@homeflare/alchemy 0.27.4 → 0.29.0

package/src/litellm/fake-litellm.ts

@@ -1,22 +1,35 @@
 /**
- * A loopback `Bun.serve` fake of LiteLLM's `/config/pass_through_endpoint` routes — TEST ONLY,
- * never imported by `index.ts` (the netbox/proxmox house convention for test-only helpers).
+ * A fake of LiteLLM's `/config/pass_through_endpoint` routes for tests — TEST ONLY, never imported
+ * by `index.ts` (the netbox/forgejo house convention for test-only helpers). Mirrors
+ * `../netbox/fake-netbox.ts`/`../forgejo/fake-forgejo.ts`: a `fetch` function handed to Effect's
+ * real `FetchHttpClient` through its `Fetch` reference, so a test exercises distilled's REAL path
+ * assembly, JSON encode/decode and status→typed-error matching (`BadRequest`, `NotFound`, …) —
+ * nothing about that matching is re-implemented here, only the wire responses a scenario needs.
  *
  * ★ MODELS THE WHOLE-FIELD READ-MODIFY-WRITE ON PURPOSE. `general_settings.pass_through_endpoints`
- *   is ONE field (client.ts's header), so every mutation here reads the CURRENT row list, waits
- *   (so two concurrent requests can interleave), then writes back what it captured — not what is
- *   there by the time it writes. Two `create` calls that race lose one row, exactly like the
- *   vendor field would without the client's per-base-URL semaphore serialising them.
+ *   is ONE field (operations.ts's header), so every mutation here reads the CURRENT row list,
+ *   awaits (so two concurrent calls can interleave — no real socket needed, `fetch` is just an
+ *   async function the runtime awaits), then writes back what it captured — not what is there by
+ *   the time it writes. Two `create` calls that race lose one row, exactly like the vendor field
+ *   would without `operations.ts`'s per-base-URL semaphore serialising them.
  * ⚠️ WHAT THIS FAKE DOES NOT MODEL: PROXY_ADMIN vs. a lesser role for most routes (any correct
- *   bearer token is accepted); and update-of-a-missing-id, which is not measured at the tag — this
- *   fake 400s it, the same status a missing delete gets, as a documented TEST SIMPLIFICATION, not a
- *   vendor fact (docs/litellm.md says so too). `forbidDelete` is the one exception: it models the
- *   real asymmetry client.ts's header describes — `DELETE` routes through
- *   `update_config_general_settings`, which 400s `not_allowed_access` for a non-PROXY_ADMIN caller
- *   (or a disconnected DB) on a row that is genuinely still live, the SAME status a missing-id
- *   delete gets (proxy_server.py:16389-16416 at v1.100.0).
+ *   bearer token is accepted). `forbidDelete` is the one exception: it models the real asymmetry
+ *   `operations.ts`'s header describes — `DELETE` routes through `update_config_general_settings`,
+ *   which 400s `not_allowed_access` for a non-PROXY_ADMIN caller (or a disconnected DB) on a row
+ *   that is genuinely still live, the SAME status a missing-id delete gets (proxy_server.py:
+ *   16389-16416 at v1.100.0).
+ * ⚠️ UPDATE-OF-A-MISSING-ID IS 404, NOT 400 — corrected by this migration. The retired hand-rolled
+ *   fake 400'd it as "not measured at the tag, a documented test simplification". The distilled
+ *   SDK's own `patches/misc/update_pass_through_endpoints_*.json` cites the real source
+ *   (`pass_through_endpoints.py`'s `update_pass_through_endpoints` at the tag): unlike DELETE, this
+ *   route raises a genuine, unambiguous `HTTPException(404)` for a missing id, distinct from the
+ *   400 `update_config_general_settings` raises for the trailing auth/DB-disconnected write. This
+ *   fake now matches that measured vendor behaviour.
  */
-import type { PassThroughGenericEndpoint } from './generated/pass-through.ts';
+import type { PassThroughGenericEndpoint } from '@distilled.cloud/litellm/misc';
+
+/** RFC 2606 placeholder — never a real host. Shared across tests, like `../netbox/fake-netbox.ts`. */
+export const FAKE_BASE = 'https://litellm.example.com';
 
 export interface FakeRequest {
   readonly method: string;
@@ -24,15 +37,17 @@ export interface FakeRequest {
 }
 
 export interface FakeLitellm {
-  readonly url: string;
+  readonly fetch: typeof globalThis.fetch;
   readonly rows: () => readonly PassThroughGenericEndpoint[];
   readonly requests: () => readonly FakeRequest[];
-  readonly stop: () => void;
 }
 
 const RACE_WINDOW_MS = 15;
 const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
 
