@homeflare/alchemy 0.28.0 → 0.29.1

package/src/proxmox/distilled-pve.ts

@@ -0,0 +1,147 @@
+/**
+ * Running one `@distilled.cloud/proxmox` typed operation the way `client.ts`'s `pve()` ran a raw
+ * HTTP call — same credential lease reuse (lease-cache.ts) and the same cluster-member failover
+ * safety rule (members.ts), now handing the request itself to the SDK instead of building one.
+ *
+ * ★ THIS IS THE SEAM A DISTILLED-BACKED FAMILY CALLS INSTEAD OF `pve()`. `client.ts` stays for
+ *   every family not yet migrated — see acl.ts, the first one, for what a migrated family looks
+ *   like. A family migrates by calling its own `@distilled.cloud/proxmox/<segment>` typed
+ *   operations through `runPve` below, never through a generic method+path+form call: that is
+ *   what "no hand-rolled client" means in practice (upstream Alchemy PR 1425).
+ *
+ * ⚠️ THE WHOLE OPERATION IS RE-RUN PER MEMBER, NOT JUST ONE HTTP CALL. `executeOnCluster` in
+ *   members.ts retries a single already-built `HttpClientRequest`; a distilled operation builds
+ *   its OWN request internally from whatever `Credentials` it is given, so there is no request to
+ *   hand between attempts. Failover here instead re-provides `Credentials` with the next member's
+ *   `apiBaseUrl` and re-runs the same operation value. This is safe under the identical rule
+ *   `executeOnCluster` documents and members.ts's classifiers still enforce: a write may repeat
+ *   only on a PROVABLY pre-send transport failure (connection refused, DNS, a refused
+ *   certificate) — never on a timeout after connect, and never on an HTTP answer of any kind,
+ *   because an answer (even a typed error the SDK decoded) proves the request reached a live
+ *   member and must not be sent again elsewhere. Reads may fail over on any transport failure.
+ *
+ * ⛔ A TYPED ANSWER-ERROR IS NEVER A REASON TO TRY ANOTHER MEMBER. `Forbidden`,
+ *   `ParameterVerificationFailed`, `ClusterNodeUnreachable`, … all mean the request reached a
+ *   member and that member answered — `isTransportFailure`/`isPreSendTransport` (members.ts)
+ *   return `false` for all of them, exactly as they do for the `HttpClientResponse` case in
+ *   `executeOnCluster`, since neither function inspects anything but a transport-level
+ *   `HttpClientError`. Such an error propagates from here UNCHANGED — not wrapped, not retried —
+ *   which is what lets a caller `catchTag` it directly.
+ *
+ * TRAP FOUND WHILE WRITING THE FAILOVER TEST: `Retry.none` on every attempt, and it is not
+ *   optional. `@distilled.cloud/core`'s DEFAULT policy retries any error in its `ServerError`
+ *   category automatically, with no caller opt-in (protocol.ts's own header names the mechanism:
+ *   `core/category.ts`'s `isTransientError` via `makeDefault`) -- and that category covers
+ *   transport failures too, not just 5xx answers: MEASURED -- a plain `listAccessAcl({})` against
+ *   a member that refuses the connection hung past a 5-second test timeout, backing off inside
+ *   the SDK before this file's own failover loop ever saw a failure to classify. Left enabled, a
+ *   WRITE could be resent to the SAME member several times before `runPveWith` gets a result at
+ *   all -- silently reintroducing, inside one member, the exact risk `executeOnCluster`
+ *   (members.ts) exists to rule out across members ("a request that may have reached a member
+ *   must not be sent again"). The hand-rolled client never auto-retried anything; member failover
+ *   was its only resilience. `Retry.none` below keeps that property true here too.
+ *
+ * ⛔ GAP FOUND ON REVIEW, FIXED 2026-09-24: `Retry.none` only stops the SDK re-sending to the SAME
+ *   member -- it added no bound on how long ONE attempt may wait. A member that accepts the TCP
+ *   connection but never answers hung this whole function forever, since the for-loop below never
+ *   got a result to classify and so never reached a healthy member. `MEMBER_TIMEOUT` (members.ts,
+ *   shared with `client.ts`'s `executeOnCluster`) now bounds each attempt; `isTransportFailure`
+ *   treats the resulting `Cause.TimeoutError` as failover-eligible for a read, and
+ *   `isPreSendTransport` still refuses it for a write, for the same reason a post-send timeout
