@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/litellm/team-types.d.ts

@@ -0,0 +1,101 @@
+/**
+ * What a `LiteLLM.Team` declares (props) and what is remembered about it (attributes).
+ *
+ * ★ A TEAM (`LiteLLM_TeamTable`, `/team/*`) owns keys, a member roster and an ACCESS CEILING: the
+ *   models it may use, and an `object_permission` that says which MCP servers, MCP access groups,
+ *   toolsets and tools its keys may reach. This resource manages exactly those, plus the team's
+ *   attachment to unified access groups. Nothing else about a team is touched.
+ * ⛔ THE TEAM'S `mcpServers` LIST IS A CEILING THAT INTERSECTS EVERY KEY'S OWN GRANTS. Where both a team
+ *   and a key list servers, the key reaches only the intersection
+ *   (`user_api_key_auth_mcp.py` lines 1482-1503, 1.103.0; docs.litellm.ai/docs/mcp_grant_access). A
+ *   NON-EMPTY team list therefore silently removes access from any key that was granted a server the
+ *   team does not list, and `[]` is "this level does not restrict". Grant servers on keys, toolsets
+ *   (`mcpToolsets`) or unified access groups, and leave the team's list `[]`, unless a ceiling is meant.
+ * ⛔ `models: []` MEANS EVERY MODEL, not none (LiteLLM's own field doc: "If empty, assumes all models
+ *   are allowed"). Compared only when declared.
+ * ⚠️ NOT MODELLED, on purpose, so an adopted team keeps them and none is ever sent: budgets and rate
+ *   limits (a team's `max_budget` is a HARD cap that 429s every key, the 2026-09-28 incident), the
+ *   metadata-backed fields (`guardrails`, `policies`, `tags`, `prompts`, `logging`,
+ *   `secret_manager_settings`, `allowed_passthrough_routes`, `team_member_key_duration`,
+ *   `disable_global_guardrails` — Enterprise, each a 403 when set on a proxy without a licence,
+ *   `common_utils.py` line 463 and `_types.py` lines 4843-4853), `model_max_budget` (Enterprise, 403,
+ *   `common_utils.py` lines 73-86), `metadata`, `router_settings`, `model_aliases`, organisation and the
+ *   other `object_permission` fields (vector stores, agents, models, search tools, skills).
+ */
+/** The object permission fields this resource manages. Each one is compared and sent ONLY WHEN DECLARED. */
+export interface TeamObjectPermission {
+    /**
+     * MCP servers the team's keys may reach, by `server_id`, alias or name. ⛔ A ceiling: see above.
+     * `[]` clears the list. The sentinel `all-proxy-mcpservers` is refused (Proxy admin only,
+     * `object_permission_utils.py` line 480, and it grants every server).
+     */
+    readonly mcpServers?: readonly string[];
+    /** MCP access group NAMES (the bare names on MCP server rows), not unified access group ids. */
+    readonly mcpAccessGroups?: readonly string[];
+    /** Toolset IDS (`toolset.toolsetId` of a `LiteLLM.Toolset`), not names. */
+    readonly mcpToolsets?: readonly string[];
+    /** Per-server tool allowlist: `server_id` (or alias or name) to the tools it may call. */
+    readonly mcpToolPermissions?: Readonly<Record<string, readonly string[]>>;
+    /**
+     * Tool names blocked for this team. ⚠️ The same list `POST /v1/tool/policy` writes for a team override,
+     * which is why `LiteLLM.ToolPolicy` does not model overrides.
+     */
+    readonly blockedTools?: readonly string[];
+}
+export interface TeamMember {
+    /** The user's `user_id`. A member is added by id only: an email would make LiteLLM allocate the id. */
+    readonly userId: string;
+    /** Default `user`. `admin` is an ENTERPRISE feature (400 on a proxy without a licence). */
+    readonly role?: 'user' | 'admin';
+}
+export interface TeamProps {
+    /** The team's alias. Not unique in LiteLLM (a policy attachment matches it as a pattern). Always compared. */
+    readonly teamAlias: string;
+    /**
+     * The team's id. Set it to ADOPT an existing team (it needs `--adopt`); without it a deterministic
+     * physical name is used for a create. ⛔ A DIFFERENT DECLARED ID IS A REPLACE (create-first, so the old
+     * team is only removed by an opt-in `RemovalPolicy.destroy()`, which also deletes its keys).
+     */
+    readonly teamId?: string;
+    /** Models the team's keys may use, compared as a set, only when declared. `[]` means every model. */
+    readonly models?: readonly string[];
+    /** Whether the team is blocked (every key stops). Compared only when declared. */
+    readonly blocked?: boolean;
+    /**
+     * Unified access group ids the team is attached to (`accessGroup.accessGroupId`), compared as a set,
+     * only when declared. LiteLLM mirrors it into each group's `assigned_team_ids` in the same transaction,
+     * so `LiteLLM.AccessGroup` does not declare teams.
+     */
+    readonly accessGroupIds?: readonly string[];
+    readonly objectPermission?: TeamObjectPermission;
+    /**
+     * Members that must exist, compared only when declared. ⛔ ADDITIVE ONLY: a live member the declaration
+     * does not list is left alone, because `/team/member_delete` also DELETES the keys that user created
+     * for the team (`team_endpoints.py` lines 3701-3748). A declared member with another role is updated.
+     * Adding a member creates its user row when the id is new. `/team/new` itself adds the caller as an
+     * `admin` member unless the proxy sets `disable_auto_add_proxy_admin_to_teams`.
+     */
+    readonly members?: readonly TeamMember[];
+}
+/** The object permission as a read returns it: every managed field, `[]` where LiteLLM holds none. */
+export interface TeamObjectPermissionAttributes {
+    readonly mcpServers: readonly string[];
+    readonly mcpAccessGroups: readonly string[];
+    readonly mcpToolsets: readonly string[];
+    readonly mcpToolPermissions: Readonly<Record<string, readonly string[]>>;
+    readonly blockedTools: readonly string[];
+}
+export interface TeamMemberAttributes {
+    readonly userId: string;
+    readonly role: string;
+}
+export interface TeamAttributes {
+    readonly teamId: string;
+    readonly teamAlias: string;
+    readonly models: readonly string[];
+    readonly blocked: boolean;
+    readonly accessGroupIds: readonly string[];
+    readonly objectPermission: TeamObjectPermissionAttributes;
+    readonly members: readonly TeamMemberAttributes[];
+}
+//# sourceMappingURL=team-types.d.ts.map