+const json = (status: number, body: unknown) =>
+  new Response(JSON.stringify(body), { headers: { 'content-type': 'application/json' }, status });
+
 export const startFakeLitellm = (options?: {
   readonly masterKey?: string;
   readonly seed?: readonly PassThroughGenericEndpoint[];
@@ -44,73 +59,63 @@ export const startFakeLitellm = (options?: {
   let rows: PassThroughGenericEndpoint[] = [...(options?.seed ?? [])];
   const requests: FakeRequest[] = [];
 
-  const json = (status: number, body: unknown) =>
-    new Response(JSON.stringify(body), { headers: { 'content-type': 'application/json' }, status });
+  const fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const request =
+      input instanceof Request ? new Request(input, init) : new Request(String(input), init);
+    const url = new URL(request.url);
+    requests.push({ method: request.method, path: `${url.pathname}${url.search}` });
+    const auth = request.headers.get('authorization');
+    if (auth !== `Bearer ${masterKey}`) return json(401, { detail: 'invalid api key' });
+    if (
+      url.pathname !== '/config/pass_through_endpoint' &&
+      !url.pathname.startsWith('/config/pass_through_endpoint/')
+    ) {
+      return json(404, { detail: 'not found' });
+    }
 
-  const server = Bun.serve({
-    // ⚠️ Loopback, not the wildcard default — see proxmox/fake-pve-lxc.ts for the race.
-    hostname: '127.0.0.1',
-    port: 0,
-    fetch: async (req) => {
-      const url = new URL(req.url);
-      requests.push({ method: req.method, path: url.pathname });
-      const auth = req.headers.get('authorization');
-      if (auth !== `Bearer ${masterKey}`) return json(401, { detail: 'invalid api key' });
-      if (
-        url.pathname !== '/config/pass_through_endpoint' &&
-        !url.pathname.startsWith('/config/pass_through_endpoint/')
-      ) {
-        return json(404, { detail: 'not found' });
-      }
+    if (request.method === 'GET') {
+      const endpointId = url.searchParams.get('endpoint_id');
+      const filtered = endpointId === null ? rows : rows.filter((row) => row.id === endpointId);
+      return json(200, { endpoints: filtered });
+    }
 
-      if (req.method === 'GET') {
-        const endpointId = url.searchParams.get('endpoint_id');
-        const filtered = endpointId === null ? rows : rows.filter((row) => row.id === endpointId);
-        return json(200, { endpoints: filtered });
-      }
+    if (request.method === 'POST' && url.pathname === '/config/pass_through_endpoint') {
+      const body = (await request.json()) as PassThroughGenericEndpoint;
+      const before = rows; // ★ captured before the window — the race the semaphore prevents
+      await sleep(RACE_WINDOW_MS);
+      rows = [...before, { ...body, is_from_config: false }];
+      return json(200, { body: {} });
+    }
 