+ *   always was refused.
+ */
+import type * as Cause from 'effect/Cause';
+import type * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import * as Result from 'effect/Result';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { credentials as distilledPveCredentials } from '@distilled.cloud/proxmox/Credentials';
+import type { ProxmoxOpContext } from '@distilled.cloud/proxmox/Protocol';
+import * as ProxmoxRetry from '@distilled.cloud/proxmox/Retry';
+import type { PveCredential, PveRole, PveTarget } from './credentials.ts';
+import { leased } from './lease-cache.ts';
+import {
+  MEMBER_TIMEOUT,
+  type MemberAttempt,
+  describeTransport,
+  isPreSendTransport,
+  isTransportFailure,
+  noteGoodMember,
+  orderedMembers,
+  pveApiBase,
+} from './members.ts';
+
+/** Every member answered nothing usable — the direct successor to `client.ts`'s `clusterExhausted`. */
+export class PveClusterExhausted extends Error {
+  constructor(readonly attempts: readonly MemberAttempt[]) {
+    super(`all members failed: ${attempts.map((a) => `${a.member} (${a.why})`).join('; ')}`);
+    this.name = 'PveClusterExhausted';
+  }
+}
+
+/**
+ * Run `op` against `target`'s cluster on an ALREADY-HELD credential — the direct successor to
+ * `client.ts`'s `pveWith`, for a caller reasoning about identity rather than cost (or a test that
+ * wants a fixed, explicit credential rather than a live OpenBao mint — see distilled-pve.test.ts).
+ *
+ * @param isWrite Whether `op` may have a side effect once sent — decides which transport
+ *   failures may retry on the next member. Pass `true` for anything that is not a plain read.
+ * @param timeout Bound on ONE member's attempt — defaults to `MEMBER_TIMEOUT` (members.ts). A
+ *   test passes a short one to prove failover/bounding without waiting out the real bound;
+ *   production code never overrides it. A member that answers past this is failed over (a read)
+ *   or failed outright (a write, since the request may already have landed) — see
+ *   `isTransportFailure`/`isPreSendTransport`.
+ */
+export const runPveWith = <A, E>(
+  target: PveTarget,
+  credential: PveCredential,
+  isWrite: boolean,
+  op: Effect.Effect<A, E, ProxmoxOpContext>,
+  timeout: Duration.Input = MEMBER_TIMEOUT,
+): Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted, HttpClient.HttpClient> =>
+  Effect.gen(function* () {
+    const attempts: MemberAttempt[] = [];
+    for (const member of orderedMembers(target)) {
+      const credLayer = distilledPveCredentials({
+        baseUrl: pveApiBase(member),
+        secret: credential.secret,
+        tokenId: credential.tokenId,
+      });
+      const outcome = yield* op.pipe(
+        ProxmoxRetry.none,
+        Effect.provide(credLayer),
+        Effect.timeout(timeout),
+        Effect.result,
+      );
+      if (Result.isSuccess(outcome)) {
+        noteGoodMember(target, member);
+        return outcome.success;
+      }
+      const mayRetry = isWrite
+        ? isPreSendTransport(outcome.failure)
+        : isTransportFailure(outcome.failure);
+      if (!mayRetry) return yield* Effect.fail(outcome.failure);
+      attempts.push({ member, why: describeTransport(outcome.failure) });
+    }
+    return yield* Effect.fail(new PveClusterExhausted(attempts));
+  });
+
+/**
+ * `runPveWith`, minting/reusing a `role` lease exactly as `pve()` did — the seam a migrated
+ * resource file calls.
+ *
+ * ⚠️ `| Error` IN THE RETURN TYPE IS `leased()`'s OWN FAILURE, NOT A NEW ONE THIS FILE ADDS.
+ *   `credentials.ts`'s `mint` fails with a plain `Error` (an OpenBao refusal — sealed, denied, no
+ *   such role) and was never typed more narrowly there; `pve()` carried the same untyped
+ *   possibility before this file existed, just without a signature that said so.
+ */
+export const runPve = <A, E>(
+  target: PveTarget,
+  role: PveRole,
+  isWrite: boolean,
+  op: Effect.Effect<A, E, ProxmoxOpContext>,
+): Effect.Effect<A, E | Cause.TimeoutError | PveClusterExhausted | Error, HttpClient.HttpClient> =>
+  Effect.gen(function* () {
+    const credential = yield* leased(target, role);
+    return yield* runPveWith(target, credential, isWrite, op);
+  });

