@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/litellm/index.js

@@ -308,25 +308,3101 @@ var budgetHandlers = {
   list: () => Effect4.succeed([])
 };
 var LiteLLMBudgetProvider = () => Provider2.effect(LiteLLMBudget, Effect4.succeed(LiteLLMBudget.Provider.of(budgetHandlers)));
+// src/litellm/credential.ts
+import { Resource as Resource3 } from "alchemy";
+import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved3 } from "alchemy/Diff";
+import * as Provider3 from "alchemy/Provider";
+import * as Effect12 from "effect/Effect";
+import * as Predicate4 from "effect/Predicate";
+
+// src/ownership/adopt.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack as Stack3 } from "alchemy/Stack";
+import * as Effect8 from "effect/Effect";
+import * as Option4 from "effect/Option";
+
+// src/ownership/resume.ts
+import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
+import { Artifacts } from "alchemy/Artifacts";
+import * as Effect5 from "effect/Effect";
+import * as Option from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect5.gen(function* () {
+  const bag = yield* Effect5.serviceOption(Artifacts);
+  if (Option.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect5.gen(function* () {
+  const bag = yield* Effect5.serviceOption(Artifacts);
+  if (Option.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect5.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect5.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect5.succeed(undefined);
+  const found = yield* recovered.pipe(Effect5.catch(unproven), Effect5.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned3.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect5.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
+
+// src/ownership/rows.ts
+import { Stack as Stack2 } from "alchemy/Stack";
+import { State, isActionState } from "alchemy/State/State";
+import * as Effect7 from "effect/Effect";
+import * as Option3 from "effect/Option";
+
+// src/ownership/whole.ts
+import { Stack } from "alchemy/Stack";
+import * as Effect6 from "effect/Effect";
+import * as Option2 from "effect/Option";
+var absent = (value) => value === undefined || value === null;
+var isPlainObject = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var carries = (declared, recorded) => {
+  if (absent(declared))
+    return true;
+  if (absent(recorded))
+    return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded))
+      return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject(declared)) {
+    if (!isPlainObject(recorded))
+      return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+var wholeDeclaration = (fqn, props) => Effect6.map(Effect6.serviceOption(Stack), (stack) => {
+  const declared = Option2.isSome(stack) ? stack.value.resources[fqn] : undefined;
+  return declared !== undefined && carries(declared.Props, props);
+});
+
+// src/ownership/rows.ts
+var storeOf = Effect7.gen(function* () {
+  const stack = yield* Effect7.serviceOption(Stack2);
+  const state = yield* Effect7.serviceOption(State);
+  if (Option3.isNone(stack) || Option3.isNone(state))
+    return;
+  const store = yield* state.value;
+  const where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect7.orElseSucceed(() => {
+  return;
+}));
+var generationOf = (row, instanceId) => {
+  let at = row;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (generation.instanceId === instanceId)
+      return generation;
+    at = generation.old;
+  }
+  return;
+};
+var recordedGeneration = (fqn, instanceId) => Effect7.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+    if (generation !== undefined)
+      return generation;
+  }
+  return;
+});
+var recordedInstance = (fqn, instanceId) => Effect7.gen(function* () {
+  const generation = yield* recordedGeneration(fqn, instanceId);
+  if (generation === undefined)
+    return "absent";
+  return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
+});
+var isCreate = (fqn, instanceId) => Effect7.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var idOf2 = (attr) => {
+  if (typeof attr !== "object" || attr === null)
+    return;
+  const id = attr.id;
+  return typeof id === "string" && id !== "" ? id : undefined;
+};
+var olderGenerationIds = (fqn, instanceId) => Effect7.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return [];
+  const ids = [];
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    collectOlder(yield* rowAt(found.store, found.where, at), instanceId, ids);
+  }
+  return ids;
+});
+var collectOlder = (row, instanceId, ids) => {
+  let at = row;
+  let seen = false;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (!seen) {
+      seen = generation.instanceId === instanceId;
+      at = generation.old;
+      continue;
+    }
+    if (generation.instanceId !== instanceId) {
+      const id = idOf2(generation.attr);
+      if (id !== undefined)
+        ids.push(id);
+    }
+    at = generation.old;
+  }
+};
+var forgetRefusedCreate = (fqn, instanceId) => Effect7.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  const row = yield* rowAt(found.store, found.where, fqn);
+  const mine = row;
+  if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
+    return;
+  }
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect7.ignore);
+});
+
+// src/ownership/adopt.ts
+var adoptEnabled = (fqn) => Effect8.gen(function* () {
+  const stack = yield* Effect8.serviceOption(Stack3);
+  const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped !== undefined)
+    return scoped;
+  const policy = yield* Effect8.serviceOption(AdoptPolicy);
+  if (Option4.isSome(policy))
+    return policy.value;
+  const context = yield* Effect8.serviceOption(AlchemyContext);
+  return Option4.isSome(context) ? context.value.adopt : false;
+});
+var adoptable = (owner) => Effect8.gen(function* () {
+  if (yield* isCreate(owner.fqn, owner.instanceId))
+    return true;
+  return yield* unfinished(owner.instanceId);
+});
+var adoptsAtApply = (owner) => Effect8.gen(function* () {
+  if (!(yield* adoptEnabled(owner.fqn)))
+    return false;
+  return yield* adoptable(owner);
+});
+var refuseTakeover = (owner, what) => Effect8.gen(function* () {
+  if (owner.output !== undefined)
+    return;
+  if (yield* resumes(owner.instanceId))
+    return;
+  const may = yield* adoptable(owner);
+  if (may && (yield* adoptEnabled(owner.fqn)))
+    return;
+  yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+  const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
+  return yield* Effect8.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+});
+var claimFor = (owner) => (what) => refuseTakeover(owner, what);
+
+// src/litellm/credential-errors.ts
+import * as Data3 from "effect/Data";
+
+class LitellmCredentialInvalidError extends Data3.TaggedError("LitellmCredentialInvalidError") {
+  get message() {
+    return `LiteLLM.Credential "${this.credentialName}": ${this.problem}.`;
+  }
+}
+
+class LitellmCredentialTransportError extends Data3.TaggedError("LitellmCredentialTransportError") {
+  get message() {
+    return `LiteLLM.Credential "${this.credentialName}": a /credentials write failed ` + `(${this.reason}) before an answer could be read, so the credential MAY have been written. ` + "This error keeps neither the request nor its cause: the request body holds the credential " + "values. Look the name up in LiteLLM. A row that landed is taken over by the next deploy " + "with --adopt; one that did not is created by it.";
+  }
+}
+
+class LitellmCredentialDebugLoggingError extends Data3.TaggedError("LitellmCredentialDebugLoggingError") {
+  get message() {
+    return `LiteLLM.Credential "${this.credentialName}": DISTILLED_DEBUG_HTTP is set, so the SDK ` + "would print the credential values to stderr in /credentials' request and response. Unset " + "it and run again. Nothing was written.";
+  }
+}
+
+class LitellmCredentialEnvUnsetError extends Data3.TaggedError("LitellmCredentialEnvUnsetError") {
+  get message() {
+    return `LiteLLM.Credential "${this.credentialName}": ` + `the deploying process does not set ${this.variables.join(", ")}.`;
+  }
+}
+
+class LitellmCredentialUnreadableError extends Data3.TaggedError("LitellmCredentialUnreadableError") {
+  get message() {
+    return `LiteLLM.Credential: a credentials read is unreadable (${this.reason}).`;
+  }
+}
+
+class LitellmCredentialAbsentAfterWriteError extends Data3.TaggedError("LitellmCredentialAbsentAfterWriteError") {
+  get message() {
+    return `LiteLLM.Credential "${this.credentialName}": the write returned no error but the ` + "credential is absent from the by-name read.";
+  }
+}
+
+class LitellmCredentialNotConvergedError extends Data3.TaggedError("LitellmCredentialNotConvergedError") {
+  get message() {
+    return `LiteLLM.Credential "${this.credentialName}": after the write it still differs from the ` + `declaration in ${this.fields.join(", ")}.`;
+  }
+}
+
+class LitellmCredentialRewriteError extends Data3.TaggedError("LitellmCredentialRewriteError") {
+  get message() {
+    return `LiteLLM.Credential "${this.credentialName}": DELETE already ran, but the replacement ` + `POST failed (${this.reason}). The next deploy recreates the row if absent; keep all ` + "declared credential variables set. If the POST landed despite the failure, the next " + "deploy reads and reconciles that row.";
+  }
+}
+
+// src/litellm/credential-form.ts
+import * as Redacted from "effect/Redacted";
+
+// src/litellm/credential-types.ts
+var isBlank = (value) => typeof value !== "string" || value.trim() === "";
+var SENSITIVE_KEY_FRAGMENTS = [
+  "authorization",
+  "token",
+  "key",
+  "secret",
+  "vertex_credentials",
+  "credentials",
+  "password",
+  "passwd"
+];
+var isSensitiveKey = (key) => {
+  const lower = key.toLowerCase();