-      if (req.method === 'POST' && url.pathname === '/config/pass_through_endpoint') {
-        const body = (await req.json()) as PassThroughGenericEndpoint;
-        const before = rows; // ★ captured before the window — the race the semaphore prevents
-        await sleep(RACE_WINDOW_MS);
-        rows = [...before, { ...body, is_from_config: false }];
-        return json(200, {});
-      }
-
-      if (req.method === 'POST' && url.pathname.startsWith('/config/pass_through_endpoint/')) {
-        const id = decodeURIComponent(url.pathname.slice('/config/pass_through_endpoint/'.length));
-        const patch = (await req.json()) as Partial<PassThroughGenericEndpoint>;
-        const before = rows;
-        await sleep(RACE_WINDOW_MS);
-        const index = before.findIndex((row) => row.id === id);
-        if (index === -1) return json(400, { detail: `No pass-through endpoint with id=${id}` });
-        // ⚠️ `exclude_none`-shaped: only keys the patch actually carries are merged, matching
-        //   client.ts's `updateBody` never sending an unset/null field (pass-through-form.ts).
-        const merged = { ...before[index], ...patch };
-        rows = before.map((row, i) => (i === index ? (merged as PassThroughGenericEndpoint) : row));
-        return json(200, {});
-      }
+    if (request.method === 'POST' && url.pathname.startsWith('/config/pass_through_endpoint/')) {
+      const id = decodeURIComponent(url.pathname.slice('/config/pass_through_endpoint/'.length));
+      const patch = (await request.json()) as Partial<PassThroughGenericEndpoint>;
+      const before = rows;
+      await sleep(RACE_WINDOW_MS);
+      const index = before.findIndex((row) => row.id === id);
+      // ⚠️ 404, not 400 — see the file header.
+      if (index === -1) return json(404, { detail: `Endpoint with ID '${id}' not found` });
+      // ⚠️ `exclude_none`-shaped: only keys the patch actually carries are merged, matching
+      //   operations.ts's `updateBody` never sending an unset/null field (pass-through-form.ts).
+      const merged = { ...before[index], ...patch };
+      rows = before.map((row, i) => (i === index ? (merged as PassThroughGenericEndpoint) : row));
+      return json(200, { body: {} });
+    }
 
-      if (req.method === 'DELETE' && url.pathname === '/config/pass_through_endpoint') {
-        const id = url.searchParams.get('endpoint_id');
-        if (forbidDelete) return json(400, { error: 'not_allowed_access' });
-        const before = rows;
-        await sleep(RACE_WINDOW_MS);
-        if (!before.some((row) => row.id === id)) {
-          return json(400, { detail: `No pass-through endpoint with id=${String(id)}` });
-        }
-        rows = before.filter((row) => row.id !== id);
-        return json(200, { endpoints: rows });
+    if (request.method === 'DELETE' && url.pathname === '/config/pass_through_endpoint') {
+      const id = url.searchParams.get('endpoint_id');
+      if (forbidDelete) return json(400, { error: 'not_allowed_access' });
+      const before = rows;
+      await sleep(RACE_WINDOW_MS);
+      if (!before.some((row) => row.id === id)) {
+        return json(400, { detail: `No pass-through endpoint with id=${String(id)}` });
       }
+      rows = before.filter((row) => row.id !== id);
+      return json(200, { endpoints: rows });
+    }
 
-      return json(405, { detail: `unhandled ${req.method} ${url.pathname}` });
-    },
-  });
+    return json(405, { detail: `unhandled ${request.method} ${url.pathname}` });
+  }) as typeof globalThis.fetch;
 
-  return {
-    requests: () => [...requests],
-    rows: () => [...rows],
-    stop: () => server.stop(true),
-    url: server.url.toString().replace(/\/$/, ''),
-  };
+  return { fetch, requests: () => [...requests], rows: () => [...rows] };
 };

package/src/litellm/fake-stack.ts

@@ -12,13 +12,13 @@
  * ★ NOT alchemy/Test/Bun — same reasoning as openbao/fake-stack.ts: no CLI profile/credentials
  *   files, no file logger. Just the provider, an in-memory state store, and the stack's services.
  */
+import { credentials } from '@distilled.cloud/litellm/Credentials';
 import * as Alchemy from 'alchemy';
 import { AdoptPolicy } from 'alchemy/AdoptPolicy';
 import { provideFreshArtifactStore } from 'alchemy/Artifacts';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import { type LitellmCreds, litellmCredentialsLayerFor } from './credentials.ts';
 import { LiteLLMPassThroughEndpointProvider } from './pass-through-endpoint.ts';
 
