@homeflare/alchemy 0.42.0 → 0.44.0

package/src/litellm/budget.test.ts

@@ -0,0 +1,105 @@
+/**
+ * `LiteLLM.Budget` through Alchemy's real Plan and Apply over the fake proxy.
+ */
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { FAKE_BASE, startFakeLitellm } from './fake-litellm.ts';
+import { fakeStack, writesOf } from './fake-stack.ts';
+import { type BudgetProps, LiteLLMBudget } from './budget.ts';
+import { differing, isHardCapUnjustified, toAttributes } from './budget-form.ts';
+
+const KEY = 'sk-test-master';
+const stack = (fake: ReturnType<typeof startFakeLitellm>) =>
+  fakeStack({ apiKey: KEY, baseUrl: FAKE_BASE }, fake.fetch);
+const declare = (props: BudgetProps, name = 'Tier') =>
+  Effect.gen(function* () {
+    yield* LiteLLMBudget(name, props);
+  });
+
+const tier = {
+  budget_id: 'hf-tier-agent',
+  budget_duration: '1d',
+  created_at: 'x',
+  max_budget: 2,
+  rpm_limit: '60',
+  soft_budget: null,
+  tpm_limit: null,
+  updated_at: 'x',
+};
+
+test('creates a soft-only budget and sends no max_budget', async () => {
+  const fake = startFakeLitellm({ masterKey: KEY });
+  const planned = await stack(fake).deploy(
+    declare({ budgetId: 'hf-tier-x', budgetDuration: '1d', softBudget: 50 }),
+  );
+  expect(planned).toEqual({ Tier: 'create' });
+  expect(fake.budgets()[0]).toMatchObject({ budget_id: 'hf-tier-x', soft_budget: 50 });
+  expect(fake.budgets()[0]).not.toHaveProperty('max_budget');
+});
+
+test('a second deploy of the same declaration writes nothing', async () => {
+  const fake = startFakeLitellm({ masterKey: KEY });
+  const props = { budgetId: 'hf-tier-x', softBudget: 50, rpmLimit: 60 };
+  const same = stack(fake);
+  await same.deploy(declare(props));
+  const before = fake.requests().length;
+  expect(await same.deploy(declare(props))).toEqual({ Tier: 'noop' });
+  expect(writesOf(fake.requests().slice(before))).toEqual([]);
+});
+
+test('a hard cap without a reason is refused before any write', async () => {
+  const fake = startFakeLitellm({ masterKey: KEY });
+  await expect(
+    stack(fake).deploy(declare({ budgetId: 'hf-tier-x', maxBudget: 60 })),
+  ).rejects.toThrow();
+  expect(writesOf(fake.requests())).toEqual([]);
+  expect(isHardCapUnjustified({ maxBudget: 1, maxBudgetReason: ' ' })).toBe(true);
+  expect(isHardCapUnjustified({ maxBudget: 1, maxBudgetReason: 'abuse guard' })).toBe(false);
+});
+
+test('a hard cap with a reason is written', async () => {
+  const fake = startFakeLitellm({ masterKey: KEY });
+  await stack(fake).deploy(
+    declare({ budgetId: 'hf-tier-x', maxBudget: 5, maxBudgetReason: 'public voice endpoint' }),
+  );
+  expect(fake.budgets()[0]).toMatchObject({ max_budget: 5 });
+});
+
+test('a live row is Unowned: refused without --adopt, taken with it', async () => {
+  const fake = startFakeLitellm({ masterKey: KEY, budgetSeed: [tier] });
+  const props = {
+    budgetId: 'hf-tier-agent',
+    budgetDuration: '1d',
+    maxBudget: 2,
+    maxBudgetReason: 'measured live',
+  };
+  const engine = stack(fake);
+  await expect(engine.deploy(declare(props))).rejects.toThrow();
+  expect(writesOf(fake.requests())).toEqual([]);
+  const planned = await engine.deploy(declare({ ...props, rpmLimit: 60 }), { adopt: true });
+  expect(Object.values(planned)).toEqual(['adopted']);
+});
+
+test('adopting a hard tier and declaring it soft clears max_budget', async () => {
+  const fake = startFakeLitellm({ masterKey: KEY, budgetSeed: [tier] });
+  await stack(fake).deploy(
+    declare({ budgetId: 'hf-tier-agent', budgetDuration: '1d', rpmLimit: 60, softBudget: 2 }),
+    { adopt: true },
+  );
+  expect(fake.budgets()[0]).toMatchObject({ max_budget: null, soft_budget: 2 });
+});
+
+test('a proxy that cannot clear a limit fails the apply instead of claiming success', async () => {
+  const fake = startFakeLitellm({ masterKey: KEY, budgetSeed: [tier], budgetExcludeNone: true });
+  await expect(
+    stack(fake).deploy(declare({ budgetId: 'hf-tier-agent', budgetDuration: '1d', rpmLimit: 60 }), {
+      adopt: true,
+    }),
+  ).rejects.toThrow();
+});
+
+test('form helpers: string limits become numbers, and differences are named', () => {
+  const live = toAttributes(tier);
+  expect(live.rpmLimit).toBe(60);
+  expect(differing(live, { budgetDuration: '1d', rpmLimit: 60 })).toEqual(['max_budget']);
+});

package/src/litellm/budget.ts

@@ -0,0 +1,127 @@
+/**
+ * `LiteLLM.Budget` — one row of LiteLLM's `LiteLLM_BudgetTable` (`/budget/*`), the "tier" keys and
+ * teams bind to (`hf-tier-*`).