+  return SENSITIVE_KEY_FRAGMENTS.some((fragment) => lower.includes(fragment));
+};
+
+// src/litellm/credential-form.ts
+var firstProblem = (props) => {
+  if (isBlank(props.credentialName) || props.credentialName !== props.credentialName.trim()) {
+    return "`credentialName` must be a non-empty string without leading or trailing whitespace";
+  }
+  if (props.credentialInfo !== undefined && (typeof props.credentialInfo !== "object" || props.credentialInfo === null)) {
+    return "`credentialInfo` must be an object of metadata";
+  }
+  if (props.credentialInfo !== undefined) {
+    for (const key of Object.keys(props.credentialInfo)) {
+      if (isSensitiveKey(key)) {
+        return `\`credentialInfo\` must not declare "${key}": LiteLLM returns \`credential_info\` ` + "unmasked, so declare it in `credentialValues`, which LiteLLM stores encrypted";
+      }
+    }
+  }
+  if (Object.keys(props.credentialValues).length === 0) {
+    return "`credentialValues` needs at least one entry: LiteLLM refuses a credential with neither " + "`credential_values` nor a model_id, and `model_id` is not modelled here";
+  }
+  for (const key of Object.keys(props.credentialValues)) {
+    if (isBlank(key) || key !== key.trim()) {
+      return "`credentialValues` keys must be non-empty strings without padding";
+    }
+    const entry = props.credentialValues[key];
+    if (typeof entry !== "object" || entry === null || isBlank(entry.fromEnv)) {
+      return `\`credentialValues["${key}"]\` takes \`{ fromEnv: 'NAME' }\`, never a value: the value would land in Alchemy's unencrypted state`;
+    }
+  }
+  return;
+};
+var differing2 = (live, props) => {
+  const out = [];
+  if (props.credentialInfo !== undefined) {
+    for (const [key, declared] of Object.entries(props.credentialInfo)) {
+      if (!isSensitiveKey(key) && !jsonEquals(live.credentialInfo[key], declared)) {
+        out.push(`credential_info.${key}`);
+      }
+    }
+  }
+  return out;
+};
+var jsonEquals = (left, right) => JSON.stringify(canonicalise(left)) === JSON.stringify(canonicalise(right));
+var canonicalise = (value2) => {
+  if (Array.isArray(value2))
+    return value2.map(canonicalise);
+  if (typeof value2 === "object" && value2 !== null) {
+    const out = {};
+    for (const key of Object.keys(value2).sort()) {
+      out[key] = canonicalise(value2[key]);
+    }
+    return out;
+  }
+  return value2;
+};
+var toAttributes3 = (row) => {
+  const info = row["credential_info"] ?? {};
+  const mirrored = {};
+  for (const [key, value2] of Object.entries(info)) {
+    if (!isSensitiveKey(key))
+      mirrored[key] = value2;
+  }
+  return {
+    credentialInfo: mirrored,
+    credentialName: String(row["credential_name"] ?? ""),
+    valueKeys: Object.keys(row["credential_values"] ?? {}).sort(),
+    infoKeys: Object.keys(info).sort(),
+    valuesSeal: ""
+  };
+};
+var isCredentialRow = (row) => typeof row === "object" && row !== null && typeof row["credential_name"] === "string";
+var literalValues = (resolved) => Object.fromEntries(Object.entries(resolved.values).map(([key, value2]) => [key, Redacted.value(value2)]));
+var createBody3 = (props, resolved) => {
+  const body = {
+    credential_info: { ...props.credentialInfo },
+    credential_name: props.credentialName,
+    credential_values: { ...literalValues(resolved) }
+  };
+  return body;
+};
+var patchBody = (props, values) => {
+  const body = {
+    credential_info: { ...props.credentialInfo },
+    credential_name: props.credentialName,
+    credential_name_body: props.credentialName
+  };
+  if (values !== undefined)
+    body.credential_values = { ...values };
+  return body;
+};
+var removedInfoKeys = (prior, props) => {
+  if (prior === undefined)
+    return [];
+  const declared = props.credentialInfo ?? {};
+  return (prior.infoKeys ?? Object.keys(prior.credentialInfo)).filter((key) => !Object.hasOwn(declared, key));
+};
+var removedValueKeys = (live, props) => (live?.valueKeys ?? []).filter((key) => !Object.hasOwn(props.credentialValues, key));
+
+// src/litellm/credential-operations.ts
+import * as credentials from "@distilled.cloud/litellm/credential_management";
+import * as Effect9 from "effect/Effect";
+import * as Predicate3 from "effect/Predicate";
+import { isHttpClientError } from "effect/unstable/http/HttpClientError";
+var readCredential = (credentialName) => throughFetch(credentials.getCredentialByNameCredentialsByNameCredentialNameGet({
+  credential_name: credentialName
+})).pipe(Effect9.catchTag("CredentialNotFound", () => Effect9.succeed(undefined)), Effect9.flatMap((response) => {
+  if (response === undefined)
+    return Effect9.succeed(undefined);
+  if (!isCredentialRow(response)) {
+    return Effect9.fail(new LitellmCredentialUnreadableError({
+      reason: "the by-name read did not answer a credential row"
+    }));
+  }
+  const answer = String(response["credential_name"]);
+  return answer === credentialName ? Effect9.succeed(toAttributes3(response)) : Effect9.fail(new LitellmCredentialUnreadableError({
+    reason: "the by-name read answered a different credential name"
+  }));
+}));
+var createCredential = (body) => {
+  const credentialName = body.credential_name ?? "";
+  return Effect9.gen(function* () {
+    yield* throughFetch(credentials.createCredentialCredentialsPost(body)).pipe(Effect9.asVoid, Effect9.catchTag("HttpClientError", (error) => Effect9.fail(new LitellmCredentialTransportError({ credentialName, reason: error.reason._tag }))), Effect9.catchDefect((defect) => carriesRequest(defect) ? Effect9.fail(new LitellmCredentialTransportError({
+      credentialName,
+      reason: isHttpClientError(defect) ? defect.reason._tag : "Defect"
+    })) : Effect9.die(defect)));
+  });
+};
+var updateCredential = (body) => {
+  const credentialName = body.credential_name ?? "";
+  return Effect9.gen(function* () {
+    yield* throughFetch(credentials.updateCredentialCredentialsCredentialNamePatch(body)).pipe(Effect9.asVoid, Effect9.catchTag("HttpClientError", (error) => Effect9.fail(new LitellmCredentialTransportError({ credentialName, reason: error.reason._tag }))), Effect9.catchDefect((defect) => carriesRequest(defect) ? Effect9.fail(new LitellmCredentialTransportError({
+      credentialName,
+      reason: isHttpClientError(defect) ? defect.reason._tag : "Defect"
+    })) : Effect9.die(defect)));
+  });
+};
+var deleteCredential = (credentialName) => throughFetch(credentials.deleteCredentialCredentialsCredentialNameDelete({
+  credential_name: credentialName
+})).pipe(Effect9.asVoid, Effect9.catchTag("CredentialNotFound", () => Effect9.void));
+var refuseDebugLogging = (credentialName) => (globalThis.process?.env?.["DISTILLED_DEBUG_HTTP"] ?? "") !== "" ? Effect9.fail(new LitellmCredentialDebugLoggingError({ credentialName })) : Effect9.void;
+var carriesRequest = (value2) => isHttpClientError(value2) || Predicate3.hasProperty(value2, "request");
+
+// src/litellm/credential-rewrite.ts
+import * as Effect10 from "effect/Effect";
+var rewriteCredential = (body) => Effect10.gen(function* () {
+  const credentialName = body.credential_name;
+  yield* deleteCredential(credentialName);
+  const post = createCredential(body);
+  yield* post.pipe(Effect10.catchTag([
+    "BadGateway",
+    "BadRequest",
+    "ConfigError",
+    "Conflict",
+    "Forbidden",
+    "GatewayTimeout",
+    "HttpClientError",
+    "InternalServerError",
+    "LitellmCredentialTransportError",
+    "LitellmParseError",
+    "Locked",
+    "NotFound",
+    "ServiceUnavailable",
+    "TooManyRequests",
+    "Unauthorized",
+    "UnknownLitellmError",
+    "UnprocessableEntity"
+  ], (error) => Effect10.fail(new LitellmCredentialRewriteError({ credentialName, reason: error._tag }))));
+});
+
+// src/litellm/credential-values.ts
+import * as Effect11 from "effect/Effect";
+import * as Redacted2 from "effect/Redacted";
+
+// src/secrets/write-only.ts
+import { Buffer } from "node:buffer";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+var resolveAll = (refs, env = process.env) => {
+  const values = {};
+  const missing = [];
+  for (const [key, ref] of Object.entries(refs)) {
+    const value2 = env[ref.fromEnv];
+    if (value2 === undefined || value2 === "")
+      missing.push(ref.fromEnv);
+    else
+      values[key] = value2;
+  }
+  return { missing: [...new Set(missing)].sort(), values };
+};
+var COST = { N: 16384, maxmem: 64 * 1024 * 1024, p: 1, r: 8 };
+var PREFIX = "scrypt";
+var canonical = (values) => JSON.stringify(Object.keys(values).sort().map((key) => [key, values[key]]));
+var digest = (salt, values) => scryptSync(canonical(values), salt, 32, COST);
+var seal = (values, salt) => {
+  if (Object.keys(values).length === 0)
+    return "";
+  const bytes = salt === undefined ? randomBytes(16) : Buffer.from(salt, "utf8");
+  return `${PREFIX}:${bytes.toString("base64url")}:${digest(bytes, values).toString("base64url")}`;
+};
+var sealMatches = (sealed, values) => {
+  if (sealed === "")
+    return Object.keys(values).length === 0;
+  const [prefix, salt, stored, extra] = sealed.split(":");
+  if (prefix !== PREFIX || salt === undefined || stored === undefined || extra !== undefined) {
+    return false;
+  }
+  const expected = Buffer.from(stored, "base64url");
+  const actual = digest(Buffer.from(salt, "base64url"), values);
+  return expected.length === actual.length && timingSafeEqual(expected, actual);
+};
+
+// src/litellm/credential-values.ts
+var resolveValues = (props, env = process.env) => {
+  const { values, missing } = resolveAll(props.credentialValues, env);
+  return {
+    missing,
+    values: Object.fromEntries(Object.entries(values).map(([key, value3]) => [key, Redacted2.make(value3)]))
+  };
+};
+var sealable = (values) => Object.fromEntries(Object.entries(values).map(([key, value3]) => [key, Redacted2.value(value3)]));
