@homeflare/alchemy 0.42.0 → 0.44.0

package/dist/litellm/credential-operations.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The `@distilled.cloud/litellm/credential_management` calls `LiteLLM.Credential` uses
+ * (LiteLLM 1.103.0; names verified in the generated source, never guessed):
+ *
+ *   read    `getCredentialByNameCredentialsByNameCredentialNameGet`  GET     /credentials/by_name/{name}
+ *   create  `createCredentialCredentialsPost`                        POST    /credentials
+ *   update  `updateCredentialCredentialsCredentialNamePatch`        PATCH   /credentials/{name}
+ *   delete  `deleteCredentialCredentialsCredentialNameDelete`        DELETE  /credentials/{name}
+ *
+ * ★ THE UPDATE IS A PATCH, NOT A REWRITE. The vendor's PATCH merges value keys; nonempty info
+ *   normally replaces the DB map but merges in memory (`endpoints.py:312-319,384-387`, 1.103.0).
+ *   The body carries `credential_name` as a second member
+ *   (`credential_name_body`, wire-named `credential_name`) because the vendor's
+ *   `UpdateCredentialItem` requires it in the body and a Smithy member has one binding — the
+ *   distilled patch `patches/credential_management/update_credential_credentials__credential_name__patch.json`.
+ *   A PATCH that fails on the wire leaves the row it was merging into, where the old DELETE + POST
+ *   rewrite left NO row when the POST failed after the DELETE (review finding 3). credential.ts
+ *   still rewrites to drop value or info keys, since PATCH cannot remove them from both stores.
+ * ⛔ NO MESSAGE SNIFFING (S21). The read's and delete's `404` is typed as the SDK's
+ *   `CredentialNotFound` (a distilled patch matched on the vendor's "Credential not found" message,
+ *   `endpoints.py`), so absence is that TAG, `catchTag`ed — never `instanceof`, never error text. A
+ *   404 from a front proxy, Access, or a wrong base path decodes as core's `NotFound` and stays an
+ *   error, never absence. A create on a name the DB already has answers `409` (`endpoints.py`'s
+ *   unique-violation handling), decoded as core `Conflict`, and is PROPAGATED: a row another writer
+ *   raced in is not this declaration's row. The PATCH's own 404 (message `Credential not found in
+ *   DB.`) is NOT `CredentialNotFound`: it stays core `NotFound`, an error — a row deleted between
+ *   the read and the PATCH must not silently read as absence.
+ * ⚠️ THE READ AND THE DELETE ASK DIFFERENT STORES (measured, `endpoints.py`): the by-name read
+ *   walks the proxy's IN-MEMORY `credential_list` (a row the proxy has not loaded answers 404),
+ *   while the delete consults the DATABASE (`delete_by_name`) and removes the in-memory entry
+ *   after. A row present in the DB but not loaded in memory reads as ABSENT, and a create for it
+ *   answers `409` — the resource reports that failure loudly instead of pretending to converge.
+ * ⚠️ Unlike pass-through endpoints, each credential is its own DB row: no semaphore.
+ */
+import * as credentials from '@distilled.cloud/litellm/credential_management';
+import * as Effect from 'effect/Effect';
+import type { CredentialAttributes } from './credential-types.ts';
+import { LitellmCredentialDebugLoggingError, LitellmCredentialTransportError, LitellmCredentialUnreadableError } from './credential-errors.ts';
+import { type LitellmOpContext } from './operations.ts';
+/**
+ * One credential by name, or `undefined` when the proxy does not hold it in memory. ⛔ ANY FAILURE
+ * OTHER THAN `CredentialNotFound` PROPAGATES: a 401, a 422 or a dead network says nothing about
+ * whether the row exists, and must never be read as absence.
+ */
+export declare const readCredential: (credentialName: string) => Effect.Effect<CredentialAttributes | undefined, credentials.GetCredentialByNameCredentialsByNameCredentialNameGetError | LitellmCredentialUnreadableError, LitellmOpContext>;
+/**
+ * POST /credentials. The answer carries no row (`{"success": true, ...}`), so the read back is the
+ * proof.
+ *
+ * ⛔ THE REQUEST BODY CARRIES THE VALUES, AND A FAILED CALL CAN CARRY ITS REQUEST — exactly the
+ *   `{"key":"sk-…"}` leak `generateKey` (key-operations.ts) closes, and it is closed the same way:
+ *   a transport failure is an `HttpClientError` in the error channel, a body that fails mid-read is
+ *   the SAME error as a DEFECT (`Effect.orDie` in core's `protocol-rest.ts`). Both become
+ *   `LitellmCredentialTransportError`, which keeps the NAME and the reason's tag and nothing else.
+ * ⛔ RECONCILE REFUSES WHILE `DISTILLED_DEBUG_HTTP` IS SET, before any request: the SDK prints
+ *   the first 400 characters of every request body (core `protocol-http.ts`), which would put the values on
+ *   stderr — the same refusal `key-secret.ts` makes for `/key/generate`.
+ */
+export declare const createCredential: (body: credentials.CreateCredentialCredentialsPostRequest) => Effect.Effect<void, credentials.CreateCredentialCredentialsPostError | LitellmCredentialTransportError, LitellmOpContext>;
+/**
+ * PATCH /credentials/{name}. Sends the full intended `credential_info` (DB replacement, memory
+ * merge) and merges resolved `credential_values` when present. The answer carries no row
+ * (`{"success": true, ...}`), so the read back is the proof.
+ *
+ * ⛔ THE SAME TWO GUARDS AS `createCredential`: the body carries the values, so a transport failure
+ *   becomes a `LitellmCredentialTransportError` that keeps the NAME and the reason's tag and
+ *   nothing else, and reconcile refuses while `DISTILLED_DEBUG_HTTP` is set (the SDK would print
+ *   the values). A PATCH that fails on the wire leaves the row in place — the point of using it
+ *   over a DELETE + POST rewrite.
+ */
+export declare const updateCredential: (body: credentials.UpdateCredentialCredentialsCredentialNamePatchRequest) => Effect.Effect<void, credentials.UpdateCredentialCredentialsCredentialNamePatchError | LitellmCredentialTransportError, LitellmOpContext>;
+/**
+ * DELETE /credentials/{name}, idempotent BY THIS FUNCTION: the vendor answers 404 for a name its
+ * database does not have, which this treats as already-absent — the DB is the authoritative store
+ * the delete consults (the read consults memory, see the header). Any other failure propagates.
+ */
+export declare const deleteCredential: (credentialName: string) => Effect.Effect<void, credentials.DeleteCredentialCredentialsCredentialNameDeleteError, LitellmOpContext>;
+/**
+ * Whether `DISTILLED_DEBUG_HTTP` is set, refused once at the top of reconcile, before even a
+ * DELETE can run (the following POST would carry values). Reads `process.env` because that is
+ * what the SDK's `protocol-http.ts` reads.
+ */
+export declare const refuseDebugLogging: (credentialName: string) => Effect.Effect<void, LitellmCredentialDebugLoggingError>;
+//# sourceMappingURL=credential-operations.d.ts.map