package/src/proxmox/members-timeout.test.ts

@@ -0,0 +1,161 @@
+/**
+ * `MEMBER_TIMEOUT` bounds one cluster-member attempt — proved directly against `executeOnCluster`
+ * with a SHORT injected bound, not against `pveWith`/`runPveWith` with an outer `Effect.timeout`.
+ *
+ * ⛔ WHY A SEPARATE FILE, NOT MORE CASES IN client.test.ts's EXISTING "transport timeout" TEST:
+ *   that test (and distilled-pve.test.ts's twin) wraps the WHOLE call in `Effect.timeout('50
+ *   millis')` from the OUTSIDE. That proves a write is never resent once the outer timeout wins
+ *   the race — but it proves nothing about whether `executeOnCluster`/`runPveWith` bound a single
+ *   attempt THEMSELVES: before this file existed, nothing did, and those tests still passed,
+ *   because the outer wrapper always won first. A broken fix here hangs node:test's own per-test
+ *   timeout instead of quietly passing.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';
+import type { PveTarget } from './credentials.ts';
+import { executeOnCluster, resetLastGoodForTest } from './members.ts';
+
+type ServeOptions = {
+  fetch(request: Request): Response | Promise<Response>;
+  hostname: string;
+  port: number;
+};
+const { Bun } = globalThis as unknown as {
+  Bun: { serve(options: ServeOptions): { port: number; stop(closeActive: boolean): void } };
+};
+
+const target = (members: readonly string[]): PveTarget => ({
+  members,
+  mount: 'proxmox-c1-test',
+  scheme: 'pve',
+});
+
+/** Same remap as client.test.ts: https://member:8006 -> http://127.0.0.1:<port>. Never a live host. */
+const remapFetch = (ports: Record<string, number>): typeof fetch =>
+  Object.assign(
+    (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {
+      const url = new URL(String(input instanceof Request ? input.url : input));
+      const port = ports[url.hostname];
+      if (port === undefined) {
+        return Promise.reject(Object.assign(new Error('unmapped host'), { code: 'ENOTFOUND' }));
+      }
+      url.protocol = 'http:';
+      url.hostname = '127.0.0.1';
+      url.port = String(port);
+      return globalThis.fetch(url, init);
+    },
+    { preconnect: globalThis.fetch.preconnect },
+  );
+
+const run = <A, E>(
+  effect: Effect.Effect<A, E, HttpClient.HttpClient>,
+  ports: Record<string, number>,
+) =>
+  Effect.runPromise(
+    effect.pipe(
+      Effect.provide(
+        FetchHttpClient.layer.pipe(
+          Layer.provideMerge(Layer.succeed(FetchHttpClient.Fetch, remapFetch(ports))),
+        ),
+      ),
+    ),
+  );
+
+const counting = (body: unknown) => {
+  let hits = 0;
+  const server = Bun.serve({
+    fetch: () => {
+      hits += 1;
+      return Response.json({ data: body });
+    },
+    hostname: '127.0.0.1',
+    port: 0,
+  });
+  return { hits: () => hits, port: server.port, stop: () => server.stop(true) };
+};
+
+const hanging = () =>
+  Bun.serve({
+    fetch: () => new Promise<Response>(() => {}),
+    hostname: '127.0.0.1',
+    port: 0,
+  });
+
+const A = 'pve-a.test';
+const B = 'pve-b.test';
+const BOUND = '100 millis';
+
+describe('MEMBER_TIMEOUT bounds a single attempt', () => {
+  /**
+   * ⚠️ EXPLICIT `{ timeout: 15000 }`: bun's default per-test kill is 5000ms (MEASURED via a
+   *   throwaway probe), which is too close to this shared, often-loaded dev machine's own
+   *   scheduling jitter to trust — a slow tick could kill the test via the FRAMEWORK's timeout
+   *   before the 100ms `BOUND` or the assertion below ever gets a say, which reads as this fix
+   *   being broken when it is not. 15s leaves wide headroom while staying far under this file's
+   *   own 10s assertion, so a genuine "never bounded" regression still fails it either way.
+   */
+  it(
+    'fails a hung read over to the next member, within the injected bound',
+    { timeout: 15000 },
+    async () => {
+      resetLastGoodForTest();
+      const hang = hanging();
+      const good = counting(['ok']);
+      try {
+        const started = Date.now();
+        const response = await run(
+          executeOnCluster(
+            target([A, B]),
+            'GET',
+            'pools',
+            (apiBase) => HttpClientRequest.get(`${apiBase}/pools`),
+            BOUND,
+          ),
+          { [A]: hang.port, [B]: good.port },
+        );
+        assert.equal(response.status, 200);
+        assert.equal(good.hits(), 1);
+        // ⚠️ Loose on purpose (machine jitter) — the real separation is "did not hang for the
+        //   whole per-test timeout above", which a regression here would.
+        assert.ok(Date.now() - started < 10000);
+      } finally {
+        hang.stop(true);
+        good.stop();
+      }
+    },
+  );
+
+  it(
+    'fails a hung write outright, never resending it, within the injected bound',
+    { timeout: 15000 },
+    async () => {
+      resetLastGoodForTest();
+      const hang = hanging();
+      const backup = counting('UPID:timeout-test');
+      try {
+        const started = Date.now();
+        await run(
+          executeOnCluster(
+            target([A, B]),
+            'PUT',
+            'nodes/node-c/network',
+            (apiBase) => HttpClientRequest.put(`${apiBase}/nodes/node-c/network`),
+            BOUND,
+          ).pipe(Effect.flip),
+          { [A]: hang.port, [B]: backup.port },
+        );
+        // ⛔ B must never receive the PUT — a post-connect timeout is not pre-send failover.
+        assert.equal(backup.hits(), 0);
+        assert.ok(Date.now() - started < 10000);
+      } finally {
+        hang.stop(true);
+        backup.stop();
+      }
+    },
+  );
+});

