@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/litellm/policy-attachment-types.d.ts

@@ -0,0 +1,48 @@
+/**
+ * What a `LiteLLM.PolicyAttachment` declares (props) and what is remembered about it (attributes).
+ *
+ * ★ AN ATTACHMENT SAYS WHERE A POLICY APPLIES (`LiteLLM_PolicyAttachmentTable`,
+ *   `/policies/attachments`): a request gets the policy when it matches ALL of the attachment's
+ *   selectors (`PolicyMatcher.scope_matches`, `policy_engine/policy_matcher.py`, 1.103.0). Teams, keys
+ *   and models are matched by ALIAS or model name with `*` wildcards (`prefix-*`); a request's team
+ *   alias is `LiteLLM.Team`'s `teamAlias`, not its id.
+ * ⛔ AN ATTACHMENT WITH NO SELECTOR IS GLOBAL. `PolicyScope.get_teams()`, `get_keys()` and
+ *   `get_models()` each default to `["*"]` when empty, and empty `tags` are simply not checked
+ *   (`policy_types.py`), so an attachment that names only a policy applies to EVERY request. It is
+ *   refused unless `scope: '*'` says so. The other three empty selectors are "any", which is why
+ *   `{ teams: ['x'] }` covers every key and every model of team x.
+ * ⛔ IMMUTABLE: THERE IS NO UPDATE ROUTE (`policy_endpoints.py` has create, get, list and delete only).
+ *   Any change is a REPLACE: the new attachment is created first, then the old one is deleted, so for a
+ *   moment both apply. Guardrails are additive, so overlap can only add enforcement, never drop it.
+ * ★ IDENTITY IS CONTENT. The id is issued by the proxy and there is no name, so a live attachment is
+ *   adopted by matching every field (policy, scope, the four selector sets, priority).
+ * ⚠️ CONFIG-FILE ATTACHMENTS (`config-<n>` ids) are never adopted or deleted: they cannot be removed
+ *   through the API.
+ */
+export interface PolicyAttachmentProps {
+    /** The policy to attach, by name. The proxy refuses a name with no PRODUCTION version (404). */
+    readonly policyName: string;
+    /** `'*'` for a global attachment. Declare this OR a selector; neither is refused (see above). */
+    readonly scope?: '*';
+    /** Team ALIASES or patterns. A set. */
+    readonly teams?: readonly string[];
+    /** Key aliases or patterns. A set. */
+    readonly keys?: readonly string[];
+    /** Model names or patterns. A set. */
+    readonly models?: readonly string[];
+    /** Tag patterns matched against key and team `metadata.tags`. A set. */
+    readonly tags?: readonly string[];
+    /** Explicit execution order, lower first; an attachment with one runs before those without. 32-bit int. */
+    readonly priority?: number;
+}
+export interface PolicyAttachmentAttributes {
+    readonly attachmentId: string;
+    readonly policyName: string;
+    readonly scope: string | null;
+    readonly teams: readonly string[];
+    readonly keys: readonly string[];
+    readonly models: readonly string[];
+    readonly tags: readonly string[];
+    readonly priority: number | null;
+}
+//# sourceMappingURL=policy-attachment-types.d.ts.map

package/dist/litellm/policy-attachment-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-attachment-types.d.ts","sourceRoot":"","sources":["../../src/litellm/policy-attachment-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,qBAAqB;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iGAAiG;IACjG,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACrB,uCAAuC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,2GAA2G;IAC3G,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC"}

package/dist/litellm/policy-attachment.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `LiteLLM.PolicyAttachment` — one row of LiteLLM's policy attachment table
+ * (`/policies/attachments`): WHERE a policy applies, by team alias, key alias, model and tag. Props,
+ * the global-by-default trap and the config-file exclusion: policy-attachment-types.ts.
+ *
+ * ⛔ IMMUTABLE, SO EVERY CHANGE IS A CREATE-FIRST REPLACE. There is no update route. The engine creates
+ *   the new attachment and then deletes the old, so both apply for a moment; guardrails are additive,
+ *   so that can only add enforcement.
+ * ★ THE REMOVAL POLICY IS THE DEFAULT (`destroy`), DELIBERATELY NOT `retain` (the other registry
+ *   resources retain). Under `retain` a replace would leave the OLD attachment live beside the new one
+ *   for good: a scope the declaration no longer names would keep the policy attached. An attachment
+ *   holds no data, so removing it loses nothing but the scoping the declaration just dropped.
+ * ★ ADOPT BY CONTENT. A live attachment that matches every field, with no state, is `Unowned` and needs
+ *   `--adopt`. Two identical live rows are refused, never guessed at.
+ * ⚠️ NO LICENCE GATE ON THESE ROUTES: none in `policy_endpoints.py` or `policy_engine/*.py` (1.103.0).
+ *   The guardrail-policies docs page says team/key-based attachment needs Enterprise
+ *   (docs.litellm.ai/docs/proxy/guardrails/guardrail_policies); whether a CE proxy enforces a
+ *   team-scoped attachment is UNVERIFIED.
+ * ⛔ NO LITELLM CREDENTIAL IS A PROP; `litellmProviders`' layer supplies `Credentials`.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type { PolicyAttachmentAttributes, PolicyAttachmentProps } from './policy-attachment-types.ts';
+import { LitellmRegistryAbsentAfterWriteError, LitellmRegistryAmbiguousError, LitellmRegistryNotConvergedError, LitellmRegistryUnreadableError } from './registry-errors.ts';
+export type { PolicyAttachmentAttributes, PolicyAttachmentProps };
+export type { RegistryError as PolicyAttachmentError } from './registry-errors.ts';
+export interface LiteLLMPolicyAttachment extends Resource<'LiteLLM.PolicyAttachment', PolicyAttachmentProps, PolicyAttachmentAttributes> {
+}
+export declare const LiteLLMPolicyAttachment: import("alchemy").ResourceClass<LiteLLMPolicyAttachment>;
+export declare const isLiteLLMPolicyAttachment: (value: unknown) => value is LiteLLMPolicyAttachment;
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel. */
+export declare const policyAttachmentHandlers: {
+    /** ⛔ With no `output` this is the adoption probe, so the refusals run here too (registry-support.ts). */
+    read: ({ olds, output, }: {
+        olds: PolicyAttachmentProps;
+        output: PolicyAttachmentAttributes | undefined;
+    }) => Effect.Effect<PolicyAttachmentAttributes | undefined, LitellmRegistryAmbiguousError | LitellmRegistryUnreadableError | import("@distilled.cloud/litellm/Protocol").LitellmOpError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    diff: ({ news, output, }: {
+        news: Input<PolicyAttachmentProps>;
+        output: PolicyAttachmentAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly deleteFirst?: never;
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+        readonly deleteFirst: false;
+    } | undefined, import("./registry-errors.ts").LitellmRegistryInvalidError, never>;
+    reconcile: ({ news, output, }: {
+        news: PolicyAttachmentProps;
+        output: PolicyAttachmentAttributes | undefined;
+    }) => Effect.Effect<PolicyAttachmentAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/litellm/Errors").LitellmParseError | LitellmRegistryAbsentAfterWriteError | LitellmRegistryAmbiguousError | import("./registry-errors.ts").LitellmRegistryInvalidError | LitellmRegistryNotConvergedError | LitellmRegistryUnreadableError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | import("@distilled.cloud/litellm/policy_engine").UnprocessableEntity, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    delete: ({ output }: {
+        output: PolicyAttachmentAttributes;
+    }) => Effect.Effect<void, import("@distilled.cloud/litellm/policy_engine").DeletePolicyAttachmentPoliciesAttachmentsAttachmentIdDeleteError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    /** ⛔ EMPTY: adoption is an explicit act (`--adopt`), and no ownership mark exists to filter by. */
+    list: () => Effect.Effect<never[], never, never>;
+};
+export declare const LiteLLMPolicyAttachmentProvider: () => import("effect/Layer").Layer<Provider.Provider<LiteLLMPolicyAttachment>, never, import("@distilled.cloud/litellm/Credentials").Credentials>;
+//# sourceMappingURL=policy-attachment.d.ts.map