 /** The planned action for each resource, deletions included, keyed by FQN. */
@@ -53,13 +53,20 @@ const actionsOf = (plan: PlanView): Planned => {
 /**
  * ⚠️ CREDENTIALS/HTTPCLIENT ARE PROVIDED AROUND `deploy`, NOT BAKED INTO THE PROVIDER LAYER.
  *   `Provider.effect`'s own construction effect is `Effect.succeed(...)` (pass-through-endpoint.ts)
- *   — it never actually reads `LitellmCredentials`/`HttpClient`; only the HANDLERS it returns do,
- *   and those run later, whenever `Apply.ts` calls `provider.reconcile`/`read`/`delete`. Effect
+ *   — it never actually reads `Credentials`/`HttpClient`; only the HANDLERS it returns do, and
+ *   those run later, whenever `Apply.ts` calls `provider.reconcile`/`read`/`delete`. Effect
  *   resolves a `yield*`'s service from whatever ambient context wraps the CALL SITE, so the layers
  *   those handlers need must wrap the whole plan+apply pipeline below, exactly where openbao's
  *   fake-stack.ts wraps `BaoEnv` around its own `deploy`.
+ * ★ `fetchFn` IS `startFakeLitellm(...).fetch` (fake-litellm.ts) — this harness never opens a real
+ *   socket; `FetchHttpClient.Fetch` is the seam the SDK's protocol layer calls through, same as
+ *   `../netbox/fake-netbox.ts`'s `fakeNetboxLayer`.
  */
-export const fakeStack = (creds: LitellmCreds, name = 'PassThroughStack'): FakeStack => {
+export const fakeStack = (
+  creds: { readonly apiKey: string; readonly baseUrl: string },
+  fetchFn: typeof globalThis.fetch,
+  name = 'PassThroughStack',
+): FakeStack => {
   const state = Alchemy.inMemoryState();
   const providers = LiteLLMPassThroughEndpointProvider();
   const stack = Alchemy.Stack as unknown as (
@@ -83,8 +90,9 @@ export const fakeStack = (creds: LitellmCreds, name = 'PassThroughStack'): FakeS
     }).pipe(
       options.adopt === undefined ? (e) => e : Effect.provideService(AdoptPolicy, options.adopt),
       Effect.provideService(Alchemy.Stage, 'test'),
-      Effect.provide(litellmCredentialsLayerFor(creds)),
+      Effect.provide(credentials(creds)),
       Effect.provide(FetchHttpClient.layer),
+      Effect.provide(Layer.succeed(FetchHttpClient.Fetch, fetchFn)),
       Effect.scoped,
     );
 

package/src/litellm/index.ts

@@ -2,32 +2,18 @@
  * LiteLLM providers for Alchemy.
  *
  * ⛔ THIS BARREL IS THE PUBLIC API, deliberately smaller than the directory — `fake-litellm.ts`
- *   and the internals `pass-through-form.ts`/`client.ts` need but a consumer should not depend on
- *   directly are not re-exported here (netbox/index.ts's own rule).
+ *   and the internals `pass-through-form.ts`/`operations.ts` need but a consumer should not depend
+ *   on directly are not re-exported here (netbox/index.ts's own rule).
+ * ★ CREDENTIALS AND TYPES NOW COME FROM `@distilled.cloud/litellm` ITSELF (2026-09-24, moved off a
+ *   hand-rolled `client.ts`/`credentials.ts` the same way `/netbox` and `/forgejo` did) — a
+ *   consumer building its own credentials layer imports `Credentials`/`CredentialsFromEnv`/
+ *   `credentials` from `@distilled.cloud/litellm/Credentials` directly, not through this barrel.
  */
-export {
-  LITELLM_PROXY_API_KEY_ENV,
-  LITELLM_PROXY_URL_ENV,
-  LitellmCredentials,
-  type LitellmCreds,
-  LitellmCredentialsError,
-  litellmCredentialsLayer,
-  litellmCredentialsLayerFor,
-} from './credentials.ts';
-export {
-  LITELLM_OPERATIONS,
-  LitellmBadRequestError,
-  type LitellmError,
-  LitellmHttpError,
-  type LitellmRequirements,
-  LitellmTransportError,
-  LitellmUnauthorizedError,
-} from './client.ts';
 export type {
   PassThroughEndpointResponse,
   PassThroughGenericEndpoint,
   PassThroughGuardrailSettings,
-} from './generated/pass-through.ts';
+} from '@distilled.cloud/litellm/misc';
 export {
   LiteLLMPassThroughEndpoint,
   LiteLLMPassThroughEndpointProvider,