package/src/proxmox/members.test.ts

@@ -8,6 +8,7 @@
  */
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
+import * as Cause from 'effect/Cause';
 import * as HttpClientError from 'effect/unstable/http/HttpClientError';
 import { isPreSendTransport, isTransportFailure } from './members.ts';
 
@@ -51,4 +52,12 @@ describe('transport classification', () => {
     assert.equal(isTransportFailure(new Error('500')), false);
     assert.equal(isPreSendTransport(new Error('ConnectionRefused')), false);
   });
+
+  // ★ `MEMBER_TIMEOUT` produces this via `Effect.timeout` — see members-timeout.test.ts for the
+  //   live-server proof that it actually fires and bounds a hung attempt.
+  it('treats a bounded-attempt timeout as transport for a read, never pre-send for a write', () => {
+    const timedOut = new Cause.TimeoutError();
+    assert.equal(isTransportFailure(timedOut), true);
+    assert.equal(isPreSendTransport(timedOut), false);
+  });
 });

package/src/proxmox/members.ts

@@ -6,6 +6,8 @@
  *
  * ⛔ NEVER cluster-c1.example.com: it resolves to 192.0.2.250, which nothing serves.
  */
+import * as Cause from 'effect/Cause';
+import type * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import * as Result from 'effect/Result';
 import * as HttpClient from 'effect/unstable/http/HttpClient';
@@ -19,6 +21,22 @@ export const PVE_API_PORT = 8006;
 /** Strict TLS, always :8006 — each node's certificate carries its mgmt name as a SAN. */
 export const pveApiBase = (member: string) => `https://${member}:${String(PVE_API_PORT)}/api2/json`;
 
+/**
+ * Bound on ONE member attempt, shared by `client.ts`'s `executeOnCluster` and
+ * `distilled-pve.ts`'s `runPveWith` — both loop over `orderedMembers` and both call this file's
+ * classifiers, so one constant keeps them in the same failure-mode boundary.
+ *
+ * ⛔ MEASURED GAP, FIXED 2026-09-24: before this, NOTHING bounded a single attempt. A member that
+ *   accepted the TCP connection but never answered hung the whole call forever — the for-loop
+ *   never produced a failure for `isTransportFailure`/`isPreSendTransport` to classify, so it
+ *   never advanced to a healthy member. `isTimeoutCause` below existed already (written for this
+ *   exact case, per its own comment: "no answer after connect") but nothing ever called
+ *   `Effect.timeout` to produce one.
+ * ★ TB4 (the live 3-member cluster, `homeflare-proxmox/src/target.ts`) waits at most 3× this
+ *   before `PveClusterExhausted` — well under S26's ~90-second ceiling on a bounded wait.
+ */
+export const MEMBER_TIMEOUT: Duration.Input = '20 seconds';
+
 /** Process-scoped last member that answered, keyed by OpenBao mount (= one PVE cluster). */
 const lastGoodByMount = new Map<string, string>();
 