package/dist/litellm/policy-attachment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-attachment.d.ts","sourceRoot":"","sources":["../../src/litellm/policy-attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAQxC,OAAO,KAAK,EACV,0BAA0B,EAC1B,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC/B,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,CAAC;AAClE,YAAY,EAAE,aAAa,IAAI,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAInF,MAAM,WAAW,uBAAwB,SAAQ,QAAQ,CACvD,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,CAC3B;CAAG;AAEJ,eAAO,MAAM,uBAAuB,0DAEnC,CAAC;AAEF,eAAO,MAAM,yBAAyB,UAAW,OAAO,KAAG,KAAK,IAAI,uBACe,CAAC;AA0BpF,oDAAoD;AACpD,eAAO,MAAM,wBAAwB;IACnC,yGAAyG;IACzG,IAAI,sBAGD;QACD,IAAI,EAAE,qBAAqB,CAAC;QAC5B,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC;KAChD;IAUD,IAAI,sBAGD;QACD,IAAI,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACnC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC;KAChD;;yBAOkB,MAAM;;yBACN,SAAS;;;IAG5B,SAAS,sBAGN;QACD,IAAI,EAAE,qBAAqB,CAAC;QAC5B,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAAC;KAChD;IAqCD,MAAM,eAAe;QAAE,MAAM,EAAE,0BAA0B,CAAA;KAAE;IAG3D,mGAAmG;IACnG,IAAI;CACL,CAAC;AAEF,eAAO,MAAM,+BAA+B,mJAIzC,CAAC"}

package/dist/litellm/policy-form.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Wire bodies, comparison and refusals for `LiteLLM.Policy`, testable without a server.
+ *
+ * ★ THE EDIT BODY CARRIES ONLY WHAT DIFFERS AND IS NEVER A `null`: `update_policy_in_db` skips every
+ *   field that is `None` (policy-types.ts), so a `null` would be a silent no-op the read back would
+ *   then have to catch.
+ */
+import type * as policies from '@distilled.cloud/litellm/policy_engine';
+import type { PolicyAttributes, PolicyProps, PolicyVersion } from './policy-types.ts';
+/** The first reason a declaration is refused, or `undefined`. Runs before any request. */
+export declare const firstProblem: (props: PolicyProps) => string | undefined;
+/** One policy version. `undefined` is "not a policy row": the caller refuses the whole answer. */
+export declare const toVersion: (value: unknown) => PolicyVersion | undefined;
+/** The attributes of a version: without the status, which is never recorded. */
+export declare const toAttributes: (version: PolicyVersion) => PolicyAttributes;
+/** Wire names of the fields where live and declared disagree. */
+export declare const differing: (live: PolicyAttributes, props: PolicyProps) => readonly string[];
+/** Create body (version 1, which LiteLLM makes production): every declared field. */
+export declare const createBody: (props: PolicyProps) => policies.CreatePolicyPoliciesPostRequest;
+/** Draft edit body: only the fields that differ from what the draft was cloned from. */
+export declare const updateBody: (props: PolicyProps, live: PolicyAttributes) => Omit<policies.UpdatePolicyPoliciesPolicyIdPutRequest, 'policy_id'>;
+//# sourceMappingURL=policy-form.d.ts.map

package/dist/litellm/policy-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-form.d.ts","sourceRoot":"","sources":["../../src/litellm/policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,wCAAwC,CAAC;AAYxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEtF,0FAA0F;AAC1F,eAAO,MAAM,YAAY,UAAW,WAAW,KAAG,MAAM,GAAG,SA6B1D,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,aAAa,GAAG,SAkB1D,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,YAAa,aAAa,KAAG,gBAGrD,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,SAAS,SAAU,gBAAgB,SAAS,WAAW,KAAG,SAAS,MAAM,EAarF,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,UAAU,UAAW,WAAW,KAAG,QAAQ,CAAC,+BAOvD,CAAC;AAEH,wFAAwF;AACxF,eAAO,MAAM,UAAU,UACd,WAAW,QACZ,gBAAgB,KACrB,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,WAAW,CAWnE,CAAC"}