package/src/litellm/operations.ts

@@ -0,0 +1,149 @@
+/**
+ * The four LiteLLM `/config/pass_through_endpoint*` calls this package writes to and reads from —
+ * now through `@distilled.cloud/litellm`'s typed operations (S23), not a hand-rolled `HttpClient`
+ * client. `client.ts` is retired; nothing else in this package imported it.
+ *
+ * ⛔ STILL WRAPPED IN A PER-BASE-URL SEMAPHORE, UNCHANGED FROM `client.ts`. LiteLLM stores every
+ *   pass-through endpoint in ONE `general_settings.pass_through_endpoints` list
+ *   (`pass_through_endpoints.py` at tag v1.100.0, mirrored in the SDK's own `misc.ts` docstrings),
+ *   so create/update/delete are each a read-modify-write of the WHOLE list through
+ *   `update_config_general_settings`. Two of this package's own calls racing each other — two
+ *   endpoints created in the same deploy — would each read the list, add their own row and write
+ *   it back, and the second write would silently drop the first row. The SDK has no opinion on
+ *   this: it is a quirk of how THIS vendor stores the resource, not a distilled protocol concern,
+ *   so it stays here, one layer above the typed calls. One permit per proxy serialises this
+ *   package's own writes; it cannot serialise against the LiteLLM UI or a second deploy process,
+ *   which is why `pass-through-endpoint.ts`'s `reconcile` reads back after writing rather than
+ *   trusting the call that just returned (docs/litellm.md).
+ * ⛔ NO STATUS SNIFFING (S21). Every failure the SDK's own typed operations declare — `BadRequest`
+ *   (400), `NotFound` (404 on update only), `UnprocessableEntity` (422) plus the shared
+ *   `Unauthorized`/`TooManyRequests`/`InternalServerError`/`BadGateway`/`ServiceUnavailable`/
+ *   `GatewayTimeout` every operation carries — is a distilled patch's doing
+ *   (`@distilled.cloud/litellm`'s own `patches/misc/*.json`, applied at generation time), never a
+ *   status check here or in `pass-through-endpoint.ts`. Deleting an id LiteLLM does not have
+ *   answers `BadRequest` (measured against the tag's `pass_through_endpoint_delete` — the id is
+ *   looked up in the list and a miss raises `HTTPException(400)`, not 404) — but so does a
+ *   genuinely-live row when the caller isn't PROXY_ADMIN, or the DB is disconnected. Telling those
+ *   apart by re-listing, not by the `BadRequest`'s message text, is `pass-through-endpoint.ts`'s
+ *   `deletePassThroughEndpoint`'s own job (S21 — a status-and-a-real-read decision, never body
+ *   text) — this file only forwards the typed error.
+ */
+import * as misc from '@distilled.cloud/litellm/misc';
+import { Credentials } from '@distilled.cloud/litellm/Credentials';
+import type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';
+import type { ConfigError } from '@distilled.cloud/litellm/Errors';
+import * as Effect from 'effect/Effect';
+import * as Semaphore from 'effect/Semaphore';
+
+export type { LitellmOpContext } from '@distilled.cloud/litellm/Protocol';
+export type LitellmRequirements = LitellmOpContext;
+export type {
+  PassThroughEndpointResponse,
+  PassThroughGenericEndpoint,
+  PassThroughGuardrailSettings,
+} from '@distilled.cloud/litellm/misc';
+
+const semaphores = new Map<string, Semaphore.Semaphore>();
+
+/** One semaphore per base URL, created on first use. Never `Hash.structure` (S18) — a plain Map key. */
+const semaphoreFor = (baseUrl: string): Effect.Effect<Semaphore.Semaphore> =>
+  Effect.sync(() => {
+    const existing = semaphores.get(baseUrl);
+    if (existing !== undefined) return existing;
+    const created = Semaphore.makeUnsafe(1);
+    semaphores.set(baseUrl, created);
+    return created;
+  });
+
+/**
+ * Serialises a write against this call's own base URL — see the file header.
+ *
+ * Resolving `Credentials` can itself fail typed (`ConfigError` — S20/S24, credentials.ts), so