package/dist/litellm/credential-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-operations.d.ts","sourceRoot":"","sources":["../../src/litellm/credential-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,WAAW,MAAM,gDAAgD,CAAC;AAC9E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,kCAAkC,EAClC,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,cAAc,mBACT,MAAM,KACrB,MAAM,CAAC,MAAM,CACd,oBAAoB,GAAG,SAAS,EAC9B,WAAW,CAAC,0DAA0D,GACtE,gCAAgC,EAClC,gBAAgB,CA4Bf,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,SACrB,WAAW,CAAC,sCAAsC,KACvD,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,WAAW,CAAC,oCAAoC,GAAG,+BAA+B,EAClF,gBAAgB,CAuBjB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,SACrB,WAAW,CAAC,qDAAqD,KACtE,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,WAAW,CAAC,mDAAmD,GAAG,+BAA+B,EACjG,gBAAgB,CAuBjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,mBACX,MAAM,KACrB,MAAM,CAAC,MAAM,CACd,IAAI,EACJ,WAAW,CAAC,oDAAoD,EAChE,gBAAgB,CASf,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,mBACb,MAAM,KACrB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,kCAAkC,CAGxC,CAAC"}

package/dist/litellm/credential-rewrite.d.ts

@@ -0,0 +1,6 @@
+import type * as credentials from '@distilled.cloud/litellm/credential_management';
+import * as Effect from 'effect/Effect';
+import { LitellmCredentialRewriteError } from './credential-errors.ts';
+import type { LitellmOpContext } from './operations.ts';
+export declare const rewriteCredential: (body: credentials.CreateCredentialCredentialsPostRequest) => Effect.Effect<void, LitellmCredentialRewriteError | credentials.DeleteCredentialCredentialsCredentialNameDeleteError, LitellmOpContext>;
+//# sourceMappingURL=credential-rewrite.d.ts.map

package/dist/litellm/credential-rewrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-rewrite.d.ts","sourceRoot":"","sources":["../../src/litellm/credential-rewrite.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,WAAW,MAAM,gDAAgD,CAAC;AACnF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,6BAA6B,EAE9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,eAAO,MAAM,iBAAiB,SAAU,WAAW,CAAC,sCAAsC,4IAsCtF,CAAC"}