package/dist/litellm/team-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-types.d.ts","sourceRoot":"","sources":["../../src/litellm/team-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,4GAA4G;AAC5G,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,gGAAgG;IAChG,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,0FAA0F;IAC1F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1E;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,8GAA8G;IAC9G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,sGAAsG;AACtG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACzE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,8BAA8B,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD"}

package/dist/litellm/team.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `LiteLLM.Team` — one row of LiteLLM's team table (`/team/*`): the models, MCP grants and roster that
+ * bound every key of a team. Props, the MCP ceiling and everything left out: team-types.ts.
+ *
+ * ★ ADOPT BY ID. `teamId` names the live team; without it a deterministic physical name is used. A
+ *   team with that id and no state is `Unowned`, so it needs `--adopt`. (`team_alias` is not unique, so
+ *   it cannot identify a team.)
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a team DELETES EVERY KEY OF THE TEAM (team-operations.ts).
+ *   Opt in with `.pipe(RemovalPolicy.destroy())`, knowing that.
+ * ★ A DECLARED FIELD IS THE TRUTH, AN UNDECLARED ONE IS LEFT ALONE. `models`, `blocked`,
+ *   `accessGroupIds`, each object-permission field and the roster are compared and sent only when
+ *   declared; the update is a partial one, and the object permission a merge by field (team-permission.ts),
+ *   so an adopted team keeps everything this resource does not manage.
+ * ⛔ THE ROSTER IS ADDITIVE ONLY (team-members.ts): removing a member would delete that user's keys.
+ * ⚠️ NO LICENCE GATE ON THE FIELDS IT MANAGES except a member's `admin` role (Enterprise, 400 without a
+ *   licence: `team_endpoints.py` lines 2713-2723, 3806-3810). Every other Enterprise team field is one
+ *   this resource never sends (team-types.ts lists them).
+ * ⛔ NO LITELLM CREDENTIAL IS A PROP; `litellmProviders`' layer supplies `Credentials`.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { LitellmRegistryAbsentAfterWriteError, LitellmRegistryNotConvergedError } from './registry-errors.ts';
+import type { TeamAttributes, TeamProps } from './team-types.ts';
+export type { TeamAttributes, TeamProps };
+export type { TeamMember, TeamMemberAttributes, TeamObjectPermission, TeamObjectPermissionAttributes, } from './team-types.ts';
+export type { RegistryError as TeamError } from './registry-errors.ts';
+export interface LiteLLMTeam extends Resource<'LiteLLM.Team', TeamProps, TeamAttributes> {
+}
+export declare const LiteLLMTeam: import("alchemy").ResourceClass<LiteLLMTeam>;
+export declare const isLiteLLMTeam: (value: unknown) => value is LiteLLMTeam;
+type Args<P> = {
+    id: string;
+    instanceId: string;
+    output: TeamAttributes | undefined;
+} & P;
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel. */
+export declare const teamHandlers: {
+    /** ⛔ With no `output` this is the adoption probe, so the refusals run here too (registry-support.ts). */
+    read: ({ id, instanceId, olds, output }: Args<{
+        olds: TeamProps;
+    }>) => Effect.Effect<TeamAttributes | undefined, import("@distilled.cloud/litellm/team_management").GetTeamInfoTeamInfoError, import("@distilled.cloud/litellm/Credentials").Credentials | import("alchemy").InstanceId | import("alchemy").Stack | import("alchemy").Stage>;
+    diff: ({ news, output }: {
+        news: Input<TeamProps>;
+        output: TeamAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+        readonly deleteFirst: false;
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'noop';
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'update';
+    } | undefined, import("./registry-errors.ts").LitellmRegistryInvalidError, never>;
+    reconcile: ({ id, instanceId, news, output }: Args<{
+        news: TeamProps;
+    }>) => Effect.Effect<TeamAttributes, LitellmRegistryAbsentAfterWriteError | import("./registry-errors.ts").LitellmRegistryInvalidError | LitellmRegistryNotConvergedError | import("@distilled.cloud/litellm/team_management").UpdateTeamTeamUpdatePostError, import("@distilled.cloud/litellm/Credentials").Credentials | import("alchemy").InstanceId | import("alchemy").Stack | import("alchemy").Stage>;
+    delete: ({ output }: {
+        output: TeamAttributes;
+    }) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/litellm/team_management").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/litellm/Errors").LitellmParseError | import("@distilled.cloud/litellm/team_management").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | import("@distilled.cloud/litellm/team_management").UnprocessableEntity, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    /** ⛔ EMPTY: adoption is an explicit act (`--adopt`), and no ownership mark exists to filter by. */
+    list: () => Effect.Effect<never[], never, never>;
+};
+export declare const LiteLLMTeamProvider: () => import("effect/Layer").Layer<Provider.Provider<LiteLLMTeam>, never, import("@distilled.cloud/litellm/Credentials").Credentials | import("alchemy").Stack | import("alchemy").Stage>;
+//# sourceMappingURL=team.d.ts.map