+ * the return type carries that alongside the wrapped operation's own error `E`; every call
+ * site's declared error type already includes `ConfigError` as a member of the SDK's shared
+ * `LitellmOpError` (protocol.ts), so this widening is a no-op for callers.
+ */
+const mutate = <A, E>(
+  io: Effect.Effect<A, E, LitellmOpContext>,
+): Effect.Effect<A, E | ConfigError, LitellmOpContext> =>
+  Effect.gen(function* () {
+    const resolve = yield* Credentials;
+    const creds = yield* resolve;
+    const semaphore = yield* semaphoreFor(creds.apiBaseUrl);
+    return yield* semaphore.withPermits(1)(io);
+  });
+
+/** GET /config/pass_through_endpoint — every row, config-file and DB alike. Not under the semaphore: reads don't race the field. */
+export const listPassThroughEndpoints = (): Effect.Effect<
+  readonly misc.PassThroughGenericEndpoint[],
+  misc.GetPassThroughEndpointsConfigPassThroughEndpointGetError,
+  LitellmOpContext
+> =>
+  misc
+    .getPassThroughEndpointsConfigPassThroughEndpointGet({})
+    .pipe(Effect.map((response) => response.endpoints));
+
+/** POST /config/pass_through_endpoint. `body` carries `id` — see pass-through-form.ts. */
+export const createPassThroughEndpoint = (
+  body: misc.PassThroughGenericEndpoint,
+): Effect.Effect<
+  void,
+  misc.CreatePassThroughEndpointsConfigPassThroughEndpointPostError,
+  LitellmOpContext
+> => mutate(misc.createPassThroughEndpointsConfigPassThroughEndpointPost(body).pipe(Effect.asVoid));
+
+/**
+ * POST /config/pass_through_endpoint/{endpoint_id}. Merges with `exclude_none` — see
+ * pass-through-form.ts. `body` is `pass-through-form.ts`'s own `UpdateBody`, not a blanket
+ * `Partial<>` — `path`/`target` are the two fields the SDK's request type still requires
+ * non-optionally on an update.
+ */
+export const updatePassThroughEndpoint = (
+  endpointId: string,
+  body: Partial<Omit<misc.PassThroughGenericEndpoint, 'path' | 'target'>> &
+    Pick<misc.PassThroughGenericEndpoint, 'path' | 'target'>,
+): Effect.Effect<
+  void,
+  misc.UpdatePassThroughEndpointsConfigPassThroughEndpointEndpointIdPostError,
+  LitellmOpContext
+> =>
+  mutate(
+    misc
+      .updatePassThroughEndpointsConfigPassThroughEndpointEndpointIdPost({
+        ...body,
+        endpoint_id: endpointId,
+      })
+      .pipe(Effect.asVoid),
+  );
+
+/**
+ * DELETE /config/pass_through_endpoint?endpoint_id=… — idempotent BY THIS FUNCTION, not by the
+ * vendor. ⚠️ Measured at v1.100.0: deleting an id the list does not have raises `HTTPException(400)`
+ * from `pass_through_endpoint_delete`, which the SDK decodes as a typed `BadRequest` — but the SAME
+ * route also raises the SAME `BadRequest` for `not_allowed_access` (a non-PROXY_ADMIN caller) or a
+ * disconnected DB, on a row that never got deleted. A `BadRequest` alone cannot tell the two apart,
+ * so THIS FUNCTION DOESN'T GUESS FROM THE TAG ALONE: on `BadRequest` it re-lists (a GET — no
+ * PROXY_ADMIN required) and only treats the delete as already-done if `endpointId` is genuinely
+ * absent; otherwise the delete failed and this re-fails with the ORIGINAL error, not a message
+ * match (S21 — a status-and-a-real-read decision, never body text).
+ */
+export const deletePassThroughEndpoint = (
+  endpointId: string,
+): Effect.Effect<
+  void,
+  misc.DeletePassThroughEndpointsConfigPassThroughEndpointDeleteError,
+  LitellmOpContext
+> =>
+  mutate(
+    misc
+      .deletePassThroughEndpointsConfigPassThroughEndpointDelete({ endpoint_id: endpointId })
+      .pipe(
+        Effect.asVoid,
+        Effect.catchTag('BadRequest', (original) =>
+          Effect.gen(function* () {
+            const rows = yield* listPassThroughEndpoints();
+            if (rows.some((row) => row.id === endpointId)) return yield* Effect.fail(original);
+          }),
+        ),
+      ),
+  );

