cost_per_request: props.cost_per_request ?? 0,
+  default_query_params: props.default_query_params ?? {},
+  headers: props.headers ?? {},
+  include_subpath: props.include_subpath ?? false
+});
+var NULLABLE_FIELDS = ["timeout", "methods", "guardrails"];
+var isUnset = (value) => value === undefined || value === null;
+var prune = (value) => Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
+var createBody = (props, id) => prune({
+  ...settled(props),
+  guardrails: isUnset(props.guardrails) ? undefined : props.guardrails,
+  id,
+  methods: isUnset(props.methods) ? undefined : props.methods,
+  path: props.path,
+  target: props.target,
+  timeout: isUnset(props.timeout) ? undefined : props.timeout
+});
+var updateBody = (props) => prune({
+  ...settled(props),
+  guardrails: isUnset(props.guardrails) ? undefined : props.guardrails,
+  methods: isUnset(props.methods) ? undefined : props.methods,
+  path: props.path,
+  target: props.target,
+  timeout: isUnset(props.timeout) ? undefined : props.timeout
+});
+var needsReplace = (live, props) => NULLABLE_FIELDS.some((field) => !isUnset(live[field]) && isUnset(props[field]));
+var matches = (live, props) => {
+  const fixed = settled(props);
+  return live.target === props.target && live.auth === fixed.auth && live.cost_per_request === fixed.cost_per_request && live.include_subpath === fixed.include_subpath && deepEqual(live.headers, fixed.headers) && deepEqual(live.default_query_params, fixed.default_query_params) && (isUnset(props.timeout) ? isUnset(live.timeout) : live.timeout === props.timeout) && (isUnset(props.methods) ? isUnset(live.methods) : deepEqual(live.methods, props.methods)) && (isUnset(props.guardrails) ? isUnset(live.guardrails) : deepEqual(live.guardrails, props.guardrails));
+};
+var SECRET_HEADER_NAMES = new Set(["authorization", "x-api-key", "cf-aig-authorization"]);
+var literalSecretHeaders = (headers) => Object.entries(headers ?? {}).filter(([name, value]) => SECRET_HEADER_NAMES.has(name.toLowerCase()) && !String(value).includes("os.environ/")).map(([name]) => name);
+
+// src/litellm/pass-through-endpoint.ts
+class LitellmConfigPathConflictError extends Data3.TaggedError("LitellmConfigPathConflictError") {
+}
+
+class LitellmUnaddressableRowError extends Data3.TaggedError("LitellmUnaddressableRowError") {
+}
+
+class LitellmLiteralSecretHeaderError extends Data3.TaggedError("LitellmLiteralSecretHeaderError") {
+}
+var LiteLLMPassThroughEndpoint = Resource("LiteLLM.PassThroughEndpoint");
+var isLiteLLMPassThroughEndpoint = (value) => Predicate.hasProperty(value, "Type") && value.Type === "LiteLLM.PassThroughEndpoint";
+var toAttributes = (row, fallbackId) => ({
+  ...row,
+  id: row.id ?? fallbackId
+});
+var physicalIdOf = (logicalId, instanceId) => createPhysicalName({ id: logicalId, instanceId, lowercase: true, maxLength: 64 });
+var locate = (rows, objectId, path) => {
+  const mine = rows.find((row) => row.id === objectId);
+  const conflict = mine === undefined ? rows.find((row) => row.path === path) : undefined;
+  return { conflict, mine };
+};
+var conflictRefusal = (conflict, path) => conflict.is_from_config === true ? new LitellmConfigPathConflictError({ path }) : new LitellmUnaddressableRowError({ path });
+var readConflict = (conflict, path) => conflict.is_from_config !== true && conflict.id !== undefined && conflict.id !== null ? Effect3.succeed(Unowned(toAttributes(conflict, conflict.id))) : Effect3.fail(conflictRefusal(conflict, path));
+var refuseLiteralSecrets = (headers) => {
+  const bad = literalSecretHeaders(headers);
+  return bad.length === 0 ? Effect3.void : Effect3.fail(new LitellmLiteralSecretHeaderError({ headers: bad }));
+};
+var passThroughHandlers = {
+  read: ({
+    id,
+    instanceId,
+    olds,
+    output