package/dist/litellm/credential-types.d.ts

@@ -0,0 +1,87 @@
+/**
+ * What `LiteLLM.Credential` declares (props) and what is remembered about it (attributes).
+ *
+ * ⛔ NO CREDENTIAL VALUE IS EVER A PROP OR AN ATTRIBUTE (S25). Alchemy persists props AND
+ *   attributes unencrypted (`StateEncoding.ts` writes a `Redacted` value's inner string beside
+ *   the tag — `secrets/write-only.ts`, measured on alchemy 2.0.0-beta.79), and LiteLLM stores a
+ *   credential's values ENCRYPTED in its database while the reads answer them MASKED, so a value
+ *   the declaration holds is `{ fromEnv: 'NAME' }` — NAME lands in state, and the value is read
+ *   from the DEPLOYING process's environment only when a write is being made
+ *   (`credential-values.ts`, the same shape `McpServerProps.authValue` uses). Unlike a model
+ *   deployment's `os.environ/NAME` reference (the PROXY resolves that in its own environment),
+ *   the credential table stores LITERAL values — measured in the live 1.103.0 container
+ *   (`credential_endpoints/endpoints.py`: `create_credential` encrypts the body's
+ *   `credential_values` before the insert, `CredentialsRepository.create`) — so the proxy could
+ *   not resolve a reference here even if one were sent.
+ * ⛔ THE LIVE ROW'S MASKED VALUES ARE NEVER MIRRORED INTO ATTRIBUTES. Both reads answer
+ *   `credential_values` with every SENSITIVE-keyed value masked (the vendor's own rule,
+ *   `_get_masked_values` in `litellm_logging.py`: a key matching `authorization`, `token`, `key`,
+ *   `secret`, `vertex_credentials`, `credentials`, `password` or `passwd` — substring,
+ *   case-insensitive — answers `v[:2] + "****" + v[-2:]` for a string longer than four
+ *   characters, `*****` otherwise; non-string values and non-sensitive keys answer in full).
+ *   A masked fragment (`sk****45`) is a PARTIAL SECRET, so `toAttributes` copies no
+ *   `credential_values` entry at all (`credential-form.ts`); what was last written is remembered
+ *   as the digest of the values this process RESOLVED, `valuesSeal` — never the values.
+ * ⚠️ `credential_info` IS THE COMPLETE INTENDED MAP, INCLUDING ON ADOPTION. Measured in
+ *   LiteLLM 1.103.0 `credential_endpoints/endpoints.py:314-319`: a nonempty PATCH normally resets
+ *   the DB info map (except when it contains a literal `credential_info` key); an empty patch
+ *   leaves it alone. Memory only merges (:385-387), retaining removed keys until restart.
+ *   Therefore removing any live info key requires a rewrite; every PATCH sends the full map.
+ *   Sensitive info keys are refused at plan time because the vendor returns info UNMASKED.
+ *   Reads retain their NAMES only, so removal can converge without persisting their values.
+ */
+import type { FromEnv } from '../secrets/write-only.ts';
+/**
+ * The credential's name — its identity in the vendor's table (a unique column, enforced by the
+ * database, `schema.prisma`'s `Credentials` model). ADOPTED: the live row whose `credential_name`
+ * equals it. ⛔ A RENAMED ROW IS A DIFFERENT CREDENTIAL: the name is the only address the vendor's
+ * routes have, so a changed `credentialName` plans a REPLACE — the old row survives under the
+ * resource's default `retain` policy, never renamed in place.
+ */
+export interface CredentialProps {
+    readonly credentialName: string;
+    /**
+     * Free-form metadata stored beside the values (`credential_info` in the vendor's row), compared
+     * as the complete intended map with canonical-JSON deep equality (omitted means empty). ⛔ Refused for a key matching the vendor's
+     * own sensitive-key list: those belong in `credentialValues`, where LiteLLM stores them
+     * encrypted and answers them masked — in `credential_info` they would be stored in clear.
+     */
+    readonly credentialInfo?: Readonly<Record<string, unknown>>;
+    /**
+     * The credential's values, each declared as `{ fromEnv: 'NAME' }` naming the environment
+     * variable the DEPLOYING process reads at call time. AT LEAST ONE is required: LiteLLM's create
+     * model refuses a body whose `credential_values` and `model_id` are both empty
+     * (`models/credentials.py`'s `CreateCredentialItem` validator → 422), and `model_id` — which
+     * would copy a deployment's values — is not modelled here, so a value-less declaration has
+     * nothing to write. A value that never resolves in a plan-only environment never drifts
+     * (credential-values.ts); one that resolves is SENT as the literal the proxy stores encrypted.
+     */
+    readonly credentialValues: Readonly<Record<string, FromEnv>>;
+}
+export interface CredentialAttributes {
+    readonly credentialName: string;
+    /**
+     * The row's `credential_info` as the read answers it, minus any SENSITIVE-KEYED entry — those
+     * would mirror a clear secret into Alchemy's state and are skipped (`toAttributes`). The digest
+     * comparison removes undeclared live keys, including on adoption (credential-form.ts).
+     */
+    readonly credentialInfo: Readonly<Record<string, unknown>>;
+    /**
+     * `scrypt:<salt>:<digest>` of the values the LAST WRITE resolved — the only way a plan notices
+     * a rotated credential, because the live row answers masked fragments that can never be
+     * compared (`secrets/write-only.ts`). An ADOPTED row starts `''`, which reads as `stale`.
+     */
+    readonly valuesSeal: string;
+    /** Names only, never masked fragments. Optional for states written by older providers. */
+    readonly valueKeys?: readonly string[];
+    /** All info key names, including withheld sensitive entries; optional for older states. */
+    readonly infoKeys?: readonly string[];
+}
+/**
+ * Whether a value is not a string with something in it. Takes `unknown`: a declaration can say
+ * anything. (Same rule as model-types.ts and registry-support.ts.)
+ */
+export declare const isBlank: (value: unknown) => boolean;
+/** Whether a key is one the vendor itself treats as sensitive. */
+export declare const isSensitiveKey: (key: string) => boolean;
+//# sourceMappingURL=credential-types.d.ts.map

package/dist/litellm/credential-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-types.d.ts","sourceRoot":"","sources":["../../src/litellm/credential-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE5D;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3D;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;GAGG;AACH,eAAO,MAAM,OAAO,UAAW,OAAO,KAAG,OACS,CAAC;AAmBnD,kEAAkE;AAClE,eAAO,MAAM,cAAc,QAAS,MAAM,KAAG,OAG5C,CAAC"}