+var sealValues = (values) => seal(sealable(values));
+var valuesState = (props, sealed, resolved = resolveValues(props)) => {
+  const declared = Object.keys(props.credentialValues);
+  if (declared.length === 0)
+    return "none";
+  if (resolved.missing.length > 0)
+    return "unknown";
+  if (sealed === "")
+    return "stale";
+  return sealMatches(sealed, sealable(resolved.values)) ? "match" : "stale";
+};
+var requireValues = (props, resolved) => resolved.missing.length === 0 ? Effect11.void : Effect11.fail(new LitellmCredentialEnvUnsetError({
+  credentialName: props.credentialName,
+  variables: resolved.missing
+}));
+
+// src/litellm/credential.ts
+var LiteLLMCredential = Resource3("LiteLLM.Credential", {
+  defaultRemovalPolicy: "retain"
+});
+var isLiteLLMCredential = (value3) => Predicate4.hasProperty(value3, "Type") && value3.Type === "LiteLLM.Credential";
+var refuse = (props) => {
+  const problem = firstProblem(props);
+  return problem === undefined ? Effect12.void : Effect12.fail(new LitellmCredentialInvalidError({
+    problem,
+    credentialName: String(props.credentialName)
+  }));
+};
+var credentialHandlers = {
+  read: ({ olds, output }) => Effect12.gen(function* () {
+    yield* refuseDebugLogging(olds.credentialName);
+    const problem = output === undefined ? firstProblem(olds) : undefined;
+    if (problem !== undefined) {
+      return yield* Effect12.die(new LitellmCredentialInvalidError({
+        problem,
+        credentialName: String(olds.credentialName)
+      }));
+    }
+    const found = yield* readCredential(olds.credentialName);
+    if (found === undefined)
+      return;
+    return output === undefined ? Unowned4(found) : { ...found, valuesSeal: output.valuesSeal };
+  }),
+  diff: ({
+    news,
+    output
+  }) => Effect12.gen(function* () {
+    if (!isResolved3(news))
+      return;
+    yield* refuse(news);
+    if (output === undefined)
+      return;
+    if (news.credentialName !== output.credentialName) {
+      return { action: "replace", deleteFirst: false };
+    }
+    const state = valuesState(news, output.valuesSeal);
+    const removed = [...removedInfoKeys(output, news), ...removedValueKeys(output, news)];
+    return differing2(output, news).length === 0 && removed.length === 0 && state !== "stale" ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({ fqn, instanceId, news, output }) => Effect12.gen(function* () {
+    yield* refuse(news);
+    yield* refuseDebugLogging(news.credentialName);
+    const resolved = resolveValues(news);
+    const before = yield* readCredential(news.credentialName);
+    let sealed = output?.valuesSeal ?? "";
+    if (before === undefined) {
+      yield* requireValues(news, resolved);
+      yield* createCredential(createBody3(news, resolved));
+      sealed = sealValues(resolved.values);
+    } else {
+      yield* refuseTakeover({ fqn, instanceId, output }, `LiteLLM.Credential ${news.credentialName}`);
+      const removed = [...removedInfoKeys(before, news), ...removedValueKeys(before, news)];
+      const infoDrift = differing2(before, news).length > 0;
+      const valuesStale = valuesState(news, sealed) === "stale";
+      if (removed.length > 0) {
+        yield* requireValues(news, resolved);
+        yield* rewriteCredential(createBody3(news, resolved));
+        sealed = sealValues(resolved.values);
+      } else if (infoDrift || valuesStale) {
+        if (valuesStale)
+          yield* requireValues(news, resolved);
+        yield* updateCredential(patchBody(news, valuesStale ? literalValues(resolved) : undefined));
+        if (valuesStale)
+          sealed = sealValues(resolved.values);
+      }
+    }
+    const after = yield* readCredential(news.credentialName);
+    if (after === undefined) {
+      return yield* Effect12.fail(new LitellmCredentialAbsentAfterWriteError({ credentialName: news.credentialName }));
+    }
+    const left = [
+      ...differing2(after, news),
+      ...removedInfoKeys(after, news).map((key) => `credential_info.${key}`),
+      ...removedValueKeys(after, news).map((key) => `credential_values.${key}`)
+    ];
+    if (left.length > 0) {
+      return yield* Effect12.fail(new LitellmCredentialNotConvergedError({
+        fields: left,
+        credentialName: news.credentialName
+      }));
+    }
+    return { ...after, valuesSeal: sealed };
+  }),
+  delete: ({ output }) => deleteCredential(output.credentialName),
+  list: () => Effect12.succeed([])
+};
+var LiteLLMCredentialProvider = () => Provider3.effect(LiteLLMCredential, Effect12.succeed(LiteLLMCredential.Provider.of(credentialHandlers)));
+// src/litellm/mcp-server.ts
+import { Resource as Resource4 } from "alchemy";
+import { Unowned as Unowned5 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Provider4 from "alchemy/Provider";
+import * as Effect17 from "effect/Effect";
+import * as Predicate5 from "effect/Predicate";
+
+// src/litellm/mcp-server-errors.ts
+import * as Data4 from "effect/Data";
+
+class LitellmMcpServerInvalidError extends Data4.TaggedError("LitellmMcpServerInvalidError") {
+  get message() {
+    return `LiteLLM.MCPServer "${this.serverName}": ${this.problem}.`;
+  }
+}
+
+class LitellmMcpServerCredentialEnvUnsetError extends Data4.TaggedError("LitellmMcpServerCredentialEnvUnsetError") {
+  get message() {
+    return `LiteLLM.MCPServer "${this.serverName}": this write must send its credential, and ` + `${this.variable} is unset or empty in the deploying environment. Export it and deploy again.`;
+  }
+}
+
+class LitellmMcpServerAmbiguousNameError extends Data4.TaggedError("LitellmMcpServerAmbiguousNameError") {
+  get message() {
+    return `LiteLLM.MCPServer "${this.serverName}": ${this.serverIds.length} live rows carry that ` + `server_name (${this.serverIds.join(", ")}). Declare \`serverId\` to choose one.`;
+  }
+}
+
+class LitellmMcpServerUnreadableError extends Data4.TaggedError("LitellmMcpServerUnreadableError") {
+  get message() {
+    return `LiteLLM.MCPServer: the server list is unreadable (${this.reason}).`;
+  }
+}
+
+class LitellmMcpServerAbsentAfterWriteError extends Data4.TaggedError("LitellmMcpServerAbsentAfterWriteError") {
+  get message() {
+    return `LiteLLM.MCPServer "${this.serverName}": the write of ${this.serverId} returned no error ` + "but the row is absent from the list and from the database read.";
+  }
+}
+
+class LitellmMcpServerNotConvergedError extends Data4.TaggedError("LitellmMcpServerNotConvergedError") {
+  get message() {
+    return `LiteLLM.MCPServer "${this.serverName}": after the write, ${this.serverId} still differs ` + `from the declaration in ${this.fields.join(", ")}.`;
+  }
+}
+
+class LitellmMcpServerDescriptionShadowedError extends Data4.TaggedError("LitellmMcpServerDescriptionShadowedError") {
+  get message() {
+    return `LiteLLM.MCPServer "${this.serverName}": ${this.serverId} has a \`description\` in \`mcp_info\`, ` + "which LiteLLM shows instead of the column this resource writes, and it differs from the " + "declaration. Edit it in LiteLLM, or remove `description` from the declaration.";
+  }
+}
+
+// src/litellm/mcp-server-credential.ts
+import * as Effect13 from "effect/Effect";
+import * as Redacted3 from "effect/Redacted";
+
+// src/litellm/mcp-server-types.ts
+var isBlank2 = (value3) => typeof value3 !== "string" || value3.trim() === "";
+var STATIC = new Set([
+  "api_key",
+  "bearer_token",
+  "basic",
+  "authorization",
+  "token"
+]);
+var isStaticAuthType = (authType) => STATIC.has(authType);
+var AUTH_TYPES = [
+  "none",
+  "oauth2",
+  "api_key",
+  "bearer_token",
+  "basic",
+  "authorization",
+  "token"
+];
+var TRANSPORTS = ["sse", "http"];
+
+// src/litellm/mcp-server-credential.ts
+var resolveCredential = (props, env = process.env) => {
+  if (props.authValue === undefined)
+    return { value: undefined, variable: undefined };
+  const { values } = resolveAll({ authValue: props.authValue }, env);
+  const raw = values["authValue"];
+  return {
+    value: raw === undefined ? undefined : Redacted3.make(raw),
+    variable: props.authValue.fromEnv
+  };
+};
+var sealable2 = (value4) => ({ authValue: Redacted3.value(value4) });
+var sealCredential = (value4) => seal(sealable2(value4));
+var credentialState = (props, sealed, resolved = resolveCredential(props)) => {
+  if (props.authValue === undefined || !isStaticAuthType(props.authType))
+    return "none";
+  if (resolved.value === undefined)
+    return "unknown";
+  if (sealed === "")
+    return "stale";
+  return sealMatches(sealed, sealable2(resolved.value)) ? "match" : "stale";
+};
+var requireCredential = (props, credential) => isStaticAuthType(props.authType) && credential.value === undefined ? Effect13.fail(new LitellmMcpServerCredentialEnvUnsetError({
+  serverName: props.serverName,
+  variable: credential.variable ?? "(undeclared)"
+})) : Effect13.void;
+
+// src/litellm/mcp-server-form.ts
+import * as Redacted4 from "effect/Redacted";
+
+// src/litellm/mcp-server-url.ts
+var SECRET_PARAM = /token|secret|passw|api.?key|auth|credential|signature|^key$|^sig$/i;
+var urlProblem = (raw) => {
+  if (isBlank2(raw))
+    return "`url` must be a non-empty string";
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return "`url` must be a full http(s) URL including the scheme";
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:")
+    return "`url` must be http or https";
+  if (url.username !== "" || url.password !== "") {
+    return "`url` must not carry userinfo; declare the credential as `authValue`";
+  }
+  if (url.hash !== "")
+    return "`url` must not carry a fragment";
+  for (const name of url.searchParams.keys()) {
+    if (SECRET_PARAM.test(name)) {