package/dist/litellm/team.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../src/litellm/team.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,oCAAoC,EACpC,gCAAgC,EACjC,MAAM,sBAAsB,CAAC;AAY9B,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AAC1C,YAAY,EACV,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAIvE,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC;CAAG;AAE3F,eAAO,MAAM,WAAW,8CAEtB,CAAC;AAEH,eAAO,MAAM,aAAa,UAAW,OAAO,KAAG,KAAK,IAAI,WACe,CAAC;AAexE,KAAK,IAAI,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAA;CAAE,GAAG,CAAC,CAAC;AAE1F,oDAAoD;AACpD,eAAO,MAAM,YAAY;IACvB,yGAAyG;IACzG,IAAI,qCAAqC,IAAI,CAAC;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC;IAUlE,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAA;KAAE;yBAOhE,SAAS;;;;yBAGb,MAAM;;;yBACN,QAAQ;;IAG3B,SAAS,qCAAqC,IAAI,CAAC;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC;IA6CvE,MAAM,eAAe;QAAE,MAAM,EAAE,cAAc,CAAA;KAAE;IAE/C,mGAAmG;IACnG,IAAI;CACL,CAAC;AAEF,eAAO,MAAM,mBAAmB,2LACqD,CAAC"}

package/dist/litellm/tool-policy-form.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Wire bodies, comparison and refusals for `LiteLLM.ToolPolicy`, testable without a server.
+ *
+ * ★ THE WRITE IS AN UPSERT. `update_tool_policy` (`db/tool_registry_writer.py`, 1.103.0) upserts on
+ *   `tool_name`: it CREATES the row when the tool has not been seen (a sent field, else `untrusted`),
+ *   and on an existing row updates only the fields that are sent. So there is no separate create.
+ */
+import type * as tools from '@distilled.cloud/litellm/tools';
+import { type ToolPolicyAttributes, type ToolPolicyProps } from './tool-policy-types.ts';
+/** The first reason a declaration is refused, or `undefined`. Runs before any request. */
+export declare const firstProblem: (props: ToolPolicyProps) => string | undefined;
+/** One tool row. `undefined` is "not a tool row". A missing policy reads as LiteLLM's default. */
+export declare const toAttributes: (value: unknown) => ToolPolicyAttributes | undefined;
+/** Wire names of the DECLARED fields where live and declared disagree. */
+export declare const differing: (live: ToolPolicyAttributes, props: ToolPolicyProps) => readonly string[];
+/**
+ * The write: the declared fields that differ (all declared ones when the tool row is new). ⚠️ NEVER a
+ * `team_id` or `key_hash` — those turn the call into an override of another object's `blocked_tools`.
+ */
+export declare const updateBody: (props: ToolPolicyProps, live: ToolPolicyAttributes | undefined) => tools.UpdateToolPolicyV1ToolPolicyPostRequest;
+//# sourceMappingURL=tool-policy-form.d.ts.map

package/dist/litellm/tool-policy-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-policy-form.d.ts","sourceRoot":"","sources":["../../src/litellm/tool-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,KAAK,KAAK,MAAM,gCAAgC,CAAC;AAE7D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAShC,0FAA0F;AAC1F,eAAO,MAAM,YAAY,UAAW,eAAe,KAAG,MAAM,GAAG,SAiB9D,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,oBAAoB,GAAG,SAcpE,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,SAAS,SACd,oBAAoB,SACnB,eAAe,KACrB,SAAS,MAAM,EASjB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,UACd,eAAe,QAChB,oBAAoB,GAAG,SAAS,KACrC,KAAK,CAAC,uCAWR,CAAC"}

package/dist/litellm/tool-policy-operations.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The two LiteLLM `/v1/tool*` calls `LiteLLM.ToolPolicy` uses, through the SDK's typed operations in
+ * `@distilled.cloud/litellm/tools` (LiteLLM 1.103.0):
+ *
+ *   read   `getToolV1ToolToolNameGet`       GET  /v1/tool/{tool_name:path}
+ *   write  `updateToolPolicyV1ToolPolicyPost`  POST /v1/tool/policy   (an UPSERT on tool_name)
+ *
+ * ⛔ A READ THAT SAYS "NOT FOUND" IS NOT PROOF OF ABSENCE. `db_get_tool` (`db/tool_registry_writer.py`)
+ *   wraps its query in `except Exception: log; return None`, and the route turns `None` into a 404, so a
+ *   database error reads exactly like a tool that was never seen. Nothing here depends on it: the write
+ *   is an upsert, so a wrong "absent" ends in a write that succeeds or fails loudly, and the read back
+ *   after it is what the deploy reports.
+ * ⛔ THERE IS NO DELETE ROUTE for a tool row or for its global policy: `DELETE /v1/tool/{name}/overrides`
+ *   removes only a team or key override. So this resource's delete RESETS the fields it managed to
+ *   LiteLLM's default (`untrusted`), it does not remove a row. It is a write, so it runs only when the
+ *   stack opts in (`retain` is the default), and only for a field that is not already the default.
+ * ⛔ NO MESSAGE SNIFFING: absence is the SDK's `NotFound` CLASS (registry-support.ts) and nothing else.
+ */
+import * as tools from '@distilled.cloud/litellm/tools';
+import * as Effect from 'effect/Effect';
+import { type ToolPolicyProps } from './tool-policy-types.ts';
+/** One tool by name, or `undefined` when the proxy has no such row (see the file header). */
+export declare const readTool: (toolName: string) => Effect.Effect<import("./tool-policy-types.ts").ToolPolicyAttributes | undefined, tools.GetToolV1ToolToolNameGetError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const writeToolPolicy: (body: tools.UpdateToolPolicyV1ToolPolicyPostRequest) => Effect.Effect<void, tools.UpdateToolPolicyV1ToolPolicyPostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/**
+ * The delete: reset each managed field that is not already the default, and nothing else. A tool the
+ * proxy does not know, or one already at the defaults, sends no request (an empty body would be a 400).
+ */
+export declare const resetToolPolicy: (props: ToolPolicyProps) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/litellm/Errors").LitellmParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | tools.UnprocessableEntity, import("@distilled.cloud/litellm/Credentials").Credentials>;
+//# sourceMappingURL=tool-policy-operations.d.ts.map