+ *
+ * ★ MONITORING, NOT LIMITS (Tim, 2026-09-28): `softBudget` is the prop; `maxBudget` is a hard cap
+ *   that 429s every caller and is refused without `maxBudgetReason` (budget-form.ts).
+ * ★ ADOPT BY id. `budgetId` names the live row; without it a deterministic physical name is used.
+ *   A foreign row with that id is `Unowned`, so it needs `--adopt`.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a budget row that keys still reference either
+ *   fails or detaches them, and a detached key loses its rate limits. Opt in with
+ *   `.pipe(RemovalPolicy.destroy())`.
+ * ⛔ CLEARING A LIMIT: sent as an explicit `null`. If this LiteLLM merges with `exclude_none` the
+ *   row keeps the old value; reconcile reads back and FAILS (`LitellmBudgetFieldNotClearedError`)
+ *   rather than report a cleared cap. Unmeasured against a live proxy at 1.103.0.
+ * ⛔ NO CREDENTIAL IS A PROP; `litellmProviders`' layer supplies `Credentials`.
+ */
+import { Resource } from 'alchemy';
+import { Unowned } from 'alchemy/AdoptPolicy';
+import { isResolved } from 'alchemy/Diff';
+import type { Input } from 'alchemy/Input';
+import { createPhysicalName } from 'alchemy/PhysicalName';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import * as Predicate from 'effect/Predicate';
+import {
+  LitellmBudgetFieldNotClearedError,
+  LitellmBudgetHardCapUnjustifiedError,
+} from './budget-errors.ts';
+import {
+  type BudgetAttributes,
+  type BudgetProps,
+  createBody,
+  differing,
+  isHardCapUnjustified,
+  updateBody,
+} from './budget-form.ts';
+import { createBudget, deleteBudget, listBudgets, updateBudget } from './budget-operations.ts';
+
+export type { BudgetAttributes, BudgetProps };
+export type { BudgetError } from './budget-errors.ts';
+
+export interface LiteLLMBudget extends Resource<'LiteLLM.Budget', BudgetProps, BudgetAttributes> {}
+
+export const LiteLLMBudget = Resource<LiteLLMBudget>('LiteLLM.Budget', {
+  defaultRemovalPolicy: 'retain',
+});
+
+export const isLiteLLMBudget = (value: unknown): value is LiteLLMBudget =>
+  Predicate.hasProperty(value, 'Type') && value.Type === 'LiteLLM.Budget';
+
+const refuseUnjustifiedCap = (props: BudgetProps) =>
+  isHardCapUnjustified(props)
+    ? Effect.fail(new LitellmBudgetHardCapUnjustifiedError({ budgetId: props.budgetId }))
+    : Effect.void;
+
+const idOf = (
+  id: string,
+  instanceId: string,
+  props: BudgetProps,
+  output: BudgetAttributes | undefined,
+) =>
+  output?.budgetId !== undefined
+    ? Effect.succeed(output.budgetId)
+    : props.budgetId !== undefined
+      ? Effect.succeed(props.budgetId)
+      : createPhysicalName({ id, instanceId, lowercase: true, maxLength: 64 });
+
+type Args<P> = {
+  id: string;
+  instanceId: string;
+  output: BudgetAttributes | undefined;
+} & P;
+
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel. */
+export const budgetHandlers = {
+  read: ({ id, instanceId, olds, output }: Args<{ olds: BudgetProps }>) =>
+    Effect.gen(function* () {
+      const budgetId = yield* idOf(id, instanceId, olds, output);
+      const live = (yield* listBudgets()).find((row) => row.budgetId === budgetId);
+      if (live === undefined) return undefined;
+      return output === undefined ? Unowned(live) : live;
+    }),
+
+  diff: ({ news, output }: { news: Input<BudgetProps>; output: BudgetAttributes | undefined }) =>
+    Effect.gen(function* () {
+      if (!isResolved(news)) return undefined;
+      yield* refuseUnjustifiedCap(news);
+      if (output === undefined) return undefined;
+      // The id is identity: a different declared id is a different row.