+  }) => Effect3.gen(function* () {
+    const objectId = output?.id ?? (yield* physicalIdOf(id, instanceId));
+    const rows = yield* listPassThroughEndpoints();
+    const { conflict, mine } = locate(rows, objectId, olds.path);
+    if (mine !== undefined)
+      return toAttributes(mine, objectId);
+    if (conflict === undefined)
+      return;
+    return yield* readConflict(conflict, olds.path);
+  }),
+  diff: ({
+    news,
+    output
+  }) => Effect3.gen(function* () {
+    if (!isResolved(news))
+      return;
+    yield* refuseLiteralSecrets(news.headers);
+    if (output === undefined)
+      return;
+    if (needsReplace(output, news))
+      return { action: "replace", deleteFirst: true };
+    return matches(output, news) ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({
+    id,
+    instanceId,
+    news,
+    output
+  }) => Effect3.gen(function* () {
+    yield* refuseLiteralSecrets(news.headers);
+    const objectId = output?.id ?? (yield* physicalIdOf(id, instanceId));
+    const rows = yield* listPassThroughEndpoints();
+    const { conflict, mine } = locate(rows, objectId, news.path);
+    if (mine === undefined) {
+      if (conflict !== undefined)
+        return yield* Effect3.fail(conflictRefusal(conflict, news.path));
+      yield* createPassThroughEndpoint(createBody(news, objectId));
+    } else if (mine.is_from_config === true) {
+      return yield* Effect3.fail(new LitellmConfigPathConflictError({ path: news.path }));
+    } else if (needsReplace(toAttributes(mine, objectId), news)) {
+      yield* deletePassThroughEndpoint(objectId);
+      yield* createPassThroughEndpoint(createBody(news, objectId));
+    } else if (!matches(toAttributes(mine, objectId), news)) {
+      const body = updateBody(news);
+      if (Object.keys(body).length > 0)
+        yield* updatePassThroughEndpoint(objectId, body);
+    }
+    const after = (yield* listPassThroughEndpoints()).find((row) => row.id === objectId);
+    if (after === undefined) {
+      return yield* Effect3.die(new Error(`LiteLLM.PassThroughEndpoint ${news.path}: the write returned no error but id ` + `${objectId} is still absent from GET /config/pass_through_endpoint — read back ` + "rather than trusting the call that just returned."));
+    }
+    return toAttributes(after, objectId);
+  }),
+  delete: ({
+    id,
+    instanceId,
+    olds,
+    output
+  }) => Effect3.gen(function* () {
+    const objectId = output.id ?? (yield* physicalIdOf(id, instanceId));
+    const rows = yield* listPassThroughEndpoints();
+    const live = rows.find((row) => row.id === objectId);
+    if (live === undefined || live.is_from_config === true || live.path !== olds.path)
+      return;
+    yield* deletePassThroughEndpoint(objectId);
+  }),
+  list: () => Effect3.succeed([])
+};
+var LiteLLMPassThroughEndpointProvider = () => Provider.effect(LiteLLMPassThroughEndpoint, Effect3.succeed(LiteLLMPassThroughEndpoint.Provider.of(passThroughHandlers)));
+// src/litellm/providers.ts
+import * as Layer2 from "effect/Layer";
+var litellmProviders = (creds = litellmCredentialsLayer) => LiteLLMPassThroughEndpointProvider().pipe(Layer2.provide(creds));
+export {
+  LITELLM_OPERATIONS,
+  LITELLM_PROXY_API_KEY_ENV,
+  LITELLM_PROXY_URL_ENV,
+  LiteLLMPassThroughEndpoint,
+  LiteLLMPassThroughEndpointProvider,
+  LitellmBadRequestError,
+  LitellmConfigPathConflictError,
+  LitellmCredentials,
+  LitellmCredentialsError,
+  LitellmHttpError,
+  LitellmLiteralSecretHeaderError,
+  LitellmTransportError,
+  LitellmUnaddressableRowError,
+  LitellmUnauthorizedError,
+  isLiteLLMPassThroughEndpoint,
+  litellmCredentialsLayer,
+  litellmCredentialsLayerFor,
+  litellmProviders
+};
+
+//# debugId=9216FE33E5E3721264756E2164756E21
+//# sourceMappingURL=index.js.map