package/dist/litellm/tool-policy-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-policy-operations.d.ts","sourceRoot":"","sources":["../../src/litellm/tool-policy-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,KAAK,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEnF,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,aAAc,MAAM,sLAOtC,CAAC;AAEJ,eAAO,MAAM,eAAe,SAAU,KAAK,CAAC,uCAAuC,iIACH,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,eAAe,UAAW,eAAe,6oBAenD,CAAC"}

package/dist/litellm/tool-policy-types.d.ts

@@ -0,0 +1,46 @@
+/**
+ * What a `LiteLLM.ToolPolicy` declares (props) and what is remembered about it (attributes).
+ *
+ * ★ A TOOL POLICY IS THE TRUST SETTING OF ONE TOOL in `LiteLLM_ToolTable` (`/v1/tool/policy`): an
+ *   input policy (`untrusted`, `trusted`, `blocked`) and an output policy (`untrusted`, `trusted`).
+ *   LiteLLM DISCOVERS tools as requests use them and gives each `untrusted`/`untrusted`
+ *   (`TOOL_POLICY_OPTIONS`, `tool_management_endpoints.py`, 1.103.0); this resource sets them.
+ * ⛔ IT DOES NOTHING UNTIL THE `tool_policy` GUARDRAIL IS CONFIGURED. The rows are data; only
+ *   `guardrails/guardrail_hooks/tool_policy/tool_policy_guardrail.py` reads them, and it is a guardrail
+ *   the proxy's own config must enable (`guardrails: - guardrail_name: tool_policy, litellm_params:
+ *   { guardrail: tool_policy, mode: post_call }`, its module docstring). Declaring a policy without it
+ *   is an inert row, not a control. Measured 2026-09-30: the rendered CT100 config has no
+ *   `tool_policy` guardrail (count 0), so on that proxy today these rows are not enforced.
+ * ⚠️ NOT MODELLED: the team and key OVERRIDES of `POST /v1/tool/policy` (`team_id`, `key_hash`). An
+ *   override is stored as an entry of that team's or key's `object_permission.blocked_tools`
+ *   (`add_tool_to_object_permission_blocked`), the same list `LiteLLM.Team` manages through
+ *   `objectPermission.blockedTools`; two resources writing one list would fight. Block a tool for a
+ *   team there, and for a key on the key.
+ */
+export type ToolInputPolicy = 'untrusted' | 'trusted' | 'blocked';
+export type ToolOutputPolicy = 'untrusted' | 'trusted';
+export interface ToolPolicyProps {
+    /**
+     * The tool's name as LiteLLM records it (for an MCP tool, `<server prefix>-<tool>`). Changing it is
+     * a DIFFERENT tool, so it is a replace. Refused if it is one of the names the route table shadows
+     * (`list`, `spend`, `policy/options`) or ends in `/detail` or `/logs`: the read is
+     * `GET /v1/tool/{tool_name:path}`, which those routes are registered before.
+     */
+    readonly toolName: string;
+    /** Compared and sent only when declared. Declare at least one of the two. */
+    readonly inputPolicy?: ToolInputPolicy;
+    /** Compared and sent only when declared. Declare at least one of the two. */
+    readonly outputPolicy?: ToolOutputPolicy;
+}
+export interface ToolPolicyAttributes {
+    readonly toolName: string;
+    readonly toolId: string;
+    /** What the row carries, as a string: a later LiteLLM may add a value this package does not know. */
+    readonly inputPolicy: string;
+    readonly outputPolicy: string;
+}
+/** What LiteLLM gives a newly discovered tool, and what `delete` resets a managed field to. */
+export declare const DEFAULT_TOOL_POLICY = "untrusted";
+export declare const INPUT_POLICIES: readonly ToolInputPolicy[];
+export declare const OUTPUT_POLICIES: readonly ToolOutputPolicy[];
+//# sourceMappingURL=tool-policy-types.d.ts.map

package/dist/litellm/tool-policy-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-policy-types.d.ts","sourceRoot":"","sources":["../../src/litellm/tool-policy-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qGAAqG;IACrG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,cAAc,EAAE,SAAS,eAAe,EAAwC,CAAC;AAC9F,eAAO,MAAM,eAAe,EAAE,SAAS,gBAAgB,EAA6B,CAAC"}