@@ -82,14 +100,22 @@ const isPreSendCause = (cause: unknown): boolean => {
  * ★ TransportError | InvalidUrlError | EncodeError occur before a response exists; StatusCodeError
  *   and kin include a response. client.execute does NOT filter status, so HTTP answers are never
  *   TransportError — only the transport layer is.
+ * ★ `Cause.TimeoutError` (from `MEMBER_TIMEOUT` below, via `Effect.timeout`) counts too — a read
+ *   with no side effect to duplicate fails over on ANY transport failure, a hang included.
  */
 export const isTransportFailure = (cause: unknown): boolean => {
+  if (Cause.isTimeoutError(cause)) return true;
   if (!HttpClientError.isHttpClientError(cause)) return false;
   const tag = cause.reason._tag;
   return tag === 'TransportError' || tag === 'InvalidUrlError' || tag === 'EncodeError';
 };
 
-/** Pre-send only: connection refused, DNS, a certificate refused — never a timeout after connect. */
+/**
+ * Pre-send only: connection refused, DNS, a certificate refused — never a timeout after connect.
+ * ⛔ `Cause.TimeoutError` (MEMBER_TIMEOUT firing) falls through to `false` here on purpose, same
+ *   as any other non-`HttpClientError` cause: the request may already have reached the member, so
+ *   a write must not repeat it elsewhere.
+ */
 export const isPreSendTransport = (cause: unknown): boolean => {
   if (!HttpClientError.isHttpClientError(cause)) return false;
   const { reason } = cause;
@@ -102,6 +128,7 @@ export const isPreSendTransport = (cause: unknown): boolean => {
 };
 
 export const describeTransport = (cause: unknown): string => {
+  if (Cause.isTimeoutError(cause)) return `timed out after ${String(MEMBER_TIMEOUT)}`;
   if (HttpClientError.isHttpClientError(cause)) return cause.message;
   return String(cause);
 };
@@ -122,12 +149,17 @@ export type PveMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
  * ★ Reads fail over on any transport failure, including timeout — no side effect to duplicate.
  *   MEASURED 2026-09-14: full C1 plans stayed all-noop with the first member refused (127.0.0.1)
  *   and with it unresolvable (n9.invalid).
+ *
+ * @param timeout Bound on ONE member's attempt — defaults to `MEMBER_TIMEOUT`. A test passes a
+ *   short one to prove failover happens without waiting out the real bound; production code never
+ *   overrides it.
  */
 export const executeOnCluster = (
   target: PveTarget,
   method: PveMethod,
   path: string,
   build: (apiBase: string) => HttpClientRequest.HttpClientRequest,
+  timeout: Duration.Input = MEMBER_TIMEOUT,
 ): Effect.Effect<
   HttpClientResponse.HttpClientResponse,
   {
@@ -156,7 +188,9 @@ export const executeOnCluster = (
     const isWrite = method !== 'GET';
     const attempts: MemberAttempt[] = [];
     for (const member of orderedMembers(target)) {
-      const outcome = yield* client.execute(build(pveApiBase(member))).pipe(Effect.result);
+      const outcome = yield* client
+        .execute(build(pveApiBase(member)))
+        .pipe(Effect.timeout(timeout), Effect.result);
       if (Result.isSuccess(outcome)) {
         noteGoodMember(target, member);
         return outcome.success;