+      return `\`url\` carries the query parameter "${name}", which looks like a credential; declare it as \`authValue\` instead, because the URL is stored in Alchemy's state`;
+    }
+  }
+  return;
+};
+var redactUrl = (raw) => {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return raw;
+  }
+  let changed = false;
+  if (url.username !== "") {
+    url.username = "REDACTED";
+    changed = true;
+  }
+  if (url.password !== "") {
+    url.password = "REDACTED";
+    changed = true;
+  }
+  for (const name of new Set(url.searchParams.keys())) {
+    if (!SECRET_PARAM.test(name))
+      continue;
+    url.searchParams.set(name, "REDACTED");
+    changed = true;
+  }
+  return changed ? url.toString() : raw;
+};
+
+// src/litellm/mcp-server-form.ts
+var listProblem = (name, list) => list !== undefined && list.some((entry) => isBlank2(entry)) ? `\`${name}\` must hold non-empty strings` : undefined;
+var TOOL_NAME = /^[A-Za-z0-9._]{1,128}$/;
+var toolNameProblem = (field, value5) => TOOL_NAME.test(value5) ? undefined : `\`${field}\` must match ^[A-Za-z0-9._]{1,128}$: LiteLLM 1.103 rejects a space, "/", ":", "@", "-" or more than 128 characters only at apply`;
+var aliasProblem = (alias) => {
+  if (alias === undefined)
+    return;
+  if (isBlank2(alias))
+    return "`alias` must be a non-empty string when declared";
+  return toolNameProblem("alias", alias);
+};
+var firstProblem2 = (props) => {
+  if (isBlank2(props.serverName) || props.serverName !== props.serverName.trim()) {
+    return "`serverName` must be a non-empty string without leading or trailing whitespace";
+  }
+  const named = toolNameProblem("serverName", props.serverName) ?? aliasProblem(props.alias);
+  if (named !== undefined)
+    return named;
+  if (props.description !== undefined && isBlank2(props.description)) {
+    return "`description` must be a non-empty string when declared: LiteLLM copies it into mcp_info only when it is truthy, so a blank one never converges";
+  }
+  if (props.serverId !== undefined && isBlank2(props.serverId)) {
+    return "`serverId` must be a non-empty string when declared";
+  }
+  const url = urlProblem(props.url);
+  if (url !== undefined)
+    return url;
+  if (!TRANSPORTS.includes(props.transport)) {
+    return '`transport` must be "sse" or "http" (`stdio` runs a command on the proxy host and is not modelled)';
+  }
+  if (!AUTH_TYPES.includes(props.authType)) {
+    return `\`authType\` must be one of ${AUTH_TYPES.join(", ")}; the others need credential fields this resource does not model`;
+  }
+  const declared = props.authValue !== undefined;
+  if (isStaticAuthType(props.authType) && !declared) {
+    return `\`authType: "${props.authType}"\` needs \`authValue: { fromEnv: … }\``;
+  }
+  if (!isStaticAuthType(props.authType) && declared) {
+    return `\`authValue\` is the static credential for api_key, bearer_token, basic, authorization and token; this server is "${props.authType}"`;
+  }
+  if (declared && isBlank2(props.authValue?.fromEnv)) {
+    return "`authValue.fromEnv` must name an environment variable";
+  }
+  return listProblem("allowedTools", props.allowedTools) ?? listProblem("mcpAccessGroups", props.mcpAccessGroups);
+};
+var toAttributes4 = (row) => ({
+  alias: row.alias ?? null,
+  allowAllKeys: row.allow_all_keys ?? false,
+  allowedTools: [...row.allowed_tools ?? []],
+  authType: row.auth_type ?? "none",
+  credentialSeal: "",
+  description: row.description ?? null,
+  mcpAccessGroups: [...row.mcp_access_groups ?? []],
+  serverId: row.server_id,
+  serverName: row.server_name ?? null,
+  transport: row.transport,
+  url: row.url === undefined || row.url === null ? null : redactUrl(row.url)
+});
+var sameSet = (live, declared) => new Set(live).size === new Set(declared).size && declared.every((entry) => live.includes(entry));
+var differing3 = (live, props) => {
+  const out = [];
+  if (live.serverName !== props.serverName)
+    out.push("server_name");
+  if (live.url !== props.url)
+    out.push("url");
+  if (live.transport !== props.transport)
+    out.push("transport");
+  if (live.authType !== props.authType)
+    out.push("auth_type");
+  if (live.allowAllKeys !== (props.allowAllKeys ?? false))
+    out.push("allow_all_keys");
+  if (props.allowedTools !== undefined && !sameSet(live.allowedTools, props.allowedTools)) {
+    out.push("allowed_tools");
+  }
+  if (!sameSet(live.mcpAccessGroups, props.mcpAccessGroups ?? []))
+    out.push("mcp_access_groups");
+  if (props.alias !== undefined && live.alias !== props.alias)
+    out.push("alias");
+  if (props.description !== undefined && live.description !== props.description) {
+    out.push("description");
+  }
+  return out;
+};
+var managed = (props) => ({
+  allow_all_keys: props.allowAllKeys ?? false,
+  ...props.allowedTools === undefined ? {} : { allowed_tools: [...props.allowedTools] },
+  auth_type: props.authType,
+  ...props.description === undefined ? {} : { description: props.description },
+  mcp_access_groups: [...props.mcpAccessGroups ?? []],
+  transport: props.transport,
+  url: props.url
+});
+var identityOnCreate = (props) => ({
+  ...props.alias === undefined ? {} : { alias: props.alias },
+  server_name: props.serverName
+});
+var identityOnUpdate = (props, live) => {
+  const renamed = live.serverName !== props.serverName;
+  const alias = props.alias ?? (renamed && live.alias !== null ? live.alias : undefined);
+  return {
+    ...alias === undefined ? {} : { alias },
+    ...renamed ? { server_name: props.serverName } : {}
+  };
+};
+var credentialsOf = (credential) => credential === undefined ? {} : { credentials: { auth_value: Redacted4.value(credential) } };
+var createBody4 = (props, serverId, credential) => ({
+  ...managed(props),
+  ...identityOnCreate(props),
+  ...credentialsOf(credential),
+  server_id: serverId
+});
+var updateBody3 = (props, serverId, credential, clearCredentials, live) => ({
+  ...managed(props),
+  ...identityOnUpdate(props, live),
+  ...clearCredentials ? { credentials: null } : credentialsOf(credential),
+  server_id: serverId
+});
+
+// src/litellm/mcp-server-locate.ts
+import { createPhysicalName as createPhysicalName3 } from "alchemy/PhysicalName";
+import * as Effect15 from "effect/Effect";
+
+// src/litellm/mcp-server-operations.ts
+import * as mcp from "@distilled.cloud/litellm/mcp_management";
+import { NotFound } from "@distilled.cloud/litellm/Errors";
+import * as Effect14 from "effect/Effect";
+var hasServerId = (row) => typeof row === "object" && row !== null && typeof row.server_id === "string";
+var listMcpServers = () => throughFetch(mcp.fetchAllMcpServersV1McpServerGet({})).pipe(Effect14.flatMap((response) => {
+  const rows = Array.isArray(response) ? response : response.body;
+  return Array.isArray(rows) && rows.every(hasServerId) ? Effect14.succeed(rows) : Effect14.fail(new LitellmMcpServerUnreadableError({
+    reason: Array.isArray(rows) ? "a row has no server_id" : "not an array"
+  }));
+}));
+var readMcpServer = (serverId) => throughFetch(mcp.fetchMcpServerV1McpServerServerIdGet({ server_id: serverId })).pipe(Effect14.map((row) => row.server_id === serverId ? row : undefined), Effect14.catch((error) => error instanceof NotFound ? Effect14.succeed(undefined) : Effect14.fail(error)));
+var createMcpServer = (body) => throughFetch(mcp.addMcpServerV1McpServerPost(body));
+var updateMcpServer = (body) => throughFetch(mcp.editMcpServerV1McpServerPut(body)).pipe(Effect14.asVoid);
+var deleteMcpServer = (serverId) => throughFetch(mcp.removeMcpServerV1McpServerServerIdDelete({ server_id: serverId })).pipe(Effect14.asVoid, Effect14.catch((original) => readMcpServer(serverId).pipe(Effect14.catch(() => Effect14.fail(original)), Effect14.flatMap((row) => row === undefined ? Effect14.void : Effect14.fail(original)))));
+
+// src/litellm/mcp-server-locate.ts
+var locate2 = (rows, props, output) => {
+  const pinned = output?.serverId ?? props.serverId;
+  if (pinned !== undefined)
+    return Effect15.succeed(rows.find((row) => row.server_id === pinned));
+  const named = rows.filter((row) => row.server_name === props.serverName);
+  return named.length > 1 ? Effect15.fail(new LitellmMcpServerAmbiguousNameError({
+    serverIds: named.map((row) => row.server_id),
+    serverName: props.serverName
+  })) : Effect15.succeed(named[0]);
+};
+var wantedId = (id, instanceId, props, output) => output?.serverId !== undefined ? Effect15.succeed(output.serverId) : props.serverId !== undefined ? Effect15.succeed(props.serverId) : createPhysicalName3({ id, instanceId, lowercase: true, maxLength: 64 });
+var findLive = (id, instanceId, props, output) => Effect15.gen(function* () {
+  const listed = yield* locate2(yield* listMcpServers(), props, output);
+  if (listed !== undefined)
+    return listed;
+  return yield* readMcpServer(yield* wantedId(id, instanceId, props, output));
+});
+
+// src/litellm/mcp-server-shadow.ts
+import * as Effect16 from "effect/Effect";
+var refuseShadowedDescription = (props, serverId) => props.description === undefined ? Effect16.void : readMcpServer(serverId).pipe(Effect16.flatMap((row) => {
+  const info = row?.mcp_info;
+  const shadowed = info !== undefined && info !== null && "description" in info && info["description"] !== props.description;
+  return shadowed ? Effect16.fail(new LitellmMcpServerDescriptionShadowedError({
+    serverId,
+    serverName: props.serverName
+  })) : Effect16.void;
+}));
+
+// src/litellm/mcp-server.ts
+var LiteLLMMCPServer = Resource4("LiteLLM.MCPServer", {
+  defaultRemovalPolicy: "retain"
+});
+var isLiteLLMMCPServer = (value5) => Predicate5.hasProperty(value5, "Type") && value5.Type === "LiteLLM.MCPServer";
+var refuse2 = (props) => {
+  const problem = firstProblem2(props);
+  return problem === undefined ? Effect17.void : Effect17.fail(new LitellmMcpServerInvalidError({ problem, serverName: String(props.serverName) }));