+      if (news.budgetId !== undefined && news.budgetId !== output.budgetId) {
+        return { action: 'replace', deleteFirst: false } as const;
+      }
+      return differing(output, news).length === 0
+        ? ({ action: 'noop' } as const)
+        : ({ action: 'update' } as const);
+    }),
+
+  reconcile: ({ id, instanceId, news, output }: Args<{ news: BudgetProps }>) =>
+    Effect.gen(function* () {
+      yield* refuseUnjustifiedCap(news);
+      const budgetId = yield* idOf(id, instanceId, news, output);
+      const before = (yield* listBudgets()).find((row) => row.budgetId === budgetId);
+      if (before === undefined) yield* createBudget(createBody(news, budgetId));
+      else if (differing(before, news).length > 0) yield* updateBudget(updateBody(news, before));
+
+      const after = (yield* listBudgets()).find((row) => row.budgetId === budgetId);
+      if (after === undefined) {
+        return yield* Effect.die(
+          new Error(`LiteLLM.Budget ${budgetId}: write returned no error but the row is absent.`),
+        );
+      }
+      const left = differing(after, news);
+      if (left.length > 0) {
+        return yield* Effect.fail(
+          new LitellmBudgetFieldNotClearedError({ budgetId, fields: left }),
+        );
+      }
+      return after;
+    }),
+
+  delete: ({ output }: { output: BudgetAttributes }) => deleteBudget(output.budgetId),
+
+  list: () => Effect.succeed([]),
+};
+
+export const LiteLLMBudgetProvider = () =>
+  Provider.effect(LiteLLMBudget, Effect.succeed(LiteLLMBudget.Provider.of(budgetHandlers)));

package/src/litellm/credential-errors.ts

@@ -0,0 +1,183 @@
+/**
+ * The typed refusals `LiteLLM.Credential` raises on top of `@distilled.cloud/litellm`'s own SDK
+ * errors.
+ *
+ * ⛔ NO MESSAGE HERE MAY CARRY A CREDENTIAL VALUE: only the credential's NAME, field names, the
+ *   NAMES of environment variables, and SDK error text — exactly like mcp-server-errors.ts.
+ * ⚠️ THE SDK'S TYPED UNION IS NARROW ON PURPOSE, and the runtime is wider: the credential routes
+ *   declare only `UnprocessableEntity` (422) in `credential_management.ts`, so a create on an
+ *   existing name — which the live 1.103.0 container answers `409` (`endpoints.py`'s
+ *   `_credential_exists_detail`) — decodes at run time as the core `Conflict` class (`Errors.ts`
+ *   re-exports it, but it is not in the operation's TS union) and PROPAGATES as such, never
+ *   silently swallowed (S21). The read's and delete's `404` is TYPED as the SDK's
+ *   `CredentialNotFound` (a distilled patch matched on the vendor's "Credential not found"
+ *   message, `endpoints.py`), so credential-operations.ts `catchTag`s it instead of `instanceof`
+ *   `NotFound`: a 404 from a front proxy, Access, or a wrong base path stays a `NotFound` and is
+ *   never read as absence. `CredentialError` carries the typed members of the four operations the
+ *   resource calls (create, by-name read, PATCH, delete), plus the refusals below.
+ */
+import type * as credentials from '@distilled.cloud/litellm/credential_management';
+import * as Data from 'effect/Data';
+import type { HttpClientErrorReason } from 'effect/unstable/http/HttpClientError';
+
+/** A declaration the resource refuses before any request: a combination nobody meant. */
+export class LitellmCredentialInvalidError extends Data.TaggedError(
+  'LitellmCredentialInvalidError',
+)<{
+  readonly credentialName: string;
+  readonly problem: string;
+}> {
+  override get message(): string {
+    return `LiteLLM.Credential "${this.credentialName}": ${this.problem}.`;
+  }
+}
+
+/**
+ * A create's `POST /credentials` or an update's `PATCH /credentials/{name}` failed on the wire (or
+ * its answer could not be read), so nobody knows whether the credential is what was asked for.