package/dist/litellm/client.d.ts

@@ -1,76 +0,0 @@
-import * as Effect from 'effect/Effect';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import { LitellmCredentials, type LitellmCredentialsError } from './credentials.ts';
-import type { PassThroughGenericEndpoint } from './generated/pass-through.ts';
-export type LitellmRequirements = HttpClient.HttpClient | LitellmCredentials;
-/**
- * The `litellm:<METHOD> <path>` operations this package writes to and reads from.
- *
- * ★ `codegen/litellm.ts` scans this FILE's text for these exact literals to pick which of
- *   LiteLLM 1.100.0's 696 paths to generate types from (codegen/litellm.ts header). Keep each one
- *   a literal string on one line; the generator matches text, it does not evaluate the object.
- */
-export declare const LITELLM_OPERATIONS: {
-    readonly create: 'litellm:POST /config/pass_through_endpoint';
-    readonly delete: 'litellm:DELETE /config/pass_through_endpoint';
-    readonly list: 'litellm:GET /config/pass_through_endpoint';
-    readonly update: 'litellm:POST /config/pass_through_endpoint/{endpoint_id}';
-};
-declare const LitellmUnauthorizedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "LitellmUnauthorizedError";
-} & Readonly<A>;
-export declare class LitellmUnauthorizedError extends LitellmUnauthorizedError_base<{
-    readonly status: number;
-    readonly method: string;
-    readonly path: string;
-}> {
-}
-declare const LitellmBadRequestError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "LitellmBadRequestError";
-} & Readonly<A>;
-export declare class LitellmBadRequestError extends LitellmBadRequestError_base<{
-    readonly method: string;
-    readonly path: string;
-    readonly detail: string;
-}> {
-}
-declare const LitellmHttpError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "LitellmHttpError";
-} & Readonly<A>;
-export declare class LitellmHttpError extends LitellmHttpError_base<{
-    readonly status: number;
-    readonly method: string;
-    readonly path: string;
-    readonly detail: string;
-}> {
-}
-declare const LitellmTransportError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "LitellmTransportError";
-} & Readonly<A>;
-export declare class LitellmTransportError extends LitellmTransportError_base<{
-    readonly method: string;
-    readonly path: string;
-    readonly cause: string;
-}> {
-}
-export type LitellmError = LitellmUnauthorizedError | LitellmBadRequestError | LitellmHttpError | LitellmTransportError | LitellmCredentialsError;
-/** GET /config/pass_through_endpoint — every row, config-file and DB alike. Not under the semaphore: reads don't race the field. */
-export declare const listPassThroughEndpoints: () => Effect.Effect<readonly PassThroughGenericEndpoint[], LitellmError, LitellmRequirements>;
-/** POST /config/pass_through_endpoint. `body` carries `id` — see pass-through-endpoint.ts. */
-export declare const createPassThroughEndpoint: (body: PassThroughGenericEndpoint) => Effect.Effect<void, LitellmError, LitellmRequirements>;
-/** POST /config/pass_through_endpoint/{endpoint_id}. Merges with `exclude_none` — see pass-through-form.ts. */
-export declare const updatePassThroughEndpoint: (endpointId: string, body: Partial<PassThroughGenericEndpoint>) => Effect.Effect<void, LitellmError, LitellmRequirements>;
-/**
- * DELETE /config/pass_through_endpoint?endpoint_id=… — idempotent BY THIS FUNCTION, not by the
- * vendor. ⚠️ Measured at v1.100.0: deleting an id the list does not have raises `HTTPException(400)`
- * from `pass_through_endpoint_delete` — but the SAME route also 400s `not_allowed_access` for a
- * non-PROXY_ADMIN caller or a disconnected DB (`update_config_general_settings`,
- * proxy_server.py:16389-16416), on a row that never got deleted. A 400 alone cannot tell the two
- * apart, so THIS FUNCTION DOESN'T GUESS FROM THE STATUS ALONE: on 400 it re-lists (a GET — no
- * PROXY_ADMIN required, proxy_server.py:3245-3251) and only treats the delete as already-done if
- * `endpointId` is genuinely absent; otherwise the delete failed and this re-fails with the ORIGINAL
- * error, not a message match (S21 — a status-and-a-real-read decision, never body text).
- */
-export declare const deletePassThroughEndpoint: (endpointId: string) => Effect.Effect<void, LitellmError, LitellmRequirements>;
-export {};
-//# sourceMappingURL=client.d.ts.map

package/dist/litellm/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/litellm/client.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,6BAA6B,CAAC;AAErC,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,UAAU,GAAG,kBAAkB,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;aAC7B,MAAM,EAAE,4CAA4C;aACpD,MAAM,EAAE,8CAA8C;aACtD,IAAI,EAAE,2CAA2C;aACjD,MAAM,EAAE,0DAA0D;CAC1D,CAAC;;;;AAEX,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;CAAG;;;;AACL,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;;;;AACL,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;;;;AACL,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;CAAG;AAEL,MAAM,MAAM,YAAY,GACpB,wBAAwB,GACxB,sBAAsB,GACtB,gBAAgB,GAChB,qBAAqB,GACrB,uBAAuB,CAAC;AAwD5B,oIAAoI;AACpI,eAAO,MAAM,wBAAwB,QAAO,MAAM,CAAC,MAAM,CACvD,SAAS,0BAA0B,EAAE,EACrC,YAAY,EACZ,mBAAmB,CAIlB,CAAC;AASJ,8FAA8F;AAC9F,eAAO,MAAM,yBAAyB,SAC9B,0BAA0B,KAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,CACK,CAAC;AAE9D,+GAA+G;AAC/G,eAAO,MAAM,yBAAyB,eACxB,MAAM,QACZ,OAAO,CAAC,0BAA0B,CAAC,KACxC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,CACuC,CAAC;AAEhG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eACxB,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,CAcrD,CAAC"}