+};
+var mcpServerHandlers = {
+  read: ({ id, instanceId, olds, output }) => Effect17.gen(function* () {
+    const problem = output === undefined ? firstProblem2(olds) : undefined;
+    if (problem !== undefined) {
+      return yield* Effect17.die(new LitellmMcpServerInvalidError({ problem, serverName: String(olds.serverName) }));
+    }
+    const found = yield* findLive(id, instanceId, olds, output);
+    if (found === undefined)
+      return;
+    const live = toAttributes4(found);
+    return output === undefined ? Unowned5(live) : { ...live, credentialSeal: output.credentialSeal };
+  }),
+  diff: ({
+    news,
+    output
+  }) => Effect17.gen(function* () {
+    if (!isResolved4(news))
+      return;
+    yield* refuse2(news);
+    if (output === undefined)
+      return;
+    if (news.serverId !== undefined && news.serverId !== output.serverId) {
+      return { action: "replace", deleteFirst: false };
+    }
+    return differing3(output, news).length === 0 && credentialState(news, output.credentialSeal) !== "stale" ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({ id, instanceId, news, output }) => Effect17.gen(function* () {
+    yield* refuse2(news);
+    const before = yield* findLive(id, instanceId, news, output);
+    const credential = resolveCredential(news);
+    let sealed = output?.credentialSeal ?? "";
+    let serverId;
+    if (before === undefined) {
+      yield* requireCredential(news, credential);
+      const wanted = yield* wantedId(id, instanceId, news, output);
+      const created = yield* createMcpServer(createBody4(news, wanted, credential.value));
+      serverId = typeof created?.server_id === "string" ? created.server_id : wanted;
+      sealed = credential.value === undefined ? "" : sealCredential(credential.value);
+    } else {
+      serverId = before.server_id;
+      const live = toAttributes4(before);
+      const state = credentialState(news, sealed, credential);
+      if (differing3(live, news).length > 0 || state === "stale") {
+        if (live.authType !== news.authType)
+          yield* requireCredential(news, credential);
+        if (differing3(live, news).includes("description")) {
+          yield* refuseShadowedDescription(news, serverId);
+        }
+        const send = isStaticAuthType(news.authType) ? credential.value : undefined;
+        const leavingStatic = !isStaticAuthType(news.authType) && (sealed !== "" || isStaticAuthType(live.authType));
+        yield* updateMcpServer(updateBody3(news, serverId, send, leavingStatic, live));
+        if (send !== undefined)
+          sealed = sealCredential(send);
+        else if (leavingStatic)
+          sealed = "";
+      }
+    }
+    const found = (yield* listMcpServers()).find((row) => row.server_id === serverId) ?? (yield* readMcpServer(serverId));
+    if (found === undefined) {
+      return yield* Effect17.fail(new LitellmMcpServerAbsentAfterWriteError({ serverId, serverName: news.serverName }));
+    }
+    const after = toAttributes4(found);
+    const left = differing3(after, news);
+    if (left.length > 0) {
+      return yield* Effect17.fail(new LitellmMcpServerNotConvergedError({
+        fields: left,
+        serverId,
+        serverName: news.serverName
+      }));
+    }
+    return { ...after, credentialSeal: sealed };
+  }),
+  delete: ({ output }) => deleteMcpServer(output.serverId),
+  list: () => Effect17.succeed([])
+};
+var LiteLLMMCPServerProvider = () => Provider4.effect(LiteLLMMCPServer, Effect17.succeed(LiteLLMMCPServer.Provider.of(mcpServerHandlers)));
+// src/litellm/access-group.ts
+import { Resource as Resource5 } from "alchemy";
+import { Unowned as Unowned6 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved5 } from "alchemy/Diff";
+import * as Provider5 from "alchemy/Provider";
+import * as Effect20 from "effect/Effect";
+import * as Predicate6 from "effect/Predicate";
+
+// src/litellm/registry-support.ts
+import { NotFound as NotFound2 } from "@distilled.cloud/litellm/Errors";
+import * as Effect18 from "effect/Effect";
+
+// src/litellm/registry-errors.ts
+import * as Data5 from "effect/Data";
+
+class LitellmRegistryInvalidError extends Data5.TaggedError("LitellmRegistryInvalidError") {
+  get message() {
+    return `${this.resource} "${this.name}": ${this.problem}.`;
+  }
+}
+
+class LitellmRegistryUnreadableError extends Data5.TaggedError("LitellmRegistryUnreadableError") {
+  get message() {
+    return `${this.resource}: the proxy's answer is unreadable (${this.reason}).`;
+  }
+}
+
+class LitellmRegistryAmbiguousError extends Data5.TaggedError("LitellmRegistryAmbiguousError") {
+  get message() {
+    return `${this.resource} "${this.name}": ${this.ids.length} live rows match (${this.ids.join(", ")}). ` + "Declare the id to choose one.";
+  }
+}
+
+class LitellmRegistryAbsentAfterWriteError extends Data5.TaggedError("LitellmRegistryAbsentAfterWriteError") {
+  get message() {
+    return `${this.resource} "${this.name}": the write returned no error but the row is absent on the read back.`;
+  }
+}
+
+class LitellmRegistryNotConvergedError extends Data5.TaggedError("LitellmRegistryNotConvergedError") {
+  get message() {
+    return `${this.resource} "${this.name}": after the write, the row still differs in ${this.fields.join(", ")}.`;
+  }
+}
+
+// src/litellm/registry-support.ts
+var isNotFound = (error) => error instanceof NotFound2;
+var bodyOf = (response) => typeof response === "object" && response !== null && !Array.isArray(response) && ("body" in response) ? response.body : response;
+var asRow = (value5) => typeof value5 === "object" && value5 !== null && !Array.isArray(value5) ? value5 : undefined;
+var stringsOf = (value5) => Array.isArray(value5) ? value5.filter((each) => typeof each === "string") : [];
+var stringOrNull = (value5) => typeof value5 === "string" ? value5 : null;
+var numberOrNull2 = (value5) => {
+  if (value5 === null || value5 === undefined || value5 === "")
+    return null;
+  const parsed = typeof value5 === "number" ? value5 : Number(value5);
+  return Number.isFinite(parsed) ? parsed : null;
+};
+var canonical2 = (values) => [...new Set(values)].sort();
+var sameSet2 = (left, right) => {
+  const a = canonical2(left);
+  const b = canonical2(right);
+  return a.length === b.length && a.every((each, index) => each === b[index]);
+};
+var isBlank3 = (value5) => typeof value5 !== "string" || value5.trim() === "";
+var firstBadEntry = (values) => {
+  for (const each of values) {
+    if (isBlank3(each) || each !== each.trim())
+      return String(each);
+  }
+  return;
+};
+var firstDuplicate = (values) => values.find((each, index) => values.indexOf(each) !== index);
+var failIfInvalid = (resource, name, problem) => problem === undefined ? Effect18.void : Effect18.fail(new LitellmRegistryInvalidError({ name, problem, resource }));
+var dieIfInvalid = (resource, name, problem) => problem === undefined ? Effect18.void : Effect18.die(new LitellmRegistryInvalidError({ name, problem, resource }));
+
+// src/litellm/access-group-form.ts
+var firstProblem3 = (props) => {
+  if (isBlank3(props.accessGroupName) || props.accessGroupName !== props.accessGroupName.trim()) {
+    return "`accessGroupName` must be a non-blank name with no leading or trailing space";
+  }
+  if (props.description !== undefined && isBlank3(props.description)) {
+    return "`description` is blank; leave it out to keep the live text";
+  }
+  for (const [field, values] of [
+    ["modelNames", props.modelNames ?? []],
+    ["mcpServerIds", props.mcpServerIds ?? []]
+  ]) {
+    const bad = firstBadEntry(values);
+    if (bad !== undefined)
+      return `\`${field}\` has a blank or padded entry (${JSON.stringify(bad)})`;
+    const twice = firstDuplicate(values);
+    if (twice !== undefined)
+      return `\`${field}\` lists ${JSON.stringify(twice)} twice`;
+  }
+  return;
+};
+var toAttributes5 = (value5) => {
+  const row = asRow(value5);
+  if (row === undefined)
+    return;
+  const accessGroupId = row["access_group_id"];
+  const accessGroupName = row["access_group_name"];
+  if (typeof accessGroupId !== "string" || typeof accessGroupName !== "string")
+    return;
+  return {
+    accessGroupId,
+    accessGroupName,
+    description: stringOrNull(row["description"]),
+    mcpServerIds: canonical2(stringsOf(row["access_mcp_server_ids"])),
+    modelNames: canonical2(stringsOf(row["access_model_names"]))
+  };
+};
+var differing4 = (live, props) => {
+  const fields = [];
+  if (live.accessGroupName !== props.accessGroupName)
+    fields.push("access_group_name");
+  if (props.description !== undefined && live.description !== props.description) {
+    fields.push("description");
+  }
+  if (!sameSet2(live.modelNames, props.modelNames ?? []))
+    fields.push("access_model_names");
+  if (!sameSet2(live.mcpServerIds, props.mcpServerIds ?? []))
+    fields.push("access_mcp_server_ids");
+  return fields;
+};
+var createBody5 = (props) => ({
+  access_group_name: props.accessGroupName,
+  access_mcp_server_ids: [...props.mcpServerIds ?? []],
+  access_model_names: [...props.modelNames ?? []],
+  ...props.description === undefined ? {} : { description: props.description }
+});
+var updateBody4 = (props, live) => {
+  const changed = new Set(differing4(live, props));
+  return {
+    ...changed.has("access_group_name") ? { access_group_name: props.accessGroupName } : {},
+    ...changed.has("description") ? { description: props.description ?? null } : {},
+    ...changed.has("access_model_names") ? { access_model_names: [...props.modelNames ?? []] } : {},
+    ...changed.has("access_mcp_server_ids") ? { access_mcp_server_ids: [...props.mcpServerIds ?? []] } : {}
+  };
+};
+