+ *
+ * ⛔ THIS IS WHAT STANDS IN FOR AN `HttpClientError`, WHICH CARRIES ITS REQUEST, AND THE REQUEST
+ *   BODY OF A CREATE OR UPDATE IS `{"credential_name": …, "credential_values": {"api_key": "…"}}`.
+ *   Measured 2026-09-30: on a dropped connection `JSON.stringify(error)`, `Bun.inspect(error)` and
+ *   Effect's JSON logger all printed the value, as did a failed deploy over it — the same leak
+ *   key-operations.ts's `LitellmKeyTransportError` closes. A defect reading a broken answer
+ *   (`protocol-rest.ts` reads it `Effect.orDie`) carries the same request. So `reason` keeps the
+ *   `HttpClientError` reason's TAG (a string) and nothing else: no request, no cause, no
+ *   description. The credential NAME stays — it is not secret.
+ */
+export class LitellmCredentialTransportError extends Data.TaggedError(
+  'LitellmCredentialTransportError',
+)<{
+  readonly credentialName: string;
+  readonly reason: HttpClientErrorReason['_tag'] | 'Defect';
+}> {
+  override get message(): string {
+    return (
+      `LiteLLM.Credential "${this.credentialName}": a /credentials write failed ` +
+      `(${this.reason}) before an answer could be read, so the credential MAY have been written. ` +
+      'This error keeps neither the request nor its cause: the request body holds the credential ' +
+      'values. Look the name up in LiteLLM. A row that landed is taken over by the next deploy ' +
+      'with --adopt; one that did not is created by it.'
+    );
+  }
+}
+
+/**
+ * The SDK prints request and response bodies to stderr while `DISTILLED_DEBUG_HTTP` is set, and a
+ * `POST /credentials` carries the values in its body — refused before any request, exactly like
+ * `key-secret.ts`'s `refuseDebugLogging` for `/key/generate`.
+ */
+export class LitellmCredentialDebugLoggingError extends Data.TaggedError(
+  'LitellmCredentialDebugLoggingError',
+)<{
+  readonly credentialName: string;
+}> {
+  override get message(): string {
+    return (
+      `LiteLLM.Credential "${this.credentialName}": DISTILLED_DEBUG_HTTP is set, so the SDK ` +
+      "would print the credential values to stderr in /credentials' request and response. Unset " +
+      'it and run again. Nothing was written.'
+    );
+  }
+}
+
+/**
+ * A write had to send the credential values and the deploying process does not hold one or more
+ * of the declared variables. The names are listed, never a value.
+ */
+export class LitellmCredentialEnvUnsetError extends Data.TaggedError(
+  'LitellmCredentialEnvUnsetError',
+)<{
+  readonly credentialName: string;
+  readonly variables: readonly string[];
+}> {
+  override get message(): string {
+    return (
+      `LiteLLM.Credential "${this.credentialName}": ` +
+      `the deploying process does not set ${this.variables.join(', ')}.`
+    );
+  }
+}
+
+/**
+ * A credentials read answered something that is not a row of the credential table (or named a
+ * different row), so adopt-by-name cannot trust it. The by-name read is this resource's only
+ * read, so a row it cannot recognise is refused rather than guessed at.
+ */
+export class LitellmCredentialUnreadableError extends Data.TaggedError(
+  'LitellmCredentialUnreadableError',
+)<{
+  readonly reason: string;
+}> {
+  override get message(): string {
+    return `LiteLLM.Credential: a credentials read is unreadable (${this.reason}).`;
+  }
+}
+
+/**
+ * A create or update returned no error, yet the by-name read does not answer the credential — the
+ * proxy failed to record it in memory or in the DB. Refused instead of reported as done.
+ */
+export class LitellmCredentialAbsentAfterWriteError extends Data.TaggedError(
+  'LitellmCredentialAbsentAfterWriteError',
+)<{
+  readonly credentialName: string;
+}> {
+  override get message(): string {
+    return (
+      `LiteLLM.Credential "${this.credentialName}": the write returned no error but the ` +
+      'credential is absent from the by-name read.'