package/dist/litellm/policy-operations.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The seven LiteLLM `/policies*` calls `LiteLLM.Policy` uses, through the SDK's typed operations in
+ * `@distilled.cloud/litellm/policy_engine` (LiteLLM 1.103.0):
+ *
+ *   versions  `listPolicyVersionsPoliciesNamePolicyNameVersionsGet`      GET    /policies/name/{policy_name}/versions
+ *   config    `listPoliciesPoliciesListGet`                              GET    /policies/list?version_status=production
+ *   create    `createPolicyPoliciesPost`                                 POST   /policies
+ *   draft     `createPolicyVersionPoliciesNamePolicyNameVersionsPost`    POST   /policies/name/{policy_name}/versions
+ *   edit      `updatePolicyPoliciesPolicyIdPut`                          PUT    /policies/{policy_id}
+ *   status    `updatePolicyVersionStatusPoliciesPolicyIdStatusPut`       PUT    /policies/{policy_id}/status
+ *   delete    `deleteAllPolicyVersionsPoliciesNamePolicyNameAllVersionsDelete` DELETE /policies/name/{policy_name}/all-versions
+ *
+ * ⛔ THE VERSION LIST IS THE TABLE AND ANSWERS ABSENCE WITH AN EMPTY LIST. `get_versions_by_policy_name`
+ *   is a `find_many` by name (`policy_registry.py`, 1.103.0), so a name with no rows is `versions: []`
+ *   with a 200, never a 404. Nothing here needs the SDK's undeclared `NotFound`.
+ * ⛔ A CONFIG-FILE POLICY IS NOT IN THE TABLE. `/policies/list` merges DB rows with config.yaml
+ *   policies (`definition_location: "config"`), and a production DB policy of the same name OVERRIDES the
+ *   config one at runtime. `configPolicyNames` is how a create refuses to do that by accident.
+ * ⚠️ MOST FAILURES HERE ARE A PLAIN 500. The handlers wrap everything in `except Exception` and answer
+ *   `HTTPException(500, detail=str(e))`, except a duplicate name (400) and a few 404/400 cases matched
+ *   by message text. The SDK retries 5xx with backoff, so a genuine failure is slow to surface; nothing
+ *   here reads the text either way (S21).
+ * ⛔ DELETE REMOVES EVERY VERSION (`delete_many` by name), not just production, and answers 200 whether
+ *   or not any row existed, so it is idempotent as it stands. It is why the resource defaults to `retain`.
+ */
+import * as policies from '@distilled.cloud/litellm/policy_engine';
+import * as Effect from 'effect/Effect';
+import type { PolicyVersion } from './policy-types.ts';
+import { LitellmRegistryUnreadableError } from './registry-errors.ts';
+/** Every version of one policy name, newest first as LiteLLM orders them. `[]` when there is none. */
+export declare const listPolicyVersions: (policyName: string) => Effect.Effect<readonly PolicyVersion[], LitellmRegistryUnreadableError | policies.ListPolicyVersionsPoliciesNamePolicyNameVersionsGetError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/** The names of the policies defined in config.yaml (their `definition_location` is `config`). */
+export declare const configPolicyNames: () => Effect.Effect<string[], LitellmRegistryUnreadableError | policies.ListPoliciesPoliciesListGetError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/** Creates version 1 AS PRODUCTION. */
+export declare const createPolicy: (body: policies.CreatePolicyPoliciesPostRequest) => Effect.Effect<void, policies.CreatePolicyPoliciesPostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/** A new DRAFT cloned from production. Answers the draft, whose id every later call needs. */
+export declare const createDraft: (policyName: string) => Effect.Effect<PolicyVersion, LitellmRegistryUnreadableError | policies.CreatePolicyVersionPoliciesNamePolicyNameVersionsPostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const editDraft: (policyId: string, body: Omit<policies.UpdatePolicyPoliciesPolicyIdPutRequest, 'policy_id'>) => Effect.Effect<void, policies.UpdatePolicyPoliciesPolicyIdPutError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/** `draft → published` or `published → production` (which demotes the old production to published). */
+export declare const setVersionStatus: (policyId: string, status: 'published' | 'production') => Effect.Effect<void, policies.UpdatePolicyVersionStatusPoliciesPolicyIdStatusPutError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const deleteAllVersions: (policyName: string) => Effect.Effect<void, policies.DeleteAllPolicyVersionsPoliciesNamePolicyNameAllVersionsDeleteError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+//# sourceMappingURL=policy-operations.d.ts.map

package/dist/litellm/policy-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-operations.d.ts","sourceRoot":"","sources":["../../src/litellm/policy-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,QAAQ,MAAM,wCAAwC,CAAC;AACnE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAQtE,sGAAsG;AACtG,eAAO,MAAM,kBAAkB,eAAgB,MAAM,4MAalD,CAAC;AAEJ,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,uKAe3B,CAAC;AAEJ,uCAAuC;AACvC,eAAO,MAAM,YAAY,SAAU,QAAQ,CAAC,+BAA+B,4HACA,CAAC;AAE5E,8FAA8F;AAC9F,eAAO,MAAM,WAAW,eAAgB,MAAM,mMAU3C,CAAC;AAEJ,eAAO,MAAM,SAAS,aACV,MAAM,QACV,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,WAAW,CAAC,mIAIvE,CAAC;AAEJ,uGAAuG;AACvG,eAAO,MAAM,gBAAgB,aAAc,MAAM,UAAU,WAAW,GAAG,YAAY,sJAM9D,CAAC;AAExB,eAAO,MAAM,iBAAiB,eAAgB,MAAM,kKAK7B,CAAC"}