package/dist/litellm/credentials.d.ts

@@ -1,48 +0,0 @@
-/**
- * The lazy Auth service every LiteLLM call reads from, and nothing else reads the environment.
- *
- * ★ LITELLM'S OWN VARIABLE NAMES, NOT A HOUSE CHOICE. `LITELLM_PROXY_URL` and
- *   `LITELLM_PROXY_API_KEY` are what LiteLLM's own CLI client reads
- *   (litellm/proxy/client/cli/main.py:70,78 at tag v1.100.0) — using the vendor's own names means
- *   a consumer who already has a `.env` for the `litellm` CLI needs nothing new for this package.
- * ⛔ NO DEFAULT URL. A published package that fell back to a loopback address would let a
- *   consumer who forgot the variable watch every call fail against a proxy that is not theirs,
- *   instead of being told which variable is missing (S24/S25 — the house rule, not a vendor one).
- * ⛔ THE KEY IS NEVER A PROP. Alchemy persists attributes unencrypted (S25); the master key that
- *   `update_config_general_settings` requires (PROXY_ADMIN only, proxy_server.py:16411 at the
- *   tag) is read fresh from the environment on every call, never stored in state.
- * ★ LAZY: the service's VALUE is an `Effect` that resolves the credential, not the credential
- *   itself — so a layer built once still reads the environment inside each operation
- *   (`yield* yield* LitellmCredentials`), the idiom `alchemy/Auth`'s custom-auth-provider guide
- *   describes for a credential a layer must not capture at build time.
- */
-import * as Context from 'effect/Context';
-import * as Effect from 'effect/Effect';
-import * as Layer from 'effect/Layer';
-export declare const LITELLM_PROXY_URL_ENV = "LITELLM_PROXY_URL";
-export declare const LITELLM_PROXY_API_KEY_ENV = "LITELLM_PROXY_API_KEY";
-export interface LitellmCreds {
-    /** Trailing slash stripped. No default — see the header. */
-    readonly baseUrl: string;
-    /** LiteLLM's master (or a PROXY_ADMIN) key. Never logged, never an attribute. */
-    readonly apiKey: string;
-}
-declare const LitellmCredentialsError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-    readonly _tag: "LitellmCredentialsError";
-} & Readonly<A>;
-export declare class LitellmCredentialsError extends LitellmCredentialsError_base<{
-    readonly message: string;
-}> {
-}
-/** Read at call time. Exported so a test can call it directly against `process.env`. */
-export declare const resolveCreds: Effect.Effect<LitellmCreds, LitellmCredentialsError>;
-declare const LitellmCredentials_base: Context.ServiceClass<LitellmCredentials, "homeflare/litellm/Credentials", Effect.Effect<LitellmCreds, LitellmCredentialsError, never>>;
-/** The Effect service a LiteLLM operation reads: `yield* yield* LitellmCredentials`. */
-export declare class LitellmCredentials extends LitellmCredentials_base {
-}
-/** The default layer: resolves from the environment, fresh, on every `yield*`. */
-export declare const litellmCredentialsLayer: Layer.Layer<LitellmCredentials>;
-/** For a test: a fixed credential, never touching the environment. */
-export declare const litellmCredentialsLayerFor: (creds: LitellmCreds) => Layer.Layer<LitellmCredentials>;
-export {};
-//# sourceMappingURL=credentials.d.ts.map

package/dist/litellm/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/litellm/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;;;;AAED,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AASL,wFAAwF;AACxF,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,uBAAuB,CAW7E,CAAC;;AAEF,wFAAwF;AACxF,qBAAa,kBAAmB,SAAQ,uBAGJ;CAAG;AAEvC,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAGnE,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,0BAA0B,UAAW,YAAY,KAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CACrC,CAAC"}