package/src/litellm/pass-through-endpoint-delete-swallow.test.ts

@@ -13,15 +13,16 @@
  *   "already gone" only if the row is actually absent.
  */
 import { describe, expect, test } from 'bun:test';
+import { credentials } from '@distilled.cloud/litellm/Credentials';
 import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
 import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { FAKE_BASE, startFakeLitellm } from './fake-litellm.ts';
 import {
   type LitellmRequirements,
   deletePassThroughEndpoint,
   listPassThroughEndpoints,
-} from './client.ts';
-import { litellmCredentialsLayerFor } from './credentials.ts';
-import { startFakeLitellm } from './fake-litellm.ts';
+} from './operations.ts';
 
 const MASTER_KEY = 'sk-test-master';
 const PROPS = {
@@ -32,35 +33,31 @@ const PROPS = {
   target: 'https://api.bria.ai',
 };
 
-const run = <A, E>(baseUrl: string, effect: Effect.Effect<A, E, LitellmRequirements>): Promise<A> =>
+const run = <A, E>(
+  fetchFn: typeof globalThis.fetch,
+  effect: Effect.Effect<A, E, LitellmRequirements>,
+): Promise<A> =>
   Effect.runPromise(
     effect.pipe(
       Effect.provide(FetchHttpClient.layer),
-      Effect.provide(litellmCredentialsLayerFor({ apiKey: MASTER_KEY, baseUrl })),
+      Effect.provide(Layer.succeed(FetchHttpClient.Fetch, fetchFn)),
+      Effect.provide(credentials({ apiKey: MASTER_KEY, baseUrl: FAKE_BASE })),
     ) as Effect.Effect<A, E, never>,
   );
 
 describe('a delete forbidden for a reason other than "already gone"', () => {
   test('is not swallowed: it fails, and the row is still live', async () => {
     const fake = startFakeLitellm({ forbidDelete: true, masterKey: MASTER_KEY, seed: [PROPS] });
-    try {
-      const result = run(fake.url, deletePassThroughEndpoint('live-1'));
-      await expect(result).rejects.toThrow();
-      const rows = await run(fake.url, listPassThroughEndpoints());
-      expect(rows.some((r) => r.id === 'live-1')).toBe(true);
-    } finally {
-      fake.stop();
-    }
+    const result = run(fake.fetch, deletePassThroughEndpoint('live-1'));
+    await expect(result).rejects.toThrow();
+    const rows = await run(fake.fetch, listPassThroughEndpoints());
+    expect(rows.some((r) => r.id === 'live-1')).toBe(true);
   });
 
   test('a genuinely-gone id still succeeds with no error (idempotent delete preserved)', async () => {
     const fake = startFakeLitellm({ forbidDelete: true, masterKey: MASTER_KEY });
-    try {
-      await expect(
-        run(fake.url, deletePassThroughEndpoint('never-existed')),
-      ).resolves.toBeUndefined();
-    } finally {
-      fake.stop();
-    }
+    await expect(
+      run(fake.fetch, deletePassThroughEndpoint('never-existed')),
+    ).resolves.toBeUndefined();
   });
 });

package/src/litellm/pass-through-endpoint-replace.test.ts

@@ -15,11 +15,11 @@
  *   caught this: it calls `h.reconcile` directly with the SAME instanceId and the OLD output, a
  *   call shape the real engine never produces for a `replace`.
  */
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { beforeEach, describe, expect, test } from 'bun:test';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import * as Effect from 'effect/Effect';
+import { FAKE_BASE, type FakeLitellm, startFakeLitellm } from './fake-litellm.ts';
 import { type FakeStack, fakeStack, writesOf } from './fake-stack.ts';
-import { type FakeLitellm, startFakeLitellm } from './fake-litellm.ts';
 import { LiteLLMPassThroughEndpoint } from './pass-through-endpoint.ts';
 import type { PassThroughEndpointProps } from './pass-through-form.ts';
 