package/dist/litellm/policy-types.d.ts

@@ -0,0 +1,57 @@
+/**
+ * What a `LiteLLM.Policy` declares (props) and what is remembered about it (attributes).
+ *
+ * ★ A POLICY IS A NAMED SET OF GUARDRAILS (`LiteLLM_PolicyTable`, `/policies`;
+ *   docs.litellm.ai/docs/proxy/guardrails/guardrail_policies): guardrails to add, guardrails to remove
+ *   from an inherited parent, and an optional model condition. WHERE it applies is a
+ *   `LiteLLM.PolicyAttachment`, not a property of the policy.
+ * ⛔ A POLICY IS VERSIONED, AND THIS RESOURCE MANAGES THE PRODUCTION VERSION. LiteLLM keeps every
+ *   version (`draft` → `published` → `production`) and only the production one is enforced. `POST /policies`
+ *   creates version 1 AS PRODUCTION, and `PUT /policies/{id}` edits a DRAFT only (400 otherwise;
+ *   `policy_endpoints.py` and `policy_registry.py`, 1.103.0). So a change is four calls: new draft from
+ *   production, edit the draft, publish it, promote it (which demotes the old production to `published`).
+ *   The old version is kept as history. `policyId` in the attributes is the PRODUCTION version's id and
+ *   changes with every promotion.
+ * ⚠️ NOT MODELLED: `pipeline` (an ordered guardrail pipeline). A new version is cloned from production,
+ *   so an adopted policy's pipeline survives every update, and none is ever sent.
+ * ⚠️ A FIELD CANNOT BE CLEARED THROUGH THE API. `update_policy_in_db` writes only fields that are not
+ *   `None`, so `description`, `inherit` and `conditionModel` are compared only when declared and
+ *   removing one from the declaration leaves the live value. The two guardrail lists can be written as
+ *   `[]`, so they are always compared.
+ */
+export interface PolicyProps {
+    /**
+     * The policy's name, and the way an existing policy is ADOPTED: its production version, found by
+     * name. Identity: a different name is a different policy, so it is a replace (create-first).
+     */
+    readonly policyName: string;
+    /** Compared only when declared. Blank is refused. */
+    readonly description?: string;
+    /** The parent policy's name. Compared only when declared. Refused if it is this policy's own name. */
+    readonly inherit?: string;
+    /** Guardrail names this policy adds, compared as a SET and always compared (default `[]`). */
+    readonly guardrailsAdd?: readonly string[];
+    /** Guardrail names removed from the inherited set, compared as a set, always compared (default `[]`). */
+    readonly guardrailsRemove?: readonly string[];
+    /**
+     * `condition.model`: the model name (exact or regex) the policy applies to. Compared only when
+     * declared. Written as the whole condition (`PolicyConditionRequest` has no other key).
+     */
+    readonly conditionModel?: string;
+}
+export interface PolicyAttributes {
+    readonly policyName: string;
+    /** The PRODUCTION version's id. */
+    readonly policyId: string;
+    readonly versionNumber: number;
+    readonly description: string | null;
+    readonly inherit: string | null;
+    readonly guardrailsAdd: readonly string[];
+    readonly guardrailsRemove: readonly string[];
+    readonly conditionModel: string | null;
+}
+/** One version of a policy, as the version list returns it. */
+export interface PolicyVersion extends PolicyAttributes {
+    readonly versionStatus: string;
+}
+//# sourceMappingURL=policy-types.d.ts.map

package/dist/litellm/policy-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-types.d.ts","sourceRoot":"","sources":["../../src/litellm/policy-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,yGAAyG;IACzG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC"}

package/dist/litellm/policy.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `LiteLLM.Policy` — the PRODUCTION version of one named policy in LiteLLM's policy engine
+ * (`LiteLLM_PolicyTable`, `/policies`): a set of guardrails to add and remove, with an optional model
+ * condition. Props, the versioning and what is left out: policy-types.ts.
+ *
+ * ★ A CHANGE IS A NEW VERSION, PROMOTED. Only a draft is editable and only production is enforced, so
+ *   an update clones production to a draft, edits it, publishes it and promotes it; the old production
+ *   stays as a `published` version. A run that stops midway leaves a draft or a published copy, both
+ *   inert; the next run starts from production again and never touches a version it did not make.
+ * ★ ADOPT BY NAME. A live production version with no state is `Unowned`, so it needs `--adopt`.
+ * ⛔ A POLICY THAT EXISTS ONLY IN config.yaml IS NEVER SHADOWED BY ACCIDENT: a create refuses when the
+ *   name belongs to a config policy, because a production DB policy would override it at runtime.
+ * ⛔ NO PRODUCTION VERSION IS NEVER GUESSED AT: a name whose versions are all `draft` or `published`
+ *   (someone demoted it) is refused with the count, not promoted.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting removes EVERY version (the history) and stops the
+ *   guardrails applying wherever an attachment pointed at it. Opt in with `RemovalPolicy.destroy()`.
+ * ⚠️ NO LICENCE GATE ON THESE ROUTES: `policy_endpoints.py` and `policy_engine/*.py` have no
+ *   `premium_user` check (grep, 1.103.0). The docs page says team/key-based attachment needs Enterprise
+ *   (docs.litellm.ai/docs/proxy/guardrails/guardrail_policies); whether a CE proxy enforces one is
+ *   UNVERIFIED. The `policies` metadata of a team or key IS gated (`_premium_user_check`).
+ * ⛔ NO LITELLM CREDENTIAL IS A PROP; `litellmProviders`' layer supplies `Credentials`.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type { PolicyAttributes, PolicyProps } from './policy-types.ts';
+import { LitellmRegistryAbsentAfterWriteError, LitellmRegistryInvalidError, LitellmRegistryNotConvergedError } from './registry-errors.ts';
+export type { PolicyAttributes, PolicyProps };
+export type { RegistryError as PolicyError } from './registry-errors.ts';
+export interface LiteLLMPolicy extends Resource<'LiteLLM.Policy', PolicyProps, PolicyAttributes> {
+}
+export declare const LiteLLMPolicy: import("alchemy").ResourceClass<LiteLLMPolicy>;
+export declare const isLiteLLMPolicy: (value: unknown) => value is LiteLLMPolicy;
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel. */
+export declare const policyHandlers: {
+    /** ⛔ With no `output` this is the adoption probe, so the refusals run here too (registry-support.ts). */
+    read: ({ olds, output }: {
+        olds: PolicyProps;
+        output: PolicyAttributes | undefined;
+    }) => Effect.Effect<PolicyAttributes | undefined, import("./registry-errors.ts").LitellmRegistryUnreadableError | import("@distilled.cloud/litellm/policy_engine").ListPolicyVersionsPoliciesNamePolicyNameVersionsGetError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    diff: ({ news, output }: {
+        news: Input<PolicyProps>;
+        output: PolicyAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+        readonly deleteFirst: false;
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'noop';
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'update';
+    } | undefined, LitellmRegistryInvalidError, never>;
+    reconcile: ({ news }: {
+        news: PolicyProps;
+    }) => Effect.Effect<PolicyAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/litellm/Errors").LitellmParseError | LitellmRegistryAbsentAfterWriteError | LitellmRegistryInvalidError | LitellmRegistryNotConvergedError | import("./registry-errors.ts").LitellmRegistryUnreadableError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | import("@distilled.cloud/litellm/policy_engine").UnprocessableEntity, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    delete: ({ output }: {
+        output: PolicyAttributes;
+    }) => Effect.Effect<void, import("@distilled.cloud/litellm/policy_engine").DeleteAllPolicyVersionsPoliciesNamePolicyNameAllVersionsDeleteError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    /** ⛔ EMPTY: adoption is an explicit act (`--adopt`), and no ownership mark exists to filter by. */
+    list: () => Effect.Effect<never[], never, never>;
+};
+export declare const LiteLLMPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<LiteLLMPolicy>, never, import("@distilled.cloud/litellm/Credentials").Credentials>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/litellm/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/litellm/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAYxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAiB,MAAM,mBAAmB,CAAC;AACtF,OAAO,EACL,oCAAoC,EACpC,2BAA2B,EAC3B,gCAAgC,EACjC,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;AAC9C,YAAY,EAAE,aAAa,IAAI,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAIzE,MAAM,WAAW,aAAc,SAAQ,QAAQ,CAAC,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,CAAC;CAAG;AAEnG,eAAO,MAAM,aAAa,gDAExB,CAAC;AAEH,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,KAAK,IAAI,aACe,CAAC;AAQ1E,oDAAoD;AACpD,eAAO,MAAM,cAAc;IACzB,yGAAyG;IACzG,IAAI,qBAAqB;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAA;KAAE;IAUpF,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAA;KAAE;yBAOpE,SAAS;;;;yBAGb,MAAM;;;yBACN,QAAQ;;IAG3B,SAAS,aAAa;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE;IA4C3C,MAAM,eAAe;QAAE,MAAM,EAAE,gBAAgB,CAAA;KAAE;IAEjD,mGAAmG;IACnG,IAAI;CACL,CAAC;AAEF,eAAO,MAAM,qBAAqB,yIACyD,CAAC"}