package/dist/litellm/credential-values.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The values of a `LiteLLM.Credential` — resolved from the deploying process's environment at
+ * call time, held as `Redacted`, and compared by seal.
+ *
+ * ★ THIS IS THE CREDENTIAL LITELLM STORES, so the deploying process holds the value: the wire
+ *   body carries the LITERAL (the proxy encrypts it into its database, measured in the live
+ *   1.103.0 container — `credential_endpoints/endpoints.py`'s `encrypt_credential_values`), which
+ *   is exactly why the prop is only a NAME (`credential-types.ts`). Inside this process the value
+ *   is a `Redacted<string>`, so a stray log or error dump prints `<redacted>`; it is unwrapped in
+ *   exactly one place, the wire body (credential-form.ts). Never a prop or an attribute.
+ * ⚠️ LITELLM DOES NOT HAND THE VALUES BACK TO COMPARE WITH: both reads answer them MASKED
+ *   (2 + `****` + 2, `*****` for a short string — `litellm_logging.py::_get_masked_values`), and a
+ *   masked fragment is a partial secret that must never be compared or stored. So what was last
+ *   written is remembered as a SEAL, and a plan asks "are the values in my environment the ones I
+ *   wrote". Four answers, mcp-server-credential.ts's own list:
+ *   - `none`    — no values are declared, nothing to compare.
+ *   - `unknown` — one or more declared variables is unset here, so a plan cannot tell. Never
+ *                 drift: a plan-only environment must not report every credentialed row as
+ *                 changed. A WRITE still demands them (`requireValues`).
+ *   - `stale`   — every variable is set and there is no seal (an adopted row, or one written
+ *                 outside this stack) or the seal disagrees. The declaration is authoritative,
+ *                 so it is written.
+ *   - `match`   — the seal was made from exactly these resolved values.
+ * ⚠️ ALL-OR-NOTHING RESOLUTION: a write sends `credential_values` only when EVERY declared
+ *   variable resolves — the values-stale PATCH and the whole-row create both demand every value
+ *   (`requireValues`, credential.ts), because sending the resolved half would store a row whose
+ *   unset half was silently blanked. When any variable is missing the state is `unknown`: an
+ *   info-only PATCH can proceed, but a required rewrite refuses before DELETE.
+ * ⚠️ A SEAL OF A GUESSABLE SECRET IS STILL GUESSABLE (secrets/write-only.ts). Use a random token.
+ */
+import * as Effect from 'effect/Effect';
+import * as Redacted from 'effect/Redacted';
+import { type Environment } from '../secrets/write-only.ts';
+import { LitellmCredentialEnvUnsetError } from './credential-errors.ts';
+import type { CredentialProps } from './credential-types.ts';
+/** What the environment holds for the declared values. `missing` names the unset variables. */
+export interface ResolvedValues {
+    readonly values: Readonly<Record<string, Redacted.Redacted<string>>>;
+    readonly missing: readonly string[];
+}
+export type CredentialValuesState = 'none' | 'unknown' | 'stale' | 'match';
+/** ⛔ Reads the environment at CALL time, never at module load (docs/credentials.md). */
+export declare const resolveValues: (props: CredentialProps, env?: Environment) => ResolvedValues;
+/** `scrypt:<salt>:<digest>` of the resolved values, for `valuesSeal`. ⛔ Never a value. */
+export declare const sealValues: (values: Readonly<Record<string, Redacted.Redacted<string>>>) => string;
+export declare const valuesState: (props: CredentialProps, sealed: string, resolved?: ResolvedValues) => CredentialValuesState;
+/**
+ * Fails naming the missing variables when this write has to send the values and the deploying
+ * process does not hold them all. Creates, rewrites and value-stale PATCHes need every value;
+ * an info-only PATCH leaves values alone and does not need this guard (credential.ts).
+ */
+export declare const requireValues: (props: CredentialProps, resolved: ResolvedValues) => Effect.Effect<void, LitellmCredentialEnvUnsetError>;
+//# sourceMappingURL=credential-values.d.ts.map

package/dist/litellm/credential-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-values.d.ts","sourceRoot":"","sources":["../../src/litellm/credential-values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,WAAW,EAAiC,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,+FAA+F;AAC/F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE3E,wFAAwF;AACxF,eAAO,MAAM,aAAa,UACjB,eAAe,QACjB,WAAW,KACf,cAQF,CAAC;AAKF,0FAA0F;AAC1F,eAAO,MAAM,UAAU,WAAY,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAG,MACjE,CAAC;AAEzB,eAAO,MAAM,WAAW,UACf,eAAe,UACd,MAAM,aACJ,cAAc,KACvB,qBAMF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,UACjB,eAAe,YACZ,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,8BAA8B,CAQ9C,CAAC"}