+    );
+  }
+}
+
+/**
+ * The write returned no error but the credential still differs from the declaration. The update
+ * path this resource uses is a PATCH merge (credential.ts, credential-operations.ts) — or a
+ * whole-row rewrite to drop a key — so a residual difference is refused here instead of being
+ * reported as converged.
+ */
+export class LitellmCredentialNotConvergedError extends Data.TaggedError(
+  'LitellmCredentialNotConvergedError',
+)<{
+  readonly credentialName: string;
+  readonly fields: readonly string[];
+}> {
+  override get message(): string {
+    return (
+      `LiteLLM.Credential "${this.credentialName}": after the write it still differs from the ` +
+      `declaration in ${this.fields.join(', ')}.`
+    );
+  }
+}
+
+/** A rewrite deleted the old row before its POST failed. Keep only the failure tag. */
+export class LitellmCredentialRewriteError extends Data.TaggedError(
+  'LitellmCredentialRewriteError',
+)<{
+  readonly credentialName: string;
+  readonly reason: string;
+}> {
+  override get message(): string {
+    return (
+      `LiteLLM.Credential "${this.credentialName}": DELETE already ran, but the replacement ` +
+      `POST failed (${this.reason}). The next deploy recreates the row if absent; keep all ` +
+      'declared credential variables set. If the POST landed despite the failure, the next ' +
+      'deploy reads and reconciles that row.'
+    );
+  }
+}
+
+export type CredentialError =
+  | credentials.CreateCredentialCredentialsPostError
+  | credentials.GetCredentialByNameCredentialsByNameCredentialNameGetError
+  | credentials.UpdateCredentialCredentialsCredentialNamePatchError
+  | credentials.DeleteCredentialCredentialsCredentialNameDeleteError
+  | LitellmCredentialInvalidError
+  | LitellmCredentialTransportError
+  | LitellmCredentialRewriteError
+  | LitellmCredentialDebugLoggingError
+  | LitellmCredentialEnvUnsetError
+  | LitellmCredentialUnreadableError
+  | LitellmCredentialAbsentAfterWriteError
+  | LitellmCredentialNotConvergedError;

package/src/litellm/credential-form.test.ts

@@ -0,0 +1,151 @@
+/**
+ * `credential-form.ts`'s refusals, read shape and comparison — pure: no server, no environment
+ * (the values' own behaviour is credential-values.ts's, tested through the resource test).
+ *
+ * ★ EVERY VALUE IS `FAKE-*`.
+ */
+import { expect, test } from 'bun:test';
+import * as Redacted from 'effect/Redacted';
+import {
+  createBody,
+  differing,
+  firstProblem,
+  isCredentialRow,
+  literalValues,
+  patchBody,
+  removedInfoKeys,
+  toAttributes,
+} from './credential-form.ts';
+import type { CredentialAttributes, CredentialProps } from './credential-types.ts';
+import type { ResolvedValues } from './credential-values.ts';
+
+const VARIABLE = 'FAKE_CREDENTIAL_KEY';
+const base: CredentialProps = {
+  credentialInfo: { note: 'docs search' },
+  credentialName: 'FAKE_api',
+  credentialValues: { api_key: { fromEnv: VARIABLE } },
+};
+
+/** Live attributes as the resource would hold them, over a metadata map. */
+const attributes = (info: Record<string, unknown>, seal = ''): CredentialAttributes => ({
+  credentialInfo: info,
+  credentialName: 'FAKE_api',
+  valuesSeal: seal,
+});
+
+test('firstProblem refuses the combinations nobody meant', () => {
+  const cases: readonly [label: string, props: CredentialProps, fragment: string][] = [
+    ['a blank name', { ...base, credentialName: '  ' }, 'credentialName'],
+    ['a padded name', { ...base, credentialName: ' FAKE_api' }, 'credentialName'],
+    ['a non-object metadata map', { ...base, credentialInfo: null as never }, 'credentialInfo'],
+    [
+      'a sensitive metadata key',
+      { ...base, credentialInfo: { authToken: 'FAKE-meta' } },
+      'authToken',
+    ],
+    ['an empty values map', { ...base, credentialValues: {} }, 'credentialValues'],
+    [
+      'a padded values key',
+      { ...base, credentialValues: { ' key': { fromEnv: VARIABLE } } },
+      'credentialValues',
+    ],
+    [
+      'a literal value',
+      { ...base, credentialValues: { api_key: 'FAKE-literal' as never } },
+      'credentialValues',
+    ],
+    [
+      'a blank variable name',
+      { ...base, credentialValues: { api_key: { fromEnv: ' ' } } },
+      'credentialValues',
+    ],
+  ];
+  for (const [label, props, fragment] of cases) {
+    expect(firstProblem(props), label).toContain(fragment);
+  }
+  expect(firstProblem(base)).toBeUndefined();
+});
+
+test('toAttributes mirrors only the metadata the vendor answers unmasked, and no values at all', () => {
+  const live = toAttributes({
+    credential_info: { note: 'docs search', aws_secret: 'FAKE-clear-in-info' },
+    credential_name: 'FAKE_api',
+    credential_values: { api_key: 'FA****ey', region: 'us-east' },
+  });
+  expect(live).toEqual({
+    credentialInfo: { note: 'docs search' },
+    credentialName: 'FAKE_api',
+    valueKeys: ['api_key', 'region'],
+    infoKeys: ['aws_secret', 'note'],
+    valuesSeal: '',
+  });
+});
+
+test('differing compares per declared key only, deeply, ignoring object key order', () => {
+  // This helper checks declared values; removedInfoKeys separately detects undeclared live keys.