package/dist/litellm/providers.d.ts

@@ -20,5 +20,5 @@
  */
 import { type Credentials } from '@distilled.cloud/litellm/Credentials';
 import * as Layer from 'effect/Layer';
-export declare const litellmProviders: (creds?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("alchemy").Provider<import("./budget.ts").LiteLLMBudget> | import("alchemy").Provider<import("./pass-through-endpoint.ts").LiteLLMPassThroughEndpoint>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stack | import("alchemy").Stage>;
+export declare const litellmProviders: (creds?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("alchemy").Provider<import("./access-group.ts").LiteLLMAccessGroup> | import("alchemy").Provider<import("./budget.ts").LiteLLMBudget> | import("alchemy").Provider<import("./credential.ts").LiteLLMCredential> | import("alchemy").Provider<import("./key.ts").LiteLLMKey> | import("alchemy").Provider<import("./mcp-server.ts").LiteLLMMCPServer> | import("alchemy").Provider<import("./model.ts").LiteLLMModel> | import("alchemy").Provider<import("./pass-through-endpoint.ts").LiteLLMPassThroughEndpoint> | import("alchemy").Provider<import("./policy.ts").LiteLLMPolicy> | import("alchemy").Provider<import("./policy-attachment.ts").LiteLLMPolicyAttachment> | import("alchemy").Provider<import("./team.ts").LiteLLMTeam> | import("alchemy").Provider<import("./tool-policy.ts").LiteLLMToolPolicy> | import("alchemy").Provider<import("./toolset.ts").LiteLLMToolset>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stack | import("alchemy").Stage>;
 //# sourceMappingURL=providers.d.ts.map

package/dist/litellm/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/litellm/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,KAAK,WAAW,EAAsB,MAAM,sCAAsC,CAAC;AAC5F,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,eAAO,MAAM,gBAAgB,WAAW,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,8SAG7D,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/litellm/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,KAAK,WAAW,EAAsB,MAAM,sCAAsC,CAAC;AAC5F,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AActC,eAAO,MAAM,gBAAgB,WAAW,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,g/BAc7B,CAAC"}

package/dist/litellm/registry-errors.d.ts

@@ -0,0 +1,62 @@
+declare const LitellmRegistryInvalidError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmRegistryInvalidError";
+} & Readonly<A>;
+/** A declaration the resource refuses before any request: a combination nobody meant. */
+export declare class LitellmRegistryInvalidError extends LitellmRegistryInvalidError_base<{
+    readonly resource: string;
+    readonly name: string;
+    readonly problem: string;
+}> {
+    get message(): string;
+}
+declare const LitellmRegistryUnreadableError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmRegistryUnreadableError";
+} & Readonly<A>;
+/** A list or read answered something that is not the rows this resource expects. */
+export declare class LitellmRegistryUnreadableError extends LitellmRegistryUnreadableError_base<{
+    readonly resource: string;
+    readonly reason: string;
+}> {
+    get message(): string;
+}
+declare const LitellmRegistryAmbiguousError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmRegistryAmbiguousError";
+} & Readonly<A>;
+/**
+ * More than one live row could be the declared one, so adopting by name cannot say which. Nothing is
+ * adopted, updated or deleted on a guess: declare the id to choose one.
+ */
+export declare class LitellmRegistryAmbiguousError extends LitellmRegistryAmbiguousError_base<{
+    readonly resource: string;
+    readonly name: string;
+    readonly ids: readonly string[];
+}> {
+    get message(): string;
+}
+declare const LitellmRegistryAbsentAfterWriteError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmRegistryAbsentAfterWriteError";
+} & Readonly<A>;
+/** A write returned no error, yet the row is not there on the read back. */
+export declare class LitellmRegistryAbsentAfterWriteError extends LitellmRegistryAbsentAfterWriteError_base<{
+    readonly resource: string;
+    readonly name: string;
+}> {
+    get message(): string;
+}
+declare const LitellmRegistryNotConvergedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmRegistryNotConvergedError";
+} & Readonly<A>;
+/**
+ * A write returned no error, yet the row still differs from the declaration. The route may merge with
+ * `exclude_none` or a truthiness check; the read back says so instead of reporting a converged row.
+ */
+export declare class LitellmRegistryNotConvergedError extends LitellmRegistryNotConvergedError_base<{
+    readonly resource: string;
+    readonly name: string;
+    readonly fields: readonly string[];
+}> {
+    get message(): string;
+}
+export type RegistryError = LitellmRegistryInvalidError | LitellmRegistryUnreadableError | LitellmRegistryAmbiguousError | LitellmRegistryAbsentAfterWriteError | LitellmRegistryNotConvergedError;
+export {};
+//# sourceMappingURL=registry-errors.d.ts.map