+// src/litellm/access-group-operations.ts
+import * as ag from "@distilled.cloud/litellm/access_groups";
+import * as Effect19 from "effect/Effect";
+var RESOURCE = "LiteLLM.AccessGroup";
+var listAccessGroups = () => throughFetch(ag.listAccessGroupsV1UnifiedAccessGroupGet({})).pipe(Effect19.flatMap((response) => {
+  const rows = bodyOf(response);
+  if (!Array.isArray(rows)) {
+    return Effect19.fail(new LitellmRegistryUnreadableError({ reason: "not an array", resource: RESOURCE }));
+  }
+  const parsed = rows.map(toAttributes5);
+  return parsed.every((row) => row !== undefined) ? Effect19.succeed(parsed) : Effect19.fail(new LitellmRegistryUnreadableError({
+    reason: "a row has no id or name",
+    resource: RESOURCE
+  }));
+}));
+var createAccessGroup = (body) => throughFetch(ag.createAccessGroupV1UnifiedAccessGroupPost(body)).pipe(Effect19.asVoid);
+var updateAccessGroup = (accessGroupId, body) => throughFetch(ag.updateAccessGroupV1UnifiedAccessGroupAccessGroupIdPut({
+  ...body,
+  access_group_id: accessGroupId
+})).pipe(Effect19.asVoid);
+var deleteAccessGroup = (accessGroupId) => throughFetch(ag.deleteAccessGroupV1UnifiedAccessGroupAccessGroupIdDelete({ access_group_id: accessGroupId })).pipe(Effect19.asVoid, Effect19.catch((original) => listAccessGroups().pipe(Effect19.catch(() => Effect19.fail(original)), Effect19.flatMap((rows) => rows.some((row) => row.accessGroupId === accessGroupId) ? Effect19.fail(original) : Effect19.void))));
+
+// src/litellm/access-group.ts
+var RESOURCE2 = "LiteLLM.AccessGroup";
+var LiteLLMAccessGroup = Resource5("LiteLLM.AccessGroup", {
+  defaultRemovalPolicy: "retain"
+});
+var isLiteLLMAccessGroup = (value5) => Predicate6.hasProperty(value5, "Type") && value5.Type === "LiteLLM.AccessGroup";
+var locate3 = (rows, props, output) => output !== undefined ? rows.find((row) => row.accessGroupId === output.accessGroupId) : rows.find((row) => row.accessGroupName === props.accessGroupName);
+var accessGroupHandlers = {
+  read: ({ olds, output }) => Effect20.gen(function* () {
+    if (output === undefined) {
+      yield* dieIfInvalid(RESOURCE2, String(olds.accessGroupName), firstProblem3(olds));
+    }
+    const live = locate3(yield* listAccessGroups(), olds, output);
+    if (live === undefined)
+      return;
+    return output === undefined ? Unowned6(live) : live;
+  }),
+  diff: ({
+    news,
+    output
+  }) => Effect20.gen(function* () {
+    if (!isResolved5(news))
+      return;
+    yield* failIfInvalid(RESOURCE2, String(news.accessGroupName), firstProblem3(news));
+    if (output === undefined)
+      return;
+    return differing4(output, news).length === 0 ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({
+    news,
+    output
+  }) => Effect20.gen(function* () {
+    yield* failIfInvalid(RESOURCE2, String(news.accessGroupName), firstProblem3(news));
+    const before = locate3(yield* listAccessGroups(), news, output);
+    if (before === undefined)
+      yield* createAccessGroup(createBody5(news));
+    else if (differing4(before, news).length > 0) {
+      yield* updateAccessGroup(before.accessGroupId, updateBody4(news, before));
+    }
+    const rows = yield* listAccessGroups();
+    const after = before === undefined ? rows.find((row) => row.accessGroupName === news.accessGroupName) : rows.find((row) => row.accessGroupId === before.accessGroupId);
+    if (after === undefined) {
+      return yield* Effect20.fail(new LitellmRegistryAbsentAfterWriteError({
+        name: news.accessGroupName,
+        resource: RESOURCE2
+      }));
+    }
+    const left = differing4(after, news);
+    if (left.length > 0) {
+      return yield* Effect20.fail(new LitellmRegistryNotConvergedError({
+        fields: left,
+        name: news.accessGroupName,
+        resource: RESOURCE2
+      }));
+    }
+    return after;
+  }),
+  delete: ({ output }) => deleteAccessGroup(output.accessGroupId),
+  list: () => Effect20.succeed([])
+};
+var LiteLLMAccessGroupProvider = () => Provider5.effect(LiteLLMAccessGroup, Effect20.succeed(LiteLLMAccessGroup.Provider.of(accessGroupHandlers)));
+// src/litellm/policy-attachment.ts
+import { Resource as Resource6 } from "alchemy";
+import { Unowned as Unowned7 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved6 } from "alchemy/Diff";
+import * as Provider6 from "alchemy/Provider";
+import * as Effect22 from "effect/Effect";
+import * as Predicate7 from "effect/Predicate";
+
+// src/litellm/policy-attachment-form.ts
+var SELECTORS = ["teams", "keys", "models", "tags"];
+var firstProblem4 = (props) => {
+  if (isBlank3(props.policyName) || props.policyName !== props.policyName.trim()) {
+    return "`policyName` must be a non-blank name with no leading or trailing space";
+  }
+  if (props.scope !== undefined && props.scope !== "*")
+    return "`scope` can only be '*'";
+  for (const field of SELECTORS) {
+    const values = props[field] ?? [];
+    const bad = firstBadEntry(values);
+    if (bad !== undefined)
+      return `\`${field}\` has a blank or padded entry (${JSON.stringify(bad)})`;
+    const twice = firstDuplicate(values);
+    if (twice !== undefined)
+      return `\`${field}\` lists ${JSON.stringify(twice)} twice`;
+  }
+  if (props.scope === undefined && SELECTORS.every((field) => (props[field] ?? []).length === 0)) {
+    return "no `scope`, `teams`, `keys`, `models` or `tags`: LiteLLM treats an attachment with no selector as GLOBAL, so declare `scope: '*'` if that is meant";
+  }
+  if (props.priority !== undefined && !(Number.isInteger(props.priority) && props.priority >= -2147483648 && props.priority <= 2147483647)) {
+    return "`priority` must be a 32-bit integer";
+  }
+  return;
+};
+var toAttributes6 = (value5) => {
+  const row = asRow(value5);
+  if (row === undefined)
+    return;
+  const attachmentId = row["attachment_id"];
+  const policyName = row["policy_name"];
+  if (typeof attachmentId !== "string" || typeof policyName !== "string")
+    return;
+  return {
+    attachmentId,
+    keys: canonical2(stringsOf(row["keys"])),
+    models: canonical2(stringsOf(row["models"])),
+    policyName,
+    priority: numberOrNull2(row["priority"]),
+    scope: stringOrNull(row["scope"]),
+    tags: canonical2(stringsOf(row["tags"])),
+    teams: canonical2(stringsOf(row["teams"]))
+  };
+};
+var isConfigRow = (value5) => asRow(value5)?.["definition_location"] === "config";
+var differing5 = (live, props) => {
+  const fields = [];
+  if (live.policyName !== props.policyName)
+    fields.push("policy_name");
+  if ((live.scope ?? null) !== (props.scope ?? null))
+    fields.push("scope");
+  for (const field of SELECTORS)
+    if (!sameSet2(live[field], props[field] ?? []))
+      fields.push(field);
+  if (live.priority !== (props.priority ?? null))
+    fields.push("priority");
+  return fields;
+};
+var createBody6 = (props) => ({
+  policy_name: props.policyName,
+  ...props.scope === undefined ? {} : { scope: props.scope },
+  ...props.teams === undefined ? {} : { teams: [...props.teams] },
+  ...props.keys === undefined ? {} : { keys: [...props.keys] },
+  ...props.models === undefined ? {} : { models: [...props.models] },
+  ...props.tags === undefined ? {} : { tags: [...props.tags] },
+  ...props.priority === undefined ? {} : { priority: props.priority }
+});
+
+// src/litellm/policy-attachment-operations.ts
+import * as policies from "@distilled.cloud/litellm/policy_engine";
+import * as Effect21 from "effect/Effect";
+var RESOURCE3 = "LiteLLM.PolicyAttachment";
+var unreadable = (reason) => new LitellmRegistryUnreadableError({ reason, resource: RESOURCE3 });
+var listAttachments = () => throughFetch(policies.listPolicyAttachmentsPoliciesAttachmentsListGet({})).pipe(Effect21.flatMap((response) => {
+  const rows = asRow(bodyOf(response))?.["attachments"];
+  if (rows === undefined)
+    return Effect21.succeed([]);
+  if (!Array.isArray(rows))
+    return Effect21.fail(unreadable("attachments is not an array"));
+  const parsed = rows.filter((row) => !isConfigRow(row)).map(toAttributes6);
+  return parsed.every((each) => each !== undefined) ? Effect21.succeed(parsed) : Effect21.fail(unreadable("an attachment has no id or policy name"));
+}));
+var createAttachment = (body) => throughFetch(policies.createPolicyAttachmentPoliciesAttachmentsPost(body)).pipe(Effect21.map((response) => toAttributes6(bodyOf(response))));
+var deleteAttachment = (attachmentId) => throughFetch(policies.deletePolicyAttachmentPoliciesAttachmentsAttachmentIdDelete({
+  attachment_id: attachmentId
+})).pipe(Effect21.asVoid, Effect21.catch((original) => listAttachments().pipe(Effect21.catch(() => Effect21.fail(original)), Effect21.flatMap((rows) => rows.some((row) => row.attachmentId === attachmentId) ? Effect21.fail(original) : Effect21.void))));
+
+// src/litellm/policy-attachment.ts
+var RESOURCE4 = "LiteLLM.PolicyAttachment";
+var LiteLLMPolicyAttachment = Resource6("LiteLLM.PolicyAttachment");
+var isLiteLLMPolicyAttachment = (value5) => Predicate7.hasProperty(value5, "Type") && value5.Type === "LiteLLM.PolicyAttachment";
+var locate4 = (rows, props, output) => {
+  if (output !== undefined) {
+    return Effect22.succeed(rows.find((row) => row.attachmentId === output.attachmentId));
+  }
+  const equal = rows.filter((row) => differing5(row, props).length === 0);
+  return equal.length > 1 ? Effect22.fail(new LitellmRegistryAmbiguousError({
+    ids: equal.map((row) => row.attachmentId),
+    name: props.policyName,
+    resource: RESOURCE4
+  })) : Effect22.succeed(equal[0]);
+};
+var policyAttachmentHandlers = {
+  read: ({
+    olds,
+    output
+  }) => Effect22.gen(function* () {
+    if (output === undefined) {
+      yield* dieIfInvalid(RESOURCE4, String(olds.policyName), firstProblem4(olds));
+    }