+  expect(differing(attributes({ note: 'docs search', extra: 'live' }), base)).toEqual([]);
+  expect(differing(attributes({ note: 'docs search v2', extra: 'live' }), base)).toEqual([
+    'credential_info.note',
+  ]);
+  expect(differing(attributes({}), base)).toEqual(['credential_info.note']);
+  const nested = { ...base, credentialInfo: { scopes: ['read', 'write'], vendor: { a: 1, b: 2 } } };
+  // object key order never matters; array order does — an array is an ordered list in JSON
+  expect(
+    differing(attributes({ scopes: ['read', 'write'], vendor: { b: 2, a: 1 } }), nested),
+  ).toEqual([]);
+  expect(
+    differing(attributes({ scopes: ['write', 'read'], vendor: { a: 1, b: 2 } }), nested),
+  ).toEqual(['credential_info.scopes']);
+  expect(differing(attributes({ scopes: ['read'], vendor: { a: 1, b: 2 } }), nested)).toEqual([
+    'credential_info.scopes',
+  ]);
+});
+
+test('isCredentialRow accepts only a row with a string name', () => {
+  expect(isCredentialRow({ credential_name: 'FAKE_api' })).toBe(true);
+  expect(isCredentialRow({ credential_values: {} })).toBe(false);
+  expect(isCredentialRow('not a row')).toBe(false);
+  expect(isCredentialRow(null)).toBe(false);
+});
+
+test('createBody carries the name in the body and the values as literals, unwrapped once', () => {
+  const resolved: ResolvedValues = {
+    missing: [],
+    values: { api_key: Redacted.make('FAKE-key-one') },
+  };
+  expect(literalValues(resolved)).toEqual({ api_key: 'FAKE-key-one' });
+  const body = createBody(base, resolved);
+  expect(body).toEqual({
+    credential_info: { note: 'docs search' },
+    credential_name: 'FAKE_api',
+    credential_values: { api_key: 'FAKE-key-one' },
+  });
+  // the body carries the VALUE the proxy stores, never the variable NAME the declaration holds
+  expect(JSON.stringify(body)).not.toContain(VARIABLE);
+});
+
+test('patchBody carries the name twice (path label and body field) and the info, values optional', () => {
+  expect(patchBody(base, undefined)).toEqual({
+    credential_info: { note: 'docs search' },
+    credential_name: 'FAKE_api',
+    credential_name_body: 'FAKE_api',
+  });
+  expect(patchBody(base, { api_key: 'FAKE-key-one' })).toEqual({
+    credential_info: { note: 'docs search' },
+    credential_name: 'FAKE_api',
+    credential_name_body: 'FAKE_api',
+    credential_values: { api_key: 'FAKE-key-one' },
+  });
+  // the body carries the VALUE, never the variable NAME the declaration holds
+  expect(JSON.stringify(patchBody(base, { api_key: 'FAKE-key-one' }))).not.toContain(VARIABLE);
+});
+
+test('removedInfoKeys finds live keys absent from the full intended info map', () => {
+  const prior = attributes({ note: 'docs search', team: 'a' });
+  expect(removedInfoKeys(prior, base)).toEqual(['team']);
+  expect(
+    removedInfoKeys(prior, { ...base, credentialInfo: { note: 'docs search', team: 'a' } }),
+  ).toEqual([]);
+  // No live row means there is nothing to remove.
+  expect(removedInfoKeys(undefined, base)).toEqual([]);
+});