package/dist/litellm/credential.d.ts

@@ -0,0 +1,83 @@
+/**
+ * `LiteLLM.Credential` — one row of LiteLLM's reusable credential table (`/credentials/*`), a
+ * named bag of values the proxy stores encrypted and can bind to a deployment by `model_id`.
+ *
+ * ★ ADOPT BY NAME. `credentialName` finds the live row whose `credential_name` equals it; a live
+ *   row with no state is `Unowned`, so it needs `--adopt`. The name is the vendor's only address
+ *   (the table's unique column, `schema.prisma`), so a row is located by the by-name read and
+ *   never guessed at.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a credential a deployment references would break
+ *   that deployment's next call. Opt in with `.pipe(RemovalPolicy.destroy())`.
+ * ⛔ THE VALUES ARE `{ fromEnv: 'NAME' }`, NEVER A VALUE (S25): LiteLLM STORES these literals
+ *   (encrypted at rest), so the deploying process must hold them — credential-types.ts carries the
+ *   full reasoning, and a `model` deployment's `os.environ/NAME` reference is the opposite case.
+ *   A plan compares the live row's `credential_info` per declared key and the values through a
+ *   digest of what was resolved (`valuesSeal`); it never compares the masked read, and a value
+ *   whose variable is unset never drifts a plan-only environment (credential-values.ts).
+ * ⚠️ A RENAME IS A REPLACE: the name is the row's identity and its only address, so a changed
+ *   `credentialName` creates the new row and the old one survives under 'retain' — never renamed
+ *   in place.
+ * ⚠️ A CHANGED ROW IS PATCHED, NOT REWRITTEN — PATCH merges values and normally replaces DB
+ *   info, but only merges in-memory info (1.103.0 credential_endpoints/endpoints.py:312-319,384-387).
+ *   A failed PATCH leaves the row behind (review finding 3: DELETE + POST left NO row when POST
+ *   failed). Dropping a value key OR an info key still requires DELETE + POST; both stores must
+ *   converge. All refusals run before the first write. Every write reads back to prove removal.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { LitellmCredentialAbsentAfterWriteError, LitellmCredentialInvalidError, LitellmCredentialNotConvergedError } from './credential-errors.ts';
+import type { CredentialAttributes, CredentialProps } from './credential-types.ts';
+export type { CredentialAttributes, CredentialProps };
+export type { CredentialError } from './credential-errors.ts';
+export interface LiteLLMCredential extends Resource<'LiteLLM.Credential', CredentialProps, CredentialAttributes> {
+}
+export declare const LiteLLMCredential: import("alchemy").ResourceClass<LiteLLMCredential>;
+export declare const isLiteLLMCredential: (value: unknown) => value is LiteLLMCredential;
+type Args<P> = {
+    fqn: string;
+    instanceId: string;
+    output: CredentialAttributes | undefined;
+} & P;
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel. */
+export declare const credentialHandlers: {
+    /**
+     * ⛔ WITH NO `output` THIS IS ALCHEMY'S ADOPTION PROBE, AND THE ONLY PLAN-TIME HOOK A NEW
+     *   CREDENTIAL GETS — so the refusals run here too, as a defect (mcp-server.ts's own rule: the
+     *   cold-start probe must fail the plan, and a recovery read must degrade to "nothing
+     *   recovered", which only a defect does).
+     */
+    read: ({ olds, output }: Args<{
+        olds: CredentialProps;
+    }>) => Effect.Effect<CredentialAttributes | undefined, import("./credential-errors.ts").LitellmCredentialDebugLoggingError | import("./credential-errors.ts").LitellmCredentialUnreadableError | import("@distilled.cloud/litellm/credential_management").GetCredentialByNameCredentialsByNameCredentialNameGetError, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    diff: ({ news, output, }: {
+        news: Input<CredentialProps>;
+        output: CredentialAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+        readonly deleteFirst: false;
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'noop';
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'update';
+    } | undefined, LitellmCredentialInvalidError, never>;
+    reconcile: ({ fqn, instanceId, news, output }: Args<{
+        news: CredentialProps;
+    }>) => Effect.Effect<{
+        credentialName: string;
+        credentialInfo: Readonly<Record<string, unknown>>;
+        valueKeys?: readonly string[];
+        infoKeys?: readonly string[];
+        valuesSeal: string;
+    }, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/litellm/credential_management").CredentialNotFound | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | LitellmCredentialAbsentAfterWriteError | import("./credential-errors.ts").LitellmCredentialDebugLoggingError | import("./credential-errors.ts").LitellmCredentialEnvUnsetError | LitellmCredentialInvalidError | LitellmCredentialNotConvergedError | import("./credential-errors.ts").LitellmCredentialRewriteError | import("./credential-errors.ts").LitellmCredentialTransportError | import("./credential-errors.ts").LitellmCredentialUnreadableError | import("@distilled.cloud/litellm/Errors").LitellmParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | import("@distilled.cloud/litellm/credential_management").UnprocessableEntity, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    delete: ({ output }: {
+        output: CredentialAttributes;
+    }) => Effect.Effect<void, import("@distilled.cloud/litellm/credential_management").DeleteCredentialCredentialsCredentialNameDeleteError, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    /** ⛔ EMPTY: adoption is an explicit act (`--adopt`), and no ownership mark exists to filter by. */
+    list: () => Effect.Effect<never[], never, never>;
+};
+export declare const LiteLLMCredentialProvider: () => import("effect/Layer").Layer<Provider.Provider<LiteLLMCredential>, never, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+//# sourceMappingURL=credential.d.ts.map

package/dist/litellm/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/litellm/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EACL,sCAAsC,EACtC,6BAA6B,EAC7B,kCAAkC,EACnC,MAAM,wBAAwB,CAAC;AAiBhC,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAInF,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,mBAAmB,UAAW,OAAO,KAAG,KAAK,IAAI,iBACe,CAAC;AAc9E,KAAK,IAAI,CAAC,CAAC,IAAI;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC;CAC1C,GAAG,CAAC,CAAC;AAEN,oDAAoD;AACpD,eAAO,MAAM,kBAAkB;IAC7B;;;;;OAKG;IACH,IAAI,qBAAqB,IAAI,CAAC;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IAmBxD,IAAI,sBAGD;QACD,IAAI,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7B,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC;KAC1C;yBAOsB,SAAS;;;;yBASb,MAAM;;;yBACN,QAAQ;;IAG3B,SAAS,sCAAsC,IAAI,CAAC;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;;;;;;;IAuE9E,MAAM,eAAe;QAAE,MAAM,EAAE,oBAAoB,CAAA;KAAE;IAErD,mGAAmG;IACnG,IAAI;CACL,CAAC;AAEF,eAAO,MAAM,yBAAyB,+IAInC,CAAC"}

package/dist/litellm/fake-access-group-litellm.d.ts

@@ -0,0 +1,34 @@
+/**
+ * A fake of LiteLLM's `/v1/unified_access_group` routes for tests — TEST ONLY. Skeleton and the
+ * rules every fake follows: fake-registry-base.ts.
+ *
+ * ★ MEASURED FROM THE LIVE 1.103.0 CONTAINER'S SOURCE (2026-09-30, `access_group_endpoints.py`, read,
+ *   not called): the name is UNIQUE (a create or a rename onto a taken name is a 409); a create
+ *   answers 201 with the row; the update is partial (`exclude_unset`) and turns a `null` list into
+ *   `[]`; a delete answers 204 with NO BODY and a missing id is a 404; writes need PROXY_ADMIN
+ *   (`forbidWrites` models the 403). The list is the table.
+ * ⚠️ NOT MODELLED: `assigned_team_ids` / `assigned_key_ids` mirroring into teams and keys (the fake
+ *   keeps the arrays and does nothing with them), and the display-name expansion of the response.
+ *   `dropModel` models `access_group_model_sync.py`: LiteLLM itself removes a model name from a group
+ *   when its last deployment goes, which is the drift source the docs warn about.
+ */
+import { type FakeRecord } from './fake-registry-base.ts';
+import type { Row } from './registry-support.ts';
+export interface FakeAccessGroupLitellm extends FakeRecord {
+    /** Every stored group, exactly as the proxy holds it. */
+    readonly groups: () => readonly Row[];
+    /** LiteLLM's own model-name pruning (`access_group_model_sync.py`). */
+    readonly dropModel: (name: string) => void;
+}
+export interface FakeAccessGroupOptions {
+    readonly masterKey?: string;
+    readonly seed?: readonly Row[];
+    /** `POST`/`PUT`/`DELETE` answer 403, as for a key that is not PROXY_ADMIN. */
+    readonly forbidWrites?: boolean;
+    /** A `PUT` drops empty lists instead of writing them (a truthiness check). */
+    readonly editIgnoresEmpty?: boolean;
+}
+/** A row as `AccessGroupResponse` carries it: every required field present. */
+export declare const groupRow: (fields: Row) => Row;
+export declare const startFakeAccessGroupLitellm: (options?: FakeAccessGroupOptions) => FakeAccessGroupLitellm;
+//# sourceMappingURL=fake-access-group-litellm.d.ts.map