package/dist/litellm/registry-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-errors.d.ts","sourceRoot":"","sources":["../../src/litellm/registry-errors.ts"],"names":[],"mappings":";;;AAYA,yFAAyF;AACzF,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,oFAAoF;AACpF,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,4EAA4E;AAC5E,qBAAa,oCAAqC,SAAQ,0CAExD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;GAGG;AACH,qBAAa,gCAAiC,SAAQ,sCAEpD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,MAAM,MAAM,aAAa,GACrB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,oCAAoC,GACpC,gCAAgC,CAAC"}

package/dist/litellm/registry-support.d.ts

@@ -0,0 +1,42 @@
+import * as Effect from 'effect/Effect';
+import { LitellmRegistryInvalidError } from './registry-errors.ts';
+/** Whether a failure is the SDK's `NotFound` class. A 401, a 500 or a dead network is never absence. */
+export declare const isNotFound: (error: unknown) => boolean;
+/**
+ * ⚠️ The SDK types most of these answers `{ body: unknown }`, but hands a JSON array or object back as
+ *   it came (measured through the fakes, as for `/budget/list`). Accept both shapes.
+ */
+export declare const bodyOf: (response: unknown) => unknown;
+export type Row = Readonly<Record<string, unknown>>;
+/** The value as a plain object, else `undefined`. An array is not a row. */
+export declare const asRow: (value: unknown) => Row | undefined;
+/** The strings of a live list, in order. Anything else (`null`, a number) is skipped, never trusted. */
+export declare const stringsOf: (value: unknown) => readonly string[];
+/** `null` for anything that is not a string: a live column can hold `null`, and so can a proxy's JSON. */
+export declare const stringOrNull: (value: unknown) => string | null;
+/** `null` for anything that is not a finite number. Numeric strings (Prisma BigInt) are converted. */
+export declare const numberOrNull: (value: unknown) => number | null;
+/** Sorted, de-duplicated. Every list a resource compares is a SET, so this is its canonical form. */
+export declare const canonical: (values: readonly string[]) => readonly string[];
+export declare const sameSet: (left: readonly string[], right: readonly string[]) => boolean;
+/** Whether a value is not a string with something in it. Takes `unknown`: a declaration can say anything. */
+export declare const isBlank: (value: unknown) => boolean;
+/** The first blank or padded entry of a declared list, or `undefined`. Padding is refused too: it is a typo. */
+export declare const firstBadEntry: (values: readonly unknown[]) => string | undefined;
+/** A list that names one entry twice. Refused rather than silently collapsed: the twin is a typo. */
+export declare const firstDuplicate: (values: readonly string[]) => string | undefined;
+/**
+ * A refusal as a TYPED FAILURE. Used in `diff` and `reconcile`, where a failure blocks that one
+ * resource with a message.
+ */
+export declare const failIfInvalid: (resource: string, name: string, problem: string | undefined) => Effect.Effect<void, never, never> | Effect.Effect<never, LitellmRegistryInvalidError, never>;
+/**
+ * The same refusal as a DEFECT, for `read` with no `output` — Alchemy's adoption probe and the ONLY
+ * plan-time hook a brand-new declaration gets (`mcp-server.ts` measured this on beta.79, `Plan.ts`
+ * lines 1303-1316). ★ A defect and not a typed failure because the same call shape is Alchemy's
+ * recovery read of an interrupted create with the STORED props, where only a defect is caught
+ * (`Effect.catchDefect`); a typed failure would wedge a stage on props a later, stricter release now
+ * refuses. The cold-start probe has no such catch, so there the defect fails the plan, as intended.
+ */
+export declare const dieIfInvalid: (resource: string, name: string, problem: string | undefined) => Effect.Effect<void, never, never>;
+//# sourceMappingURL=registry-support.d.ts.map

package/dist/litellm/registry-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-support.d.ts","sourceRoot":"","sources":["../../src/litellm/registry-support.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE,wGAAwG;AACxG,eAAO,MAAM,UAAU,UAAW,OAAO,KAAG,OAAoC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,MAAM,aAAc,OAAO,KAAG,OAM7B,CAAC;AAEf,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,KAAK,UAAW,OAAO,KAAG,GAAG,GAAG,SACsD,CAAC;AAEpG,wGAAwG;AACxG,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,SAAS,MAAM,EACoC,CAAC;AAE/F,0GAA0G;AAC1G,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,GAAG,IACb,CAAC;AAE3C,sGAAsG;AACtG,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,GAAG,IAItD,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,SAAS,WAAY,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EACxC,CAAC;AAE9B,eAAO,MAAM,OAAO,SAAU,SAAS,MAAM,EAAE,SAAS,SAAS,MAAM,EAAE,KAAG,OAI3E,CAAC;AAEF,6GAA6G;AAC7G,eAAO,MAAM,OAAO,UAAW,OAAO,KAAG,OACS,CAAC;AAEnD,gHAAgH;AAChH,eAAO,MAAM,aAAa,WAAY,SAAS,OAAO,EAAE,KAAG,MAAM,GAAG,SAKnE,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,cAAc,WAAY,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SACN,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,aAAa,aAAc,MAAM,QAAQ,MAAM,WAAW,MAAM,GAAG,SAAS,iGAGV,CAAC;AAEhF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,aAAc,MAAM,QAAQ,MAAM,WAAW,MAAM,GAAG,SAAS,sCAGV,CAAC"}