package/dist/litellm/tool-policy.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `LiteLLM.ToolPolicy` — the input and output trust policy of one tool in LiteLLM's tool registry
+ * (`LiteLLM_ToolTable`, `POST /v1/tool/policy`). Props, the enforcement precondition and what is left
+ * out: tool-policy-types.ts.
+ *
+ * ⛔ INERT WITHOUT THE `tool_policy` GUARDRAIL in the proxy's own config (tool-policy-types.ts).
+ * ★ ADOPT BY NAME. LiteLLM discovers tools itself, so a tool it has already seen has a live row with no
+ *   state: `Unowned`, which needs `--adopt` (a row at the defaults is adopted the same way). A tool
+ *   never seen has no row, and the write creates it.
+ * ★ `defaultRemovalPolicy: 'retain'` — there is no delete route. `delete` RESETS the managed fields to
+ *   `untrusted` (tool-policy-operations.ts), which for an `input_policy` of `blocked` re-opens a tool.
+ *   Opt in with `.pipe(RemovalPolicy.destroy())`.
+ * ⚠️ NO LICENCE GATE ON THESE ROUTES: `tool_management_endpoints.py` has no `premium_user` check
+ *   (1.103.0). Whether the `tool_policy` guardrail itself is licence-gated is UNVERIFIED (its module
+ *   has no `premium` reference either).
+ * ⛔ NO LITELLM CREDENTIAL IS A PROP; `litellmProviders`' layer supplies `Credentials`.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { LitellmRegistryAbsentAfterWriteError, LitellmRegistryNotConvergedError } from './registry-errors.ts';
+import type { ToolPolicyAttributes, ToolPolicyProps } from './tool-policy-types.ts';
+export type { ToolPolicyAttributes, ToolPolicyProps };
+export type { ToolInputPolicy, ToolOutputPolicy } from './tool-policy-types.ts';
+export type { RegistryError as ToolPolicyError } from './registry-errors.ts';
+export interface LiteLLMToolPolicy extends Resource<'LiteLLM.ToolPolicy', ToolPolicyProps, ToolPolicyAttributes> {
+}
+export declare const LiteLLMToolPolicy: import("alchemy").ResourceClass<LiteLLMToolPolicy>;
+export declare const isLiteLLMToolPolicy: (value: unknown) => value is LiteLLMToolPolicy;
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel. */
+export declare const toolPolicyHandlers: {
+    /** ⛔ With no `output` this is the adoption probe, so the refusals run here too (registry-support.ts). */
+    read: ({ olds, output }: {
+        olds: ToolPolicyProps;
+        output: ToolPolicyAttributes | undefined;
+    }) => Effect.Effect<ToolPolicyAttributes | undefined, import("@distilled.cloud/litellm/tools").GetToolV1ToolToolNameGetError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    diff: ({ news, output, }: {
+        news: Input<ToolPolicyProps>;
+        output: ToolPolicyAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'replace';
+        readonly deleteFirst: false;
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'noop';
+    } | {
+        readonly deleteFirst?: never;
+        readonly action: 'update';
+    } | undefined, import("./registry-errors.ts").LitellmRegistryInvalidError, never>;
+    reconcile: ({ news }: {
+        news: ToolPolicyProps;
+    }) => Effect.Effect<ToolPolicyAttributes, LitellmRegistryAbsentAfterWriteError | import("./registry-errors.ts").LitellmRegistryInvalidError | LitellmRegistryNotConvergedError | import("@distilled.cloud/litellm/tools").UpdateToolPolicyV1ToolPolicyPostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    /** ⛔ A RESET, not a removal: see tool-policy-operations.ts. */
+    delete: ({ olds }: {
+        olds: ToolPolicyProps;
+    }) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/litellm/Errors").LitellmParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | import("@distilled.cloud/litellm/tools").UnprocessableEntity, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    /** ⛔ EMPTY: adoption is an explicit act (`--adopt`), and a discovered tool row has no owner mark. */
+    list: () => Effect.Effect<never[], never, never>;
+};
+export declare const LiteLLMToolPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<LiteLLMToolPolicy>, never, import("@distilled.cloud/litellm/Credentials").Credentials>;
+//# sourceMappingURL=tool-policy.d.ts.map

package/dist/litellm/tool-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-policy.d.ts","sourceRoot":"","sources":["../../src/litellm/tool-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,oCAAoC,EACpC,gCAAgC,EACjC,MAAM,sBAAsB,CAAC;AAI9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEpF,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAChF,YAAY,EAAE,aAAa,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI7E,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,CACrB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,mBAAmB,UAAW,OAAO,KAAG,KAAK,IAAI,iBACe,CAAC;AAE9E,oDAAoD;AACpD,eAAO,MAAM,kBAAkB;IAC7B,yGAAyG;IACzG,IAAI,qBAAqB;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAA;KAAE;IAU5F,IAAI,sBAGD;QACD,IAAI,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7B,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC;KAC1C;yBAOsB,SAAS;;;;yBAGb,MAAM;;;yBACN,QAAQ;;IAG3B,SAAS,aAAa;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE;IA4B/C,+DAA+D;IAC/D,MAAM,aAAa;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE;IAE5C,qGAAqG;IACrG,IAAI;CACL,CAAC;AAEF,eAAO,MAAM,yBAAyB,6IAInC,CAAC"}