package/dist/litellm/fake-access-group-litellm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-access-group-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-access-group-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAY,KAAK,UAAU,EAA+B,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAEjD,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,SAAS,GAAG,EAAE,CAAC;IACtC,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,+EAA+E;AAC/E,eAAO,MAAM,QAAQ,WAAY,GAAG,KAAG,GAcrC,CAAC;AAEH,eAAO,MAAM,2BAA2B,aAC7B,sBAAsB,KAC9B,sBA0EF,CAAC"}

package/dist/litellm/fake-credential-litellm.d.ts

@@ -0,0 +1,54 @@
+/**
+ * A fake of LiteLLM's `/credentials/*` routes for tests — TEST ONLY, never imported by `index.ts`.
+ * Like `fake-model-litellm.ts` it is a `fetch` function handed to Effect's real `FetchHttpClient`
+ * through its `Fetch` reference, so a test exercises distilled's REAL path assembly, JSON encoding
+ * and status-to-error matching; only the wire responses a scenario needs are written here.
+ *
+ * ★ THE MASKING RULE IS THE VENDOR'S, READ FROM THE LIVE 1.103.0 CONTAINER
+ *   (`litellm_logging.py::_get_masked_values`): a key whose lowercased form contains `token`,
+ *   `key`, `secret`, `password`, `passwd`, `credentials`, `vertex_credentials` or
+ *   `authorization` answers `v[:2] + "****" + v[-2:]` for a string longer than four characters,
+ *   `*****` for a shorter one, the value untouched for a non-string, and a non-sensitive key
+ *   answers its full value. Both the list and the by-name read apply it (the by-name read with
+ *   `unmasked_length=4, number_of_asterisks=4` — the same rule).
+ * ★ THE READ AND THE DELETE ASK DIFFERENT STORES, AS THE VENDOR DOES (measured): the by-name read
+ *   answers only rows loaded in memory, while the delete consults the table. `memoryOmits` models
+ *   a row committed to the table but not loaded in memory, so the read answers 404 while the
+ *   create for the same name answers 409 — the asymmetry credential-operations.ts documents.
+ * ★ A CREATE ON AN EXISTING NAME ANSWERS 409 (the vendor's unique-violation handling,
+ *   `_credential_exists_detail`), decoded by the real SDK path as core `Conflict`. The PATCH route
+ *   merges values in both stores; nonempty info normally replaces DB info but merges in memory
+ *   (`credential_endpoints/endpoints.py:312-319,384-387`, 1.103.0). Empty info leaves DB unchanged. With
+ *   the body's `credential_name` (the `credential_name_body` member) applied as the new name only
+ *   when it differs from the path's (the kit never renames in place, so it never does).
+ * ★ `FAKE-*` VALUES ONLY. Nothing here is, or looks like, a real credential.
+ */
+/** One request that reached the fake. Its own type, so this file depends on no other fake. */
+export interface FakeCredentialRequest {
+    readonly method: string;
+    readonly path: string;
+}
+type Row = Record<string, unknown>;
+export interface FakeCredentialLitellm {
+    readonly fetch: typeof globalThis.fetch;
+    /**
+     * Every stored row as the fake's table holds it — values in CLEAR, the fake's own choice: the
+     * real table encrypts them, but nothing reads the table directly, only the masked reads, so the
+     * encryption seam is invisible here and a test can assert what a write SENT.
+     */
+    readonly rows: () => readonly Row[];
+    readonly requests: () => readonly FakeCredentialRequest[];
+    /** The JSON bodies of every `POST` and `PATCH`, in order (including rejected PATCH requests). */
+    readonly bodies: () => readonly Row[];
+}
+export interface FakeCredentialOptions {
+    readonly masterKey?: string;
+    readonly seed?: readonly Row[];
+    /** Names committed to the table that the in-memory read omits (a row not loaded). */
+    readonly memoryOmits?: readonly string[];
+}
+/** A minimal 1.103.0-shaped row, as the table holds it. */
+export declare const credentialRow: (fields: Row) => Row;
+export declare const startFakeCredentialLitellm: (options?: FakeCredentialOptions) => FakeCredentialLitellm;
+export {};
+//# sourceMappingURL=fake-credential-litellm.d.ts.map

package/dist/litellm/fake-credential-litellm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-credential-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-credential-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,8FAA8F;AAC9F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,GAAG,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,qBAAqB,EAAE,CAAC;IAC1D,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,SAAS,GAAG,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAKD,2DAA2D;AAC3D,eAAO,MAAM,aAAa,WAAY,GAAG,KAAG,GAK1C,CAAC;AAgCH,eAAO,MAAM,0BAA0B,aAC5B,qBAAqB,KAC7B,qBAuHF,CAAC"}