+    const live = yield* locate4(yield* listAttachments(), olds, output);
+    if (live === undefined)
+      return;
+    return output === undefined ? Unowned7(live) : live;
+  }),
+  diff: ({
+    news,
+    output
+  }) => Effect22.gen(function* () {
+    if (!isResolved6(news))
+      return;
+    yield* failIfInvalid(RESOURCE4, String(news.policyName), firstProblem4(news));
+    if (output === undefined)
+      return;
+    return differing5(output, news).length === 0 ? { action: "noop" } : { action: "replace", deleteFirst: false };
+  }),
+  reconcile: ({
+    news,
+    output
+  }) => Effect22.gen(function* () {
+    yield* failIfInvalid(RESOURCE4, String(news.policyName), firstProblem4(news));
+    const before = yield* locate4(yield* listAttachments(), news, output);
+    if (before !== undefined && differing5(before, news).length === 0)
+      return before;
+    const created = yield* createAttachment(createBody6(news));
+    if (created === undefined) {
+      return yield* Effect22.fail(new LitellmRegistryUnreadableError({
+        reason: "the create answered something that is not an attachment",
+        resource: RESOURCE4
+      }));
+    }
+    const after = (yield* listAttachments()).find((row) => row.attachmentId === created.attachmentId);
+    if (after === undefined) {
+      return yield* Effect22.fail(new LitellmRegistryAbsentAfterWriteError({ name: news.policyName, resource: RESOURCE4 }));
+    }
+    const left = differing5(after, news);
+    if (left.length > 0) {
+      return yield* Effect22.fail(new LitellmRegistryNotConvergedError({
+        fields: left,
+        name: news.policyName,
+        resource: RESOURCE4
+      }));
+    }
+    return after;
+  }),
+  delete: ({ output }) => deleteAttachment(output.attachmentId),
+  list: () => Effect22.succeed([])
+};
+var LiteLLMPolicyAttachmentProvider = () => Provider6.effect(LiteLLMPolicyAttachment, Effect22.succeed(LiteLLMPolicyAttachment.Provider.of(policyAttachmentHandlers)));
+// src/litellm/policy.ts
+import { Resource as Resource7 } from "alchemy";
+import { Unowned as Unowned8 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved7 } from "alchemy/Diff";
+import * as Provider7 from "alchemy/Provider";
+import * as Effect24 from "effect/Effect";
+import * as Predicate8 from "effect/Predicate";
+
+// src/litellm/policy-form.ts
+var firstProblem5 = (props) => {
+  if (isBlank3(props.policyName) || props.policyName !== props.policyName.trim()) {
+    return "`policyName` must be a non-blank name with no leading or trailing space";
+  }
+  for (const [field, value5] of [
+    ["description", props.description],
+    ["inherit", props.inherit],
+    ["conditionModel", props.conditionModel]
+  ]) {
+    if (value5 !== undefined && isBlank3(value5)) {
+      return `\`${field}\` is blank; leave it out to keep the live value (a policy field cannot be cleared)`;
+    }
+  }
+  if (props.inherit === props.policyName)
+    return "`inherit` names the policy itself";
+  for (const [field, values] of [
+    ["guardrailsAdd", props.guardrailsAdd ?? []],
+    ["guardrailsRemove", props.guardrailsRemove ?? []]
+  ]) {
+    const bad = firstBadEntry(values);
+    if (bad !== undefined)
+      return `\`${field}\` has a blank or padded entry (${JSON.stringify(bad)})`;
+    const twice = firstDuplicate(values);
+    if (twice !== undefined)
+      return `\`${field}\` lists ${JSON.stringify(twice)} twice`;
+  }
+  const both = (props.guardrailsAdd ?? []).find((name) => (props.guardrailsRemove ?? []).includes(name));
+  if (both !== undefined)
+    return `guardrail ${JSON.stringify(both)} is both added and removed`;
+  return;
+};
+var toVersion = (value5) => {
+  const row = asRow(value5);
+  if (row === undefined)
+    return;
+  const policyId = row["policy_id"];
+  const policyName = row["policy_name"];
+  if (typeof policyId !== "string" || typeof policyName !== "string")
+    return;
+  const condition = asRow(row["condition"]);
+  return {
+    conditionModel: stringOrNull(condition?.["model"]),
+    description: stringOrNull(row["description"]),
+    guardrailsAdd: canonical2(stringsOf(row["guardrails_add"])),
+    guardrailsRemove: canonical2(stringsOf(row["guardrails_remove"])),
+    inherit: stringOrNull(row["inherit"]),
+    policyId,
+    policyName,
+    versionNumber: numberOrNull2(row["version_number"]) ?? 1,
+    versionStatus: typeof row["version_status"] === "string" ? row["version_status"] : "production"
+  };
+};
+var toAttributes7 = (version) => {
+  const { versionStatus: _status, ...attributes } = version;
+  return attributes;
+};
+var differing6 = (live, props) => {
+  const fields = [];
+  if (props.description !== undefined && live.description !== props.description) {
+    fields.push("description");
+  }
+  if (props.inherit !== undefined && live.inherit !== props.inherit)
+    fields.push("inherit");
+  if (!sameSet2(live.guardrailsAdd, props.guardrailsAdd ?? []))
+    fields.push("guardrails_add");
+  if (!sameSet2(live.guardrailsRemove, props.guardrailsRemove ?? []))
+    fields.push("guardrails_remove");
+  if (props.conditionModel !== undefined && live.conditionModel !== props.conditionModel) {
+    fields.push("condition");
+  }
+  return fields;
+};
+var createBody7 = (props) => ({
+  guardrails_add: [...props.guardrailsAdd ?? []],
+  guardrails_remove: [...props.guardrailsRemove ?? []],
+  policy_name: props.policyName,
+  ...props.description === undefined ? {} : { description: props.description },
+  ...props.inherit === undefined ? {} : { inherit: props.inherit },
+  ...props.conditionModel === undefined ? {} : { condition: { model: props.conditionModel } }
+});
+var updateBody5 = (props, live) => {
+  const changed = new Set(differing6(live, props));
+  return {
+    ...changed.has("description") ? { description: props.description ?? null } : {},
+    ...changed.has("inherit") ? { inherit: props.inherit ?? null } : {},
+    ...changed.has("guardrails_add") ? { guardrails_add: [...props.guardrailsAdd ?? []] } : {},
+    ...changed.has("guardrails_remove") ? { guardrails_remove: [...props.guardrailsRemove ?? []] } : {},
+    ...changed.has("condition") ? { condition: { model: props.conditionModel ?? null } } : {}
+  };
+};
+
+// src/litellm/policy-operations.ts
+import * as policies2 from "@distilled.cloud/litellm/policy_engine";
+import * as Effect23 from "effect/Effect";
+var RESOURCE5 = "LiteLLM.Policy";
+var unreadable2 = (reason) => new LitellmRegistryUnreadableError({ reason, resource: RESOURCE5 });
+var listPolicyVersions = (policyName) => throughFetch(policies2.listPolicyVersionsPoliciesNamePolicyNameVersionsGet({ policy_name: policyName })).pipe(Effect23.flatMap((response) => {
+  const versions = asRow(bodyOf(response))?.["versions"];
+  if (versions === undefined)
+    return Effect23.succeed([]);
+  if (!Array.isArray(versions))
+    return Effect23.fail(unreadable2("versions is not an array"));
+  const parsed = versions.map(toVersion);
+  return parsed.every((each) => each !== undefined) ? Effect23.succeed(parsed) : Effect23.fail(unreadable2("a version has no id or name"));
+}));
+var configPolicyNames = () => throughFetch(policies2.listPoliciesPoliciesListGet({ version_status: "production" })).pipe(Effect23.flatMap((response) => {
+  const rows = asRow(bodyOf(response))?.["policies"];
+  if (!Array.isArray(rows))
+    return Effect23.fail(unreadable2("policies is not an array"));
+  return Effect23.succeed(rows.flatMap((row) => {
+    const each = asRow(row);
+    return each?.["definition_location"] === "config" && typeof each["policy_name"] === "string" ? [each["policy_name"]] : [];
+  }));
+}));
+var createPolicy = (body) => throughFetch(policies2.createPolicyPoliciesPost(body)).pipe(Effect23.asVoid);
+var createDraft = (policyName) => throughFetch(policies2.createPolicyVersionPoliciesNamePolicyNameVersionsPost({ policy_name: policyName })).pipe(Effect23.flatMap((response) => {
+  const draft = toVersion(bodyOf(response));
+  return draft === undefined ? Effect23.fail(unreadable2("the new draft is not a policy")) : Effect23.succeed(draft);
+}));
+var editDraft = (policyId, body) => throughFetch(policies2.updatePolicyPoliciesPolicyIdPut({ ...body, policy_id: policyId })).pipe(Effect23.asVoid);
+var setVersionStatus = (policyId, status) => throughFetch(policies2.updatePolicyVersionStatusPoliciesPolicyIdStatusPut({
+  policy_id: policyId,
+  version_status: status
+})).pipe(Effect23.asVoid);
+var deleteAllVersions = (policyName) => throughFetch(policies2.deleteAllPolicyVersionsPoliciesNamePolicyNameAllVersionsDelete({
+  policy_name: policyName
+})).pipe(Effect23.asVoid);
+
+// src/litellm/policy.ts
+var RESOURCE6 = "LiteLLM.Policy";
+var LiteLLMPolicy = Resource7("LiteLLM.Policy", {
+  defaultRemovalPolicy: "retain"
+});
+var isLiteLLMPolicy = (value5) => Predicate8.hasProperty(value5, "Type") && value5.Type === "LiteLLM.Policy";
+var production = (versions) => versions.find((version) => version.versionStatus === "production");
+var invalid = (name, problem) => Effect24.fail(new LitellmRegistryInvalidError({ name, problem, resource: RESOURCE6 }));
+var policyHandlers = {
+  read: ({ olds, output }) => Effect24.gen(function* () {
+    if (output === undefined) {
+      yield* dieIfInvalid(RESOURCE6, String(olds.policyName), firstProblem5(olds));
+    }
+    const live = production(yield* listPolicyVersions(output?.policyName ?? olds.policyName));
+    if (live === undefined)
+      return;
+    return output === undefined ? Unowned8(toAttributes7(live)) : toAttributes7(live);
+  }),
+  diff: ({ news, output }) => Effect24.gen(function* () {
+    if (!isResolved7(news))
+      return;
+    yield* failIfInvalid(RESOURCE6, String(news.policyName), firstProblem5(news));
+    if (output === undefined)
+      return;
+    if (news.policyName !== output.policyName) {