package/dist/litellm/toolset-form.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Wire bodies, comparison and refusals for `LiteLLM.Toolset`, testable without a server.
+ *
+ * ★ THE EDIT IS A PARTIAL ONE (`update_mcp_toolset`, 1.103.0, read from the live container): an absent
+ *   field keeps its stored value, a `null` clears it, EXCEPT `toolset_name` and `tools`, where `null`
+ *   is a no-op ("a toolset always has a name and a tool list"). So `tools` is sent only as a list, and
+ *   emptying a selection is an explicit `[]`. This resource never sends a `null` name or list.
+ */
+import type * as mcp from '@distilled.cloud/litellm/mcp_management';
+import type { ToolsetAttributes, ToolsetProps } from './toolset-types.ts';
+/** The first reason a declaration is refused, or `undefined`. Runs before any request. */
+export declare const firstProblem: (props: ToolsetProps) => string | undefined;
+/** One toolset row. `undefined` is "not a toolset": the caller refuses the whole answer. */
+export declare const toAttributes: (value: unknown) => ToolsetAttributes | undefined;
+/** Wire names of the fields where live and declared disagree. */
+export declare const differing: (live: ToolsetAttributes, props: ToolsetProps) => readonly string[];
+export declare const createBody: (props: ToolsetProps) => mcp.AddMcpToolsetV1McpToolsetPostRequest;
+/** Only what differs, and never a `null` name or list (LiteLLM ignores those). */
+export declare const updateBody: (props: ToolsetProps, live: ToolsetAttributes) => mcp.EditMcpToolsetV1McpToolsetPutRequest;
+//# sourceMappingURL=toolset-form.d.ts.map

package/dist/litellm/toolset-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolset-form.d.ts","sourceRoot":"","sources":["../../src/litellm/toolset-form.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,KAAK,GAAG,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AAgBvF,0FAA0F;AAC1F,eAAO,MAAM,YAAY,UAAW,YAAY,KAAG,MAAM,GAAG,SAoB3D,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,iBAAiB,GAAG,SAmBjE,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,SAAS,SAAU,iBAAiB,SAAS,YAAY,KAAG,SAAS,MAAM,EAQvF,CAAC;AAKF,eAAO,MAAM,UAAU,UAAW,YAAY,KAAG,GAAG,CAAC,oCAInD,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,UAAU,UACd,YAAY,QACb,iBAAiB,KACtB,GAAG,CAAC,oCAQN,CAAC"}

package/dist/litellm/toolset-operations.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The five LiteLLM `/v1/mcp/toolset*` calls `LiteLLM.Toolset` uses, through the SDK's typed operations
+ * in `@distilled.cloud/litellm/mcp_management` (LiteLLM 1.103.0):
+ *
+ *   list    `fetchMcpToolsetsV1McpToolsetGet`             GET    /v1/mcp/toolset
+ *   read    `fetchMcpToolsetV1McpToolsetToolsetIdGet`     GET    /v1/mcp/toolset/{toolset_id}
+ *   create  `addMcpToolsetV1McpToolsetPost`               POST   /v1/mcp/toolset          (201)
+ *   update  `editMcpToolsetV1McpToolsetPut`               PUT    /v1/mcp/toolset
+ *   delete  `removeMcpToolsetV1McpToolsetToolsetIdDelete` DELETE /v1/mcp/toolset/{toolset_id} (202, no body)
+ *
+ * ⛔ THE LIST CANNOT PROVE ABSENCE, THE BY-ID READ CAN (`mcp_management_endpoints.py` and
+ *   `toolset_db.py`, read from the live 1.103.0 container). `list_mcp_toolsets` wraps its query in
+ *   `except Exception: … return []`, so a database error answers an EMPTY LIST with a 200; and the
+ *   route narrows the answer to the caller's granted toolsets unless the caller is an admin. The by-id
+ *   route reads the table (`get_mcp_toolset`, a `find_unique`) and answers 404 only for a missing row.
+ *   So the list is used ONLY to adopt by name, and everything else reads by id. A wrong "absent" from
+ *   the list can only end in a create, which a unique name turns into a 409 that fails the deploy.
+ * ⛔ NO MESSAGE SNIFFING. `readToolset` tests the SDK's `NotFound` CLASS (registry-support.ts) and
+ *   nothing else; a 401, a 403 or a dead network propagates, and is never read as absence.
+ * ★ DELETE IS IDEMPOTENT BY A REAL READ: a failed DELETE is swallowed only when a by-id read says the
+ *   row is gone. A 403 (only PROXY_ADMIN may delete) leaves it live, so it re-raises the original.
+ */
+import * as mcp from '@distilled.cloud/litellm/mcp_management';
+import * as Effect from 'effect/Effect';
+import { type LitellmOpContext } from './operations.ts';
+import { LitellmRegistryUnreadableError } from './registry-errors.ts';
+import type { ToolsetAttributes } from './toolset-types.ts';
+/** ⚠️ NOT PROOF OF ABSENCE: see the file header. Adopt-by-name only. */
+export declare const listToolsets: () => Effect.Effect<readonly ToolsetAttributes[], mcp.FetchMcpToolsetsV1McpToolsetGetError | LitellmRegistryUnreadableError, LitellmOpContext>;
+/**
+ * One toolset BY ID, from the table, or `undefined` when the proxy has no such row. The row must carry
+ * the id asked for; anything else the proxy answers is "no such row".
+ */
+export declare const readToolset: (toolsetId: string) => Effect.Effect<ToolsetAttributes | undefined, mcp.FetchMcpToolsetV1McpToolsetToolsetIdGetError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/** The created row, which carries the id LiteLLM issued. `undefined` when the answer is not a toolset. */
+export declare const createToolset: (body: mcp.AddMcpToolsetV1McpToolsetPostRequest) => Effect.Effect<ToolsetAttributes | undefined, mcp.AddMcpToolsetV1McpToolsetPostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const updateToolset: (body: mcp.EditMcpToolsetV1McpToolsetPutRequest) => Effect.Effect<void, mcp.EditMcpToolsetV1McpToolsetPutError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+export declare const deleteToolset: (toolsetId: string) => Effect.Effect<void, mcp.RemoveMcpToolsetV1McpToolsetToolsetIdDeleteError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+//# sourceMappingURL=toolset-operations.d.ts.map