package/dist/litellm/fake-keys.d.ts

@@ -0,0 +1,53 @@
+/**
+ * A fake of LiteLLM's `/key/*` routes for `LiteLLM.Key` tests — TEST ONLY, never imported by
+ * `index.ts`. `fake-litellm.ts` mounts it, so a test still goes through distilled's REAL path
+ * assembly, JSON encode/decode and status→typed-error matching over `FetchHttpClient.Fetch`.
+ *
+ * ★ MEASURED against the litellm 1.103.0 wheel's source (`key_management_endpoints.py`), not a live
+ *   proxy: a user-defined `key` must start with `sk-` and be 16+ characters, else 400 (:1477-1490); a
+ *   duplicate `key_alias` is 400 on generate and update (`_enforce_unique_key_alias`, :7639-7667);
+ *   `/key/update` applies `model_dump(exclude_unset=True)`, so an explicit `null` clears a column
+ *   (`duration: null` sets `expires` null, :2468-2500) and omitted fields are untouched; an update
+ *   that finds no alias is 404 (`_get_and_validate_existing_key`, per the distilled patch); a delete
+ *   of an alias it does not hold is 404 "No keys found" (:4914-4918) and of a key the caller may not
+ *   delete 403 (:4933-4936), BOTH answered as a `ProxyException` envelope, because `delete_key_fn`
+ *   re-raises through `handle_exception_on_proxy` (`proxy/utils.py:7815`), whose `message` is `str(detail)`
+ *   (`_types.py` `ProxyException`): `{"error": {"message": "{'error': 'No keys found'}", "code": "404", ...}}`;
+ *   `/key/list` filters `key_alias` exactly unless told otherwise, and
+ *   `return_full_object` answers full rows, `token` being the sha256 hex of the key (`hash_token`).
+ * ⚠️ NOT MODELLED, or only a stand-in: `disable_custom_api_keys` (a 403 for ANY user-defined key);
+ *   a `budget_id` that names no budget is a foreign-key violation whose status is UNMEASURED — 400
+ *   here, so a test can prove the Budget is written first.
+ * ⛔ THE PLAINTEXT KEY NEVER SITS IN A ROW. Rows carry only `token`, a sha256 of the value, the way
+ *   a LiteLLM row carries a hash. The values the proxy was SENT are kept apart in `received()`, so a
+ *   test can prove what reached the wire without the value ever being in the state a resource sees.
+ */
+type Row = Record<string, unknown>;
+export interface FakeKeysOptions {
+    /** Live rows, wire-shaped like `UserAPIKeyAuth` (`key_alias`, `budget_id`, `models`, `token`, …). */
+    readonly keySeed?: readonly Row[];
+    /** `GET /key/list` answers this status and nothing else — a transient read failure. */
+    readonly keyListStatus?: number;
+    /** `POST /key/delete` answers 403 and keeps the row — a caller that may not delete. */
+    readonly keyDeleteForbidden?: boolean;
+    /** `POST /key/delete` deletes the row and STILL answers 404 — another caller got there first. */
+    readonly keyDeleteRaces?: boolean;
+    /** `/key/generate` ignores the user-defined `key` and mints its own. */
+    readonly keyIgnoresUserValue?: boolean;
+    /** `/key/update` drops explicit `null`s instead of writing them (an `exclude_none` merge). */
+    readonly keyUpdateIgnoresNull?: boolean;
+}
+export interface FakeKeys {
+    readonly route: (request: Request, url: URL) => Promise<Response>;
+    readonly rows: () => readonly Row[];
+    /** Every JSON body a `/key/*` write carried, in order. FAKE-* material only. */
+    readonly writes: () => readonly {
+        readonly path: string;
+        readonly body: Row;
+    }[];
+    /** The raw key values `/key/generate` was sent — kept off the rows on purpose. */
+    readonly received: () => readonly string[];
+}
+export declare const createFakeKeys: (options: FakeKeysOptions | undefined, budgetExists: (budgetId: string) => boolean) => FakeKeys;
+export {};
+//# sourceMappingURL=fake-keys.d.ts.map

package/dist/litellm/fake-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-keys.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,MAAM,WAAW,eAAe;IAC9B,qGAAqG;IACrG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC;IAClC,uFAAuF;IACvF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,8FAA8F;IAC9F,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,GAAG,EAAE,CAAC;IACpC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;IAChF,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC5C;AAmCD,eAAO,MAAM,cAAc,YAChB,eAAe,GAAG,SAAS,gBACtB,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,KAC1C,QAuGF,CAAC"}

package/dist/litellm/fake-litellm.d.ts

@@ -27,6 +27,7 @@
  *   fake now matches that measured vendor behaviour.
  */
 import type { PassThroughGenericEndpoint } from '@distilled.cloud/litellm/misc';
+import { type FakeKeys, type FakeKeysOptions } from './fake-keys.ts';
 /** RFC 2606 placeholder — never a real host. Shared across tests, like `../netbox/fake-netbox.ts`. */
 export declare const FAKE_BASE = "https://litellm.example.com";
 export interface FakeRequest {
@@ -37,11 +38,18 @@ export interface FakeLitellm {
     readonly fetch: typeof globalThis.fetch;
     readonly rows: () => readonly PassThroughGenericEndpoint[];
     readonly requests: () => readonly FakeRequest[];
+    /** `/budget/*` rows, wire-shaped (`tpm_limit`/`rpm_limit` as decimal strings, like the real table). */
+    readonly budgets: () => readonly Record<string, unknown>[];
+    /** `/key/*` rows and the writes they took — see fake-keys.ts. */
+    readonly keys: FakeKeys;
 }
 export declare const startFakeLitellm: (options?: {
     readonly masterKey?: string;
     readonly seed?: readonly PassThroughGenericEndpoint[];
     /** Every `DELETE` 400s `not_allowed_access`, whether or not the row exists — see the file header. */
     readonly forbidDelete?: boolean;
-}) => FakeLitellm;
+    readonly budgetSeed?: readonly Record<string, unknown>[];
+    /** `/budget/update` drops `null`s instead of writing them (an `exclude_none` merge). */
+    readonly budgetExcludeNone?: boolean;
+} & FakeKeysOptions) => FakeLitellm;
 //# sourceMappingURL=fake-litellm.d.ts.map