package/dist/litellm/team-form.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Wire bodies, comparison and refusals for `LiteLLM.Team`, testable without a server. The object
+ * permission is team-permission.ts, the roster team-members.ts.
+ *
+ * ★ THE UPDATE IS A PARTIAL ONE (`/team/update` builds its write from `data.json(exclude_unset=True)`,
+ *   `team_endpoints.py` line 2418, 1.103.0), so it sends the team id and ONLY what differs. Nothing
+ *   here sends `metadata`, a budget, a limit or any Enterprise field.
+ * ★ THE READ IS `/team/info`, and it returns the team's OWN columns: access-group grants are resolved
+ *   into separate `access_group_*` fields (`_resolve_team_access_group_resources`), never merged into
+ *   `models` or `object_permission`, so a group cannot make a team look as if it declared a model.
+ */
+import type * as team from '@distilled.cloud/litellm/team_management';
+import type { TeamAttributes, TeamProps } from './team-types.ts';
+/** The first reason a declaration is refused, or `undefined`. Runs before any request. */
+export declare const firstProblem: (props: TeamProps) => string | undefined;
+/** One `team_info` row. `undefined` is "not a team": the caller refuses the whole answer. */
+export declare const toAttributes: (value: unknown) => TeamAttributes | undefined;
+/** The team's own fields (never the roster) where live and declared disagree, by wire name. */
+export declare const teamFieldsDiffering: (live: TeamAttributes, props: TeamProps) => readonly string[];
+/** Everything that differs, the roster included. Empty means converged. */
+export declare const differing: (live: TeamAttributes, props: TeamProps) => readonly string[];
+/** Create body: every declared team field. The roster is added afterwards, through `member_add`. */
+export declare const createBody: (props: TeamProps, teamId: string) => team.PostNewTeamTeamNewRequest;
+/** Update body: the team id and only the fields that differ. `undefined` when nothing but the roster does. */
+export declare const updateBody: (props: TeamProps, live: TeamAttributes) => team.UpdateTeamTeamUpdatePostRequest | undefined;
+//# sourceMappingURL=team-form.d.ts.map

package/dist/litellm/team-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-form.d.ts","sourceRoot":"","sources":["../../src/litellm/team-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,0CAA0C,CAAC;AAiBtE,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjE,0FAA0F;AAC1F,eAAO,MAAM,YAAY,UAAW,SAAS,KAAG,MAAM,GAAG,SAgCxD,CAAC;AAEF,6FAA6F;AAC7F,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,cAAc,GAAG,SAc9D,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB,SAAU,cAAc,SAAS,SAAS,KAAG,SAAS,MAAM,EAY3F,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,SAAS,SAAU,cAAc,SAAS,SAAS,KAAG,SAAS,MAAM,EAGjF,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,UAAU,UAAW,SAAS,UAAU,MAAM,KAAG,IAAI,CAAC,yBASjE,CAAC;AAEH,8GAA8G;AAC9G,eAAO,MAAM,UAAU,UACd,SAAS,QACV,cAAc,KACnB,IAAI,CAAC,+BAA+B,GAAG,SAoBzC,CAAC"}

package/dist/litellm/team-members.d.ts

@@ -0,0 +1,10 @@
+import type { TeamMember, TeamMemberAttributes } from './team-types.ts';
+/** The roster of a `team_info` row. An entry with no `user_id` (an email-only invite) is skipped. */
+export declare const toMemberAttributes: (value: unknown) => readonly TeamMemberAttributes[];
+/** Declared members that are not on the live roster at all. */
+export declare const membersToAdd: (live: readonly TeamMemberAttributes[], declared: readonly TeamMember[] | undefined) => readonly TeamMember[];
+/** Declared members that are on the roster with another role. */
+export declare const roleChanges: (live: readonly TeamMemberAttributes[], declared: readonly TeamMember[] | undefined) => readonly TeamMember[];
+/** Whether the declared roster is fully present. Extra live members do not count. */
+export declare const rosterPending: (live: readonly TeamMemberAttributes[], declared: readonly TeamMember[] | undefined) => boolean;
+//# sourceMappingURL=team-members.d.ts.map

package/dist/litellm/team-members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-members.d.ts","sourceRoot":"","sources":["../../src/litellm/team-members.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAExE,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,SAAS,oBAAoB,EAahF,CAAC;AAIF,+DAA+D;AAC/D,eAAO,MAAM,YAAY,SACjB,SAAS,oBAAoB,EAAE,YAC3B,SAAS,UAAU,EAAE,GAAG,SAAS,KAC1C,SAAS,UAAU,EACoE,CAAC;AAE3F,iEAAiE;AACjE,eAAO,MAAM,WAAW,SAChB,SAAS,oBAAoB,EAAE,YAC3B,SAAS,UAAU,EAAE,GAAG,SAAS,KAC1C,SAAS,UAAU,EAGnB,CAAC;AAEJ,qFAAqF;AACrF,eAAO,MAAM,aAAa,SAClB,SAAS,oBAAoB,EAAE,YAC3B,SAAS,UAAU,EAAE,GAAG,SAAS,KAC1C,OAAuF,CAAC"}