package/dist/litellm/generated/pass-through.d.ts

@@ -1,71 +0,0 @@
-/**
- * Generated from LiteLLM 1.100.0's OpenAPI document -- DO NOT EDIT BY HAND.
- *
- * Run: bun codegen/litellm.ts    (`--check` compares without writing)
- * Manifest entry: `litellm-openapi` -- LiteLLM Proxy (app.openapi()) 1.100.0
- *   sha256 1b3e4d23da6aea92..., read from codegen/manifest.json's own note on how this document
- *   was produced (the vendor's own generator, cross-checked byte-identically — not a live read).
- *
- * Covers the 4 pass-through operations this package writes to:
- *   litellm:DELETE /config/pass_through_endpoint
- *   litellm:GET /config/pass_through_endpoint
- *   litellm:POST /config/pass_through_endpoint
- *   litellm:POST /config/pass_through_endpoint/{endpoint_id}
- *
- * Does NOT cover the other 692 paths LiteLLM 1.100.0 publishes — this generator is
- * consumer-driven (codegen/litellm.ts), not exhaustive. See codegen/README.md.
- */
-export interface PassThroughEndpointResponse {
-    readonly endpoints: readonly PassThroughGenericEndpoint[];
-}
-export interface PassThroughGenericEndpoint {
-    /**
-     * Whether authentication is required for the pass-through endpoint. Defaults to True so a pass-through silently created without an explicit value still requires a valid LiteLLM API key — set to False only if the endpoint is meant to be a public forwarder (e.g. an unauthenticated webhook target).
-     * @default true
-     */
-    readonly auth?: boolean;
-    /**
-     * The USD cost per request to the target endpoint. This is used to calculate the cost of the request to the target endpoint.
-     * @default 0
-     */
-    readonly cost_per_request?: number;
-    /**
-     * Key-value pairs of default query parameters to be sent with every request to this endpoint. These can be overridden by client-provided query parameters. For example: {'key': 'default_value', 'api_version': '2023-01'}
-     * @default {}
-     */
-    readonly default_query_params?: Record<string, unknown>;
-    /** Guardrails configuration for this passthrough endpoint. Dict keys are guardrail names, values are optional settings for field targeting. When set, all org/team/key level guardrails will also execute. Defaults to None (no guardrails execute). */
-    readonly guardrails?: Record<string, PassThroughGuardrailSettings | null> | null;
-    /**
-     * Key-value pairs of headers to be forwarded with the request. You can set any key value pair here and it will be forwarded to your target endpoint
-     * @default {}
-     */
-    readonly headers?: Record<string, unknown>;
-    /** Optional unique identifier for the pass-through endpoint. If not provided, endpoints will be identified by path for backwards compatibility. */
-    readonly id?: string | null;
-    /**
-     * If True, requests to subpaths of the path will be forwarded to the target endpoint. For example, if the path is /bria and include_subpath is True, requests to /bria/v1/text-to-image/base/2.3 will be forwarded to the target endpoint.
-     * @default false
-     */
-    readonly include_subpath?: boolean;
-    /**
-     * True if this endpoint is defined in the config file, False if from DB. Config-defined endpoints cannot be edited via the UI.
-     * @default false
-     */
-    readonly is_from_config?: boolean;
-    /** List of HTTP methods this endpoint handles (e.g., ['GET', 'POST']). If None or empty, all methods (GET, POST, PUT, DELETE, PATCH) are supported for backward compatibility. This allows the same path to have different targets for different HTTP methods. */
-    readonly methods?: readonly string[] | null;
-    /** The route to be added to the LiteLLM Proxy Server. */
-    readonly path: string;
-    /** The URL to which requests for this path should be forwarded. */
-    readonly target: string;
-    /** Upstream request timeout in seconds for this pass-through endpoint. If unset, uses general_settings.pass_through_request_timeout (default 600). */
-    readonly timeout?: number | null;
-}
-export interface PassThroughGuardrailSettings {
-    /** JSONPath expressions for input field targeting (pre_call). Examples: 'query', 'documents[*].text', 'messages[*].content'. If not specified, guardrail runs on entire request payload. */
-    readonly request_fields?: readonly string[] | null;
-    /** JSONPath expressions for output field targeting (post_call). Examples: 'results[*].text', 'output'. If not specified, guardrail runs on entire response payload. */
-    readonly response_fields?: readonly string[] | null;
-}
-//# sourceMappingURL=pass-through.d.ts.map

package/dist/litellm/generated/pass-through.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pass-through.d.ts","sourceRoot":"","sources":["../../../src/litellm/generated/pass-through.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAC3D;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,wPAAwP;IACxP,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACjF;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,kQAAkQ;IAClQ,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sJAAsJ;IACtJ,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,4LAA4L;IAC5L,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACnD,uKAAuK;IACvK,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACrD"}