package/dist/litellm/fake-litellm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,sGAAsG;AACtG,eAAO,MAAM,SAAS,gCAAgC,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,0BAA0B,EAAE,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,WAAW,EAAE,CAAC;CACjD;AAQD,eAAO,MAAM,gBAAgB,aAAc;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,qGAAqG;IACrG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,KAAG,WAiEH,CAAC"}
+{"version":3,"file":"fake-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,eAAe,EAAkB,MAAM,gBAAgB,CAAC;AAErF,sGAAsG;AACtG,eAAO,MAAM,SAAS,gCAAgC,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,0BAA0B,EAAE,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,WAAW,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC3D,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAQD,eAAO,MAAM,gBAAgB,aACjB;IACR,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,qGAAqG;IACrG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACzD,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC,GAAG,eAAe,KAClB,WAkHF,CAAC"}

package/dist/litellm/fake-mcp-litellm.d.ts

@@ -0,0 +1,67 @@
+/**
+ * A fake of LiteLLM's `/v1/mcp/server` routes for tests — TEST ONLY, never imported by `index.ts`.
+ * Like `fake-litellm.ts` it is a `fetch` function handed to Effect's real `FetchHttpClient` through
+ * its `Fetch` reference, so a test exercises distilled's REAL path assembly, JSON encoding and
+ * status-to-error matching; only the wire responses a scenario needs are written here.
+ *
+ * ★ A SEPARATE FILE FROM `fake-litellm.ts` ON PURPOSE: that fake carries the pass-through and
+ *   budget routes and is at its size budget; a fake per route family keeps each one small.
+ * ⚠️ SHAPES ARE FROM THE GENERATED 1.103.0 SCHEMA (`mcp_management.ts`), NOT A LIVE READ. What the
+ *   real proxy does on a duplicate create, an edit of a missing id, a delete of a missing id, and
+ *   whether its list redacts `credentials` is UNMEASURED; the answers below (400, 404, 404, redacted
+ *   unless `echoCredentials`) are the fake's own choices, and every test that leans on one says so.
+ * ★ ONE RULE IS MEASURED, NOT CHOSEN: an edit that changes `auth_type` and sends no `credentials` key
+ *   clears the stored credential (litellm 1.103.0, `db.py` lines 1013-1014, read from the live
+ *   container; every static type is its own credential class). The engine tests that rely on it are
+ *   `mcp-server-retype.test.ts`.
+ * ★ THREE MORE RULES ARE MEASURED (2026-09-29, the live 1.103.0 container, read from source and, for
+ *   the alias rule, by running its own normaliser on a body): (1) `GET /v1/mcp/server` is the
+ *   in-memory REGISTRY, not the table, so a row can be committed and not listed (`registryMisses`,
+ *   `hideCreated`); the by-id `GET` reads the table first and REGISTERS the row it finds. (2) The
+ *   list's `description` is `mcp_info.description` when that key exists, else the column. (3) A
+ *   write with a `server_name` and no `alias` defaults the alias to the name and WRITES it; `-` in
+ *   either name is a 400, and a space in an alias becomes `_`.
+ * ⚠️ `servers()` RETURNS WHAT REACHED THE PROXY, credentials included, so a test can assert what
+ *   was SENT. The list route (`GET`) is what a resource can read, and it hides them by default.
+ * ★ `FAKE-*` VALUES ONLY. Nothing here is, or looks like, a real credential.
+ */
+/** One request that reached the fake. Its own type, so this file depends on no other fake. */
+export interface FakeMcpRequest {
+    readonly method: string;
+    readonly path: string;
+}
+type Row = Record<string, unknown>;
+export interface FakeMcpLitellm {
+    readonly fetch: typeof globalThis.fetch;
+    /** Every stored row exactly as the proxy holds it, `credentials` included. */
+    readonly servers: () => readonly Row[];
+    readonly requests: () => readonly FakeMcpRequest[];
+    /** The JSON bodies of every `POST`/`PUT`, in order. */
+    readonly bodies: () => readonly Row[];
+}
+export interface FakeMcpOptions {
+    readonly masterKey?: string;
+    readonly seed?: readonly Row[];
+    /** `GET` echoes the stored `credentials` instead of hiding them (a worst-case proxy). */
+    readonly echoCredentials?: boolean;
+    /** `PUT` drops an empty list and a `false`, like a truthiness check would. */
+    readonly editIgnoresFalsy?: boolean;
+    /** `POST` ignores a supplied `server_id` and issues its own. */
+    readonly issuesOwnId?: boolean;
+    /** Every `DELETE` answers 400, whether or not the row exists (no rights). */
+    readonly forbidDelete?: boolean;
+    /** Ids committed to the table that the registry does not hold (a failed reload), so the list omits them. */
+    readonly registryMisses?: readonly string[];
+    /** A `POST` commits the row but its registry refresh fails (LiteLLM only logs it). */
+    readonly hideCreated?: boolean;
+    /**
+     * The by-id `GET` answers 403, whether or not the row exists. ⚠️ Not 500: the SDK retries 5xx with
+     * backoff (`Retry.Retry`), which would take a test tens of seconds to no purpose.
+     */
+    readonly readFails?: boolean;
+}
+/** A minimal 1.103.0-shaped row, as the list route returns it. */
+export declare const serverRow: (fields: Row) => Row;
+export declare const startFakeMcpLitellm: (options?: FakeMcpOptions) => FakeMcpLitellm;
+export {};
+//# sourceMappingURL=fake-mcp-litellm.d.ts.map

package/dist/litellm/fake-mcp-litellm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-mcp-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-mcp-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,SAAS,GAAG,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,cAAc,EAAE,CAAC;IACnD,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,SAAS,GAAG,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,4GAA4G;IAC5G,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAOD,kEAAkE;AAClE,eAAO,MAAM,SAAS,WAAY,GAAG,KAAG,GAOtC,CAAC;AA8BH,eAAO,MAAM,mBAAmB,aAAa,cAAc,KAAQ,cAwGlE,CAAC"}