@@ -29,9 +29,8 @@ let fake: FakeLitellm;
 let stack: FakeStack;
 beforeEach(() => {
   fake = startFakeLitellm({ masterKey: MASTER_KEY });
-  stack = fakeStack({ apiKey: MASTER_KEY, baseUrl: fake.url });
+  stack = fakeStack({ apiKey: MASTER_KEY, baseUrl: FAKE_BASE }, fake.fetch);
 });
-afterEach(() => fake.stop());
 
 /** ★ `RemovalPolicy.destroy()`, deliberately: under the (non-default) `retain`, `deleteFirst`'s own
  *   old-generation delete is skipped by the engine (Apply.ts's `deleteOldGenerations`), so a path

package/src/litellm/pass-through-endpoint.test.ts

@@ -2,15 +2,16 @@
  * `LiteLLM.PassThroughEndpoint`'s lifecycle handlers, called directly against `fake-litellm.ts` —
  * the loopback-fake pattern this kit uses in place of `alchemy/Test/*` (H12, no live writes).
  */
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { beforeEach, describe, expect, test } from 'bun:test';
+import { credentials } from '@distilled.cloud/litellm/Credentials';
 import { Unowned } from 'alchemy/AdoptPolicy';
 import { Stack } from 'alchemy/Stack';
 import { Stage } from 'alchemy/Stage';
 import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
 import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import { litellmCredentialsLayerFor } from './credentials.ts';
-import { type FakeLitellm, startFakeLitellm } from './fake-litellm.ts';
-import { createPassThroughEndpoint } from './client.ts';
+import { FAKE_BASE, type FakeLitellm, startFakeLitellm } from './fake-litellm.ts';
+import { createPassThroughEndpoint } from './operations.ts';
 import {
   LitellmConfigPathConflictError,
   LitellmLiteralSecretHeaderError,
@@ -22,11 +23,11 @@ const MASTER_KEY = 'sk-test-master';
 const INSTANCE_ID = 'a'.repeat(32);
 const FAKE_STACK = { actions: {}, bindings: {}, name: 's', resources: {}, stage: 'test' } as never;
 
+/** No `.stop()` any more — `fake.fetch` is a plain function, no real socket to close. */
 let fake: FakeLitellm;
 beforeEach(() => {
   fake = startFakeLitellm({ masterKey: MASTER_KEY });
 });
-afterEach(() => fake.stop());
 
 const run = <A, E>(effect: Effect.Effect<A, E, never>): Promise<A> =>
   Effect.runPromise(effect as Effect.Effect<A, E, never>);
@@ -34,7 +35,8 @@ const run = <A, E>(effect: Effect.Effect<A, E, never>): Promise<A> =>
 const withServices = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   effect.pipe(
     Effect.provide(FetchHttpClient.layer),
-    Effect.provide(litellmCredentialsLayerFor({ apiKey: MASTER_KEY, baseUrl: fake.url })),
+    Effect.provide(Layer.succeed(FetchHttpClient.Fetch, fake.fetch)),
+    Effect.provide(credentials({ apiKey: MASTER_KEY, baseUrl: FAKE_BASE })),
     Effect.provideService(Stage, 'test'),
     Effect.provideService(Stack, FAKE_STACK),
   ) as Effect.Effect<A, E, never>;
@@ -150,7 +152,6 @@ describe('two endpoints created in one deploy', () => {
 
 describe('a path held by an is_from_config row', () => {
   test('is refused at read, before any write', async () => {
-    fake.stop();
     fake = startFakeLitellm({
       masterKey: MASTER_KEY,
       seed: [{ ...PROPS, id: 'cfg-1', is_from_config: true }],
@@ -167,7 +168,6 @@ describe('a path held by an is_from_config row', () => {
 
 describe('a foreign DB row on the same path', () => {
   test('is Unowned, and read works with output undefined', async () => {
-    fake.stop();
     fake = startFakeLitellm({
       masterKey: MASTER_KEY,
       seed: [{ ...PROPS, id: 'foreign-1', is_from_config: false }],