package/dist/litellm/team-operations.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The seven LiteLLM `/team/*` calls `LiteLLM.Team` uses, through the SDK's typed operations in
+ * `@distilled.cloud/litellm/team_management` (LiteLLM 1.103.0):
+ *
+ *   read    `getTeamInfoTeamInfo`                  GET  /team/info?team_id=
+ *   list    `listTeamTeamListGet`                  GET  /team/list            (only to confirm a delete)
+ *   create  `postNewTeamTeamNew`                   POST /team/new
+ *   update  `updateTeamTeamUpdatePost`             POST /team/update
+ *   add     `teamMemberAddTeamMemberAddPost`       POST /team/member_add
+ *   role    `teamMemberUpdateTeamMemberUpdatePost` POST /team/member_update
+ *   delete  `deleteTeamTeamDeletePost`             POST /team/delete
+ *
+ * ⛔ A "NOT FOUND" FROM `/team/info` IS NOT PROOF OF ABSENCE. Its lookup sits in `try … except Exception:
+ *   raise HTTPException(404)` (`team_endpoints.py`, 1.103.0), so a database error answers exactly like a
+ *   missing team, and `/team/delete` does the same. The SDK declares no 404 for `/team/info`; a 404
+ *   decodes at run time as its `NotFound` class, which `readTeam` tests by CLASS (registry-support.ts,
+ *   never a message). A wrong "absent" can only end in a `create`, which a duplicate team id turns into a
+ *   400 that fails the deploy; nothing is written on a guess.
+ * ⛔ DELETE DELETES THE TEAM'S KEYS (`delete_team`, `team_endpoints.py` line 4258: "delete team and associated team
+ *   keys", and `prisma_client.delete_data(team_id_list=…, table_name="key")` at line 4374). It is the single most destructive
+ *   call in this family, and the reason the resource defaults to `retain`.
+ * ★ DELETE IS IDEMPOTENT ONLY AFTER A REAL READ THAT CANNOT LIE. The SDK types `NotFound` for
+ *   `/team/delete` (a distilled patch), so it is caught with `catchTag`; but the route's own 404 also
+ *   covers a database error, so success is reported only when `/team/list` (a `find_many`, whose
+ *   failures are not swallowed) no longer has the id. A team still listed re-raises the ORIGINAL error.
+ */
+import * as team from '@distilled.cloud/litellm/team_management';
+import * as Effect from 'effect/Effect';
+import type { TeamMember } from './team-types.ts';
+/** One team BY ID, or `undefined` when the proxy has no such team (see the file header). */
+export declare const readTeam: (teamId: string) => Effect.Effect<import("./team-types.ts").TeamAttributes | undefined, team.GetTeamInfoTeamInfoError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const createTeam: (body: team.PostNewTeamTeamNewRequest) => Effect.Effect<void, team.PostNewTeamTeamNewError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const updateTeam: (body: team.UpdateTeamTeamUpdatePostRequest) => Effect.Effect<void, team.UpdateTeamTeamUpdatePostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/** One call adds every missing member; LiteLLM skips a user already on the roster. */
+export declare const addMembers: (teamId: string, members: readonly TeamMember[]) => Effect.Effect<void, team.TeamMemberAddTeamMemberAddPostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const setMemberRole: (teamId: string, member: TeamMember) => Effect.Effect<void, team.TeamMemberUpdateTeamMemberUpdatePostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const deleteTeam: (teamId: string) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | team.BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/litellm/Errors").LitellmParseError | team.NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | team.UnprocessableEntity, import("@distilled.cloud/litellm/Credentials").Credentials>;
+//# sourceMappingURL=team-operations.d.ts.map

package/dist/litellm/team-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-operations.d.ts","sourceRoot":"","sources":["../../src/litellm/team-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,IAAI,MAAM,0CAA0C,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,4FAA4F;AAC5F,eAAO,MAAM,QAAQ,WAAY,MAAM,mKAOpC,CAAC;AAEJ,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,yBAAyB,kHACE,CAAC;AAElE,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,+BAA+B,wHACE,CAAC;AAExE,sFAAsF;AACtF,eAAO,MAAM,UAAU,WAAY,MAAM,WAAW,SAAS,UAAU,EAAE,8HAMlD,CAAC;AAExB,eAAO,MAAM,aAAa,WAAY,MAAM,UAAU,UAAU,oIAOzC,CAAC;AAgBxB,eAAO,MAAM,UAAU,WAAY,MAAM,8qBAQtC,CAAC"}

package/dist/litellm/team-permission.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The `object_permission` half of `LiteLLM.Team`: reading it, comparing it, and the body that writes it.
+ *
+ * ★ THE WRITE IS A MERGE BY TOP-LEVEL FIELD (measured, `object_permission_utils.py` lines 114-118,
+ *   1.103.0, read from the live container): `prepare_object_permission_upsert` builds
+ *   `{**existing_fields, **new_object_permission}`, so a field the request leaves out KEEPS its stored
+ *   value, and a field sent as `[]` (or `{}`) REPLACES it with an empty one. That is what lets this
+ *   resource manage five fields and leave the other seven of an adopted team alone. docs.litellm.ai/docs/
+ *   mcp_grant_access says the same: "unset fields are left unchanged on update".
+ * ★ NULL AND `[]` ARE THE SAME "NOTHING GRANTED". A team that never had a grant reads `null` or `[]`
+ *   (`LiteLLM_ObjectPermissionTable` defaults), so both normalise to an empty list before comparing.
+ * ⚠️ `mcp_tool_permissions` CAN COME BACK AS A JSON STRING (it is stored through `safe_dumps` "for
+ *   GraphQL compatibility", and `_resolve_team_allowed_mcp_servers` itself handles both), so the read
+ *   accepts an object or a string.
+ * ⚠️ THE SERVER REFUSES, AND THIS FILE DOES NOT REPEAT IT: a name or alias that matches several MCP
+ *   servers cannot key `mcp_tool_permissions` (400, `reject_ambiguous_mcp_tool_permission_keys`), and a
+ *   non-admin caller cannot grant `all-proxy-mcpservers` (403). The one refusal made here is that
+ *   sentinel, because it silently grants every server on the proxy and is not something a declaration
+ *   should carry by accident.
+ */
+import type * as team from '@distilled.cloud/litellm/team_management';
+import type { TeamObjectPermission, TeamObjectPermissionAttributes } from './team-types.ts';
+/** A live `object_permission` (or `null`) as this resource compares it. */
+export declare const toPermissionAttributes: (value: unknown) => TeamObjectPermissionAttributes;
+/** Wire names of the DECLARED fields where live and declared disagree. An undeclared field never counts. */
+export declare const permissionDiffers: (live: TeamObjectPermissionAttributes, declared: TeamObjectPermission | undefined) => readonly string[];
+/**
+ * The `object_permission` body: the declared fields named in `only` (all of them when `only` is
+ * absent, for a create). ⛔ Never a `null`: a merge would read it as "clear", and the declaration said
+ * a list.
+ */
+export declare const permissionBody: (declared: TeamObjectPermission, only?: ReadonlySet<string>) => team.LiteLLMObjectPermissionBase;
+/** The first reason a declared object permission is refused, or `undefined`. */
+export declare const permissionProblem: (declared: TeamObjectPermission | undefined) => string | undefined;
+//# sourceMappingURL=team-permission.d.ts.map

package/dist/litellm/team-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-permission.d.ts","sourceRoot":"","sources":["../../src/litellm/team-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,0CAA0C,CAAC;AAUtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AA+B5F,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,UAAW,OAAO,KAAG,8BASvD,CAAC;AAaF,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,SACtB,8BAA8B,YAC1B,oBAAoB,GAAG,SAAS,KACzC,SAAS,MAAM,EAcjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,aACf,oBAAoB,SACvB,WAAW,CAAC,MAAM,CAAC,KACzB,IAAI,CAAC,2BAeP,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,aAClB,oBAAoB,GAAG,SAAS,KACzC,MAAM,GAAG,SA0BX,CAAC"}