package/dist/litellm/toolset-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolset-operations.d.ts","sourceRoot":"","sources":["../../src/litellm/toolset-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,GAAG,MAAM,yCAAyC,CAAC;AAC/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAGtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAI5D,wEAAwE;AACxE,eAAO,MAAM,YAAY,QAAO,MAAM,CAAC,MAAM,CAC3C,SAAS,iBAAiB,EAAE,EAC5B,GAAG,CAAC,oCAAoC,GAAG,8BAA8B,EACzE,gBAAgB,CAoBf,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,WAAW,cAAe,MAAM,+JAO1C,CAAC;AAEJ,0GAA0G;AAC1G,eAAO,MAAM,aAAa,SAAU,GAAG,CAAC,oCAAoC,qJAGzE,CAAC;AAEJ,eAAO,MAAM,aAAa,SAAU,GAAG,CAAC,oCAAoC,4HACD,CAAC;AAE5E,eAAO,MAAM,aAAa,cAAe,MAAM,0IAS5C,CAAC"}

package/dist/litellm/toolset-types.d.ts

@@ -0,0 +1,46 @@
+/**
+ * What a `LiteLLM.Toolset` declares (props) and what is remembered about it (attributes).
+ *
+ * ★ A TOOLSET IS A NAMED SELECTION OF `{ server_id, tool_name }` PAIRS drawn from one or more MCP
+ *   servers (`LiteLLM_MCPToolsetTable`, `/v1/mcp/toolset`; docs.litellm.ai/docs/mcp_toolsets). A key or
+ *   team is granted one through `object_permission.mcp_toolsets`, which holds the toolset's ID
+ *   (`fetch_mcp_toolsets` filters `list_mcp_toolsets(toolset_ids=…)`), so `LiteLLM.Team` takes
+ *   `toolset.toolsetId`, not the name.
+ * ⚠️ THE ID IS THE PROXY'S. `create_mcp_toolset` sets `toolset_id = str(uuid.uuid4())` and the create
+ *   request has no id field, so nothing here can pick one. The id LiteLLM answers is what is recorded.
+ * ★ THE NAME IS A URL SEGMENT. A toolset is served at `/toolset/{toolset_name}/mcp`
+ *   (`proxy_server.py` line 19346) and `litellm_proxy/mcp/<toolset_name>` (docs), so a name with a `/`
+ *   can never be addressed. LiteLLM itself accepts one; the refusal is this package's.
+ * ⚠️ NOT MODELLED: nothing beyond name, description and tools — the table has no other column that a
+ *   write reaches.
+ */
+export interface ToolsetTool {
+    /** The MCP server's `server_id`. Declare it as `server.serverId` (a `LiteLLM.MCPServer`). */
+    readonly serverId: string;
+    /** The tool's name on that server, as the server lists it. */
+    readonly toolName: string;
+}
+export interface ToolsetProps {
+    /**
+     * The toolset's name, and the way an existing row is ADOPTED. `toolset_name` is unique in the table
+     * (a create or rename onto a taken name is a 409), so the match is exact. Changing it is an update of
+     * the same row, never a replace.
+     */
+    readonly toolsetName: string;
+    /** Compared only when declared: adopting a row never clears text a person wrote. Blank is refused. */
+    readonly description?: string;
+    /**
+     * The selection, compared as a SET of pairs and ALWAYS compared: it is what a caller may reach, so an
+     * adopted toolset with more than declared is corrected. `[]` is an explicit empty selection (LiteLLM
+     * keeps an empty list only when it is sent as one). Required, so the declaration always says.
+     */
+    readonly tools: readonly ToolsetTool[];
+}
+export interface ToolsetAttributes {
+    readonly toolsetId: string;
+    readonly toolsetName: string;
+    readonly description: string | null;
+    /** Sorted by server, then tool, so two reads of one row are equal. */
+    readonly tools: readonly ToolsetTool[];
+}
+//# sourceMappingURL=toolset-types.d.ts.map

package/dist/litellm/toolset-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolset-types.d.ts","sourceRoot":"","sources":["../../src/litellm/toolset-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sGAAsG;IACtG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC"}

package/dist/litellm/toolset.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `LiteLLM.Toolset` — one row of LiteLLM's MCP toolset table (`/v1/mcp/toolset`): a named selection of
+ * `{ server_id, tool_name }` pairs a key or team can be granted instead of whole servers. Props and
+ * what is left out: toolset-types.ts.
+ *
+ * ★ ADOPT BY NAME. `toolset_name` is unique, so `toolsetName` finds the one live row (from the LIST,
+ *   which is the only by-name lookup the API has, and which cannot prove absence: toolset-operations.ts).
+ *   A live row with no state is `Unowned`, so it needs `--adopt`.
+ * ★ THE ID IS THE PROXY'S and is what state remembers; every later read is BY ID, from the table.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a toolset does not detach it: teams and keys that hold
+ *   its id keep a dangling grant, and every caller reaching MCP through it loses the tools.
+ * ⚠️ NO LICENCE GATE ON THESE ROUTES: `mcp_management_endpoints.py`'s toolset block has no
+ *   `premium_user` check (1.103.0), and docs.litellm.ai/docs/mcp_toolsets makes no Enterprise statement.
+ *   Writes need PROXY_ADMIN (403 otherwise).
+ * ⛔ NO LITELLM CREDENTIAL IS A PROP; `litellmProviders`' layer supplies `Credentials`.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { LitellmRegistryAbsentAfterWriteError, LitellmRegistryAmbiguousError, LitellmRegistryNotConvergedError, LitellmRegistryUnreadableError } from './registry-errors.ts';
+import type { ToolsetAttributes, ToolsetProps } from './toolset-types.ts';
+export type { ToolsetAttributes, ToolsetProps };
+export type { RegistryError as ToolsetError } from './registry-errors.ts';
+export interface LiteLLMToolset extends Resource<'LiteLLM.Toolset', ToolsetProps, ToolsetAttributes> {
+}
+export declare const LiteLLMToolset: import("alchemy").ResourceClass<LiteLLMToolset>;
+export declare const isLiteLLMToolset: (value: unknown) => value is LiteLLMToolset;
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel. */
+export declare const toolsetHandlers: {
+    /** ⛔ With no `output` this is the adoption probe, so the refusals run here too (registry-support.ts). */
+    read: ({ olds, output }: {
+        olds: ToolsetProps;
+        output: ToolsetAttributes | undefined;
+    }) => Effect.Effect<ToolsetAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/litellm/Errors").LitellmParseError | LitellmRegistryAmbiguousError | LitellmRegistryUnreadableError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | import("@distilled.cloud/litellm/mcp_management").UnprocessableEntity, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    diff: ({ news, output }: {
+        news: Input<ToolsetProps>;
+        output: ToolsetAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'noop';
+    } | {
+        readonly action: 'update';
+    } | undefined, import("./registry-errors.ts").LitellmRegistryInvalidError, never>;
+    reconcile: ({ news, output }: {
+        news: ToolsetProps;
+        output: ToolsetAttributes | undefined;
+    }) => Effect.Effect<ToolsetAttributes, LitellmRegistryAbsentAfterWriteError | LitellmRegistryAmbiguousError | import("./registry-errors.ts").LitellmRegistryInvalidError | LitellmRegistryNotConvergedError | LitellmRegistryUnreadableError | import("@distilled.cloud/litellm/mcp_management").EditMcpToolsetV1McpToolsetPutError, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    delete: ({ output }: {
+        output: ToolsetAttributes;
+    }) => Effect.Effect<void, import("@distilled.cloud/litellm/mcp_management").RemoveMcpToolsetV1McpToolsetToolsetIdDeleteError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+    /** ⛔ EMPTY: adoption is an explicit act (`--adopt`), and no ownership mark exists to filter by. */
+    list: () => Effect.Effect<never[], never, never>;
+};
+export declare const LiteLLMToolsetProvider: () => import("effect/Layer").Layer<Provider.Provider<LiteLLMToolset>, never, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+//# sourceMappingURL=toolset.d.ts.map

package/dist/litellm/toolset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolset.d.ts","sourceRoot":"","sources":["../../src/litellm/toolset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC/B,MAAM,sBAAsB,CAAC;AAU9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE1E,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AAChD,YAAY,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAI1E,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,KAAK,IAAI,cACe,CAAC;AAuB3E,oDAAoD;AACpD,eAAO,MAAM,eAAe;IAC1B,yGAAyG;IACzG,IAAI,qBAAqB;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAA;KAAE;IAUtF,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAA;KAAE;yBAM1E,MAAM;;yBACN,QAAQ;;IAG3B,SAAS,qBAAqB;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAA;KAAE;IAyC3F,MAAM,eAAe;QAAE,MAAM,EAAE,iBAAiB,CAAA;KAAE;IAElD,mGAAmG;IACnG,IAAI;CACL,CAAC;AAEF,eAAO,MAAM,sBAAsB,4IAC2D,CAAC"}

package/dist/openbao/index.js

@@ -429,6 +429,40 @@ var recordedInstance = (fqn, instanceId) => Effect5.gen(function* () {
   return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
 });
 var isCreate = (fqn, instanceId) => Effect5.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var idOf = (attr) => {
+  if (typeof attr !== "object" || attr === null)
+    return;
+  const id = attr.id;
+  return typeof id === "string" && id !== "" ? id : undefined;
+};
+var olderGenerationIds = (fqn, instanceId) => Effect5.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return [];
+  const ids = [];
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    collectOlder(yield* rowAt(found.store, found.where, at), instanceId, ids);
+  }
+  return ids;
+});
+var collectOlder = (row, instanceId, ids) => {
+  let at = row;
+  let seen = false;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (!seen) {
+      seen = generation.instanceId === instanceId;
+      at = generation.old;
+      continue;
+    }
+    if (generation.instanceId !== instanceId) {
+      const id = idOf(generation.attr);
+      if (id !== undefined)
+        ids.push(id);
+    }
+    at = generation.old;
+  }
+};
 var forgetRefusedCreate = (fqn, instanceId) => Effect5.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
@@ -3595,5 +3629,5 @@ export {
   revokeSelfEffect
 };
 
-//# debugId=6284E1A37FA458FA64756E2164756E21
+//# debugId=3866B2DE62460BDF64756E2164756E21
 //# sourceMappingURL=index.js.map