+      return { action: "replace", deleteFirst: false };
+    }
+    return differing6(output, news).length === 0 ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({ news }) => Effect24.gen(function* () {
+    yield* failIfInvalid(RESOURCE6, String(news.policyName), firstProblem5(news));
+    const versions = yield* listPolicyVersions(news.policyName);
+    const live = production(versions);
+    if (versions.length === 0) {
+      if ((yield* configPolicyNames()).includes(news.policyName)) {
+        return yield* invalid(news.policyName, "a policy of this name is defined in config.yaml, and a production DB policy would override it at runtime; rename this one or remove the config policy first");
+      }
+      yield* createPolicy(createBody7(news));
+    } else if (live === undefined) {
+      return yield* invalid(news.policyName, `${versions.length} version(s) exist and none is production, so the policy is inactive; promote one in LiteLLM (or delete its versions) instead of letting this guess`);
+    } else if (differing6(live, news).length > 0) {
+      const draft = yield* createDraft(news.policyName);
+      yield* editDraft(draft.policyId, updateBody5(news, live));
+      yield* setVersionStatus(draft.policyId, "published");
+      yield* setVersionStatus(draft.policyId, "production");
+    }
+    const after = production(yield* listPolicyVersions(news.policyName));
+    if (after === undefined) {
+      return yield* Effect24.fail(new LitellmRegistryAbsentAfterWriteError({ name: news.policyName, resource: RESOURCE6 }));
+    }
+    const left = differing6(after, news);
+    if (left.length > 0) {
+      return yield* Effect24.fail(new LitellmRegistryNotConvergedError({
+        fields: left,
+        name: news.policyName,
+        resource: RESOURCE6
+      }));
+    }
+    return toAttributes7(after);
+  }),
+  delete: ({ output }) => deleteAllVersions(output.policyName),
+  list: () => Effect24.succeed([])
+};
+var LiteLLMPolicyProvider = () => Provider7.effect(LiteLLMPolicy, Effect24.succeed(LiteLLMPolicy.Provider.of(policyHandlers)));
+// src/litellm/team.ts
+import { Resource as Resource8 } from "alchemy";
+import { Unowned as Unowned9 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved8 } from "alchemy/Diff";
+import { createPhysicalName as createPhysicalName4 } from "alchemy/PhysicalName";
+import * as Provider8 from "alchemy/Provider";
+import * as Effect26 from "effect/Effect";
+import * as Predicate9 from "effect/Predicate";
+
+// src/litellm/team-members.ts
+var toMemberAttributes = (value5) => {
+  if (!Array.isArray(value5))
+    return [];
+  const members = [];
+  for (const entry of value5) {
+    const row = asRow(entry);
+    if (typeof row?.["user_id"] === "string" && row["user_id"] !== "") {
+      members.push({
+        role: typeof row["role"] === "string" ? row["role"] : "user",
+        userId: row["user_id"]
+      });
+    }
+  }
+  return members.sort((a, b) => a.userId.localeCompare(b.userId));
+};
+var roleOf = (member) => member.role ?? "user";
+var membersToAdd = (live, declared) => (declared ?? []).filter((member) => !live.some((each) => each.userId === member.userId));
+var roleChanges = (live, declared) => (declared ?? []).filter((member) => live.some((each) => each.userId === member.userId && each.role !== roleOf(member)));
+var rosterPending = (live, declared) => membersToAdd(live, declared).length + roleChanges(live, declared).length > 0;
+
+// src/litellm/team-permission.ts
+var ALL_PROXY_SERVERS = "all-proxy-mcpservers";
+var LISTS = [
+  ["mcpServers", "mcp_servers"],
+  ["mcpAccessGroups", "mcp_access_groups"],
+  ["mcpToolsets", "mcp_toolsets"],
+  ["blockedTools", "blocked_tools"]
+];
+var parseToolPermissions = (value5) => {
+  const parsed = typeof value5 === "string" ? safeJson(value5) : value5;
+  const row = asRow(parsed);
+  if (row === undefined)
+    return {};
+  return Object.fromEntries(Object.keys(row).sort().map((server) => [server, canonical2(stringsOf(row[server]))]));
+};
+var safeJson = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return;
+  }
+};
+var toPermissionAttributes = (value5) => {
+  const row = asRow(value5);
+  return {
+    blockedTools: canonical2(stringsOf(row?.["blocked_tools"])),
+    mcpAccessGroups: canonical2(stringsOf(row?.["mcp_access_groups"])),
+    mcpServers: canonical2(stringsOf(row?.["mcp_servers"])),
+    mcpToolPermissions: parseToolPermissions(row?.["mcp_tool_permissions"]),
+    mcpToolsets: canonical2(stringsOf(row?.["mcp_toolsets"]))
+  };
+};
+var sameToolPermissions = (live, declared) => {
+  const servers = Object.keys(declared).sort();
+  return sameSet2(Object.keys(live), servers) && servers.every((server) => sameSet2(live[server] ?? [], declared[server] ?? []));
+};
+var permissionDiffers = (live, declared) => {
+  if (declared === undefined)
+    return [];
+  const fields = [];
+  for (const [prop, wire] of LISTS) {
+    const wanted = declared[prop];
+    if (wanted !== undefined && !sameSet2(live[prop], wanted))
+      fields.push(wire);
+  }
+  if (declared.mcpToolPermissions !== undefined && !sameToolPermissions(live.mcpToolPermissions, declared.mcpToolPermissions)) {
+    fields.push("mcp_tool_permissions");
+  }
+  return fields;
+};
+var permissionBody = (declared, only) => {
+  const body = {};
+  for (const [prop, wire] of LISTS) {
+    const wanted = declared[prop];
+    if (wanted !== undefined && (only === undefined || only.has(wire)))
+      body[wire] = [...wanted];
+  }
+  if (declared.mcpToolPermissions !== undefined && (only === undefined || only.has("mcp_tool_permissions"))) {
+    body["mcp_tool_permissions"] = Object.fromEntries(Object.entries(declared.mcpToolPermissions).map(([server, tools]) => [server, [...tools]]));
+  }
+  return body;
+};
+var permissionProblem = (declared) => {
+  if (declared === undefined)
+    return;
+  for (const [prop] of LISTS) {
+    const values = declared[prop] ?? [];
+    const bad = firstBadEntry(values);
+    if (bad !== undefined)
+      return `\`objectPermission.${prop}\` has a blank or padded entry (${JSON.stringify(bad)})`;
+    const twice = firstDuplicate(values);
+    if (twice !== undefined)
+      return `\`objectPermission.${prop}\` lists ${JSON.stringify(twice)} twice`;
+  }
+  if ((declared.mcpServers ?? []).includes(ALL_PROXY_SERVERS)) {
+    return `\`objectPermission.mcpServers\` carries \`${ALL_PROXY_SERVERS}\`, which grants EVERY MCP server on the proxy; list the servers instead`;
+  }
+  for (const [server, tools] of Object.entries(declared.mcpToolPermissions ?? {})) {
+    if (isBlank3(server) || server !== server.trim()) {
+      return "`objectPermission.mcpToolPermissions` has a blank or padded server key";
+    }
+    const bad = firstBadEntry(tools);
+    if (bad !== undefined)
+      return `\`objectPermission.mcpToolPermissions\` lists a blank or padded tool for ${server}`;
+    const twice = firstDuplicate(tools);
+    if (twice !== undefined)
+      return `\`objectPermission.mcpToolPermissions\` lists ${JSON.stringify(twice)} twice for ${server}`;
+  }
+  return;
+};
+
+// src/litellm/team-form.ts
+var firstProblem6 = (props) => {
+  if (isBlank3(props.teamAlias) || props.teamAlias !== props.teamAlias.trim()) {
+    return "`teamAlias` must be a non-blank name with no leading or trailing space";
+  }
+  if (props.teamId !== undefined && (isBlank3(props.teamId) || props.teamId !== props.teamId.trim())) {
+    return "`teamId` must be a non-blank id with no leading or trailing space";
+  }
+  for (const [field, values] of [
+    ["models", props.models ?? []],
+    ["accessGroupIds", props.accessGroupIds ?? []]
+  ]) {
+    const bad = firstBadEntry(values);
+    if (bad !== undefined)
+      return `\`${field}\` has a blank or padded entry (${JSON.stringify(bad)})`;
+    const twice = firstDuplicate(values);
+    if (twice !== undefined)
+      return `\`${field}\` lists ${JSON.stringify(twice)} twice`;
+  }
+  const ids = (props.members ?? []).map((member) => member.userId);
+  const badId = firstBadEntry(ids);
+  if (badId !== undefined)
+    return `\`members\` has a blank or padded userId (${JSON.stringify(badId)})`;
+  const twiceId = firstDuplicate(ids);
+  if (twiceId !== undefined)
+    return `\`members\` lists ${JSON.stringify(twiceId)} twice`;
+  for (const member of props.members ?? []) {
+    if (member.role !== undefined && member.role !== "user" && member.role !== "admin") {
+      return `member ${member.userId} has a role other than user or admin`;
+    }
+  }
+  return permissionProblem(props.objectPermission);
+};
+var toAttributes8 = (value5) => {
+  const row = asRow(asRow(value5)?.["team_info"]);
+  if (row === undefined)
+    return;
+  const teamId = row["team_id"];
+  if (typeof teamId !== "string")
+    return;
+  return {
+    accessGroupIds: canonical2(stringsOf(row["access_group_ids"])),
+    blocked: row["blocked"] === true,
+    members: toMemberAttributes(row["members_with_roles"]),
+    models: canonical2(stringsOf(row["models"])),
+    objectPermission: toPermissionAttributes(row["object_permission"]),
+    teamAlias: typeof row["team_alias"] === "string" ? row["team_alias"] : "",
+    teamId
+  };
+};
+var teamFieldsDiffering = (live, props) => {
+  const fields = [];
+  if (live.teamAlias !== props.teamAlias)
+    fields.push("team_alias");
+  if (props.models !== undefined && !sameSet2(live.models, props.models))
+    fields.push("models");
+  if (props.blocked !== undefined && live.blocked !== props.blocked)
+    fields.push("blocked");
+  if (props.accessGroupIds !== undefined && !sameSet2(live.accessGroupIds, props.accessGroupIds)) {
+    fields.push("access_group_ids");
+  }
+  for (const wire of permissionDiffers(live.objectPermission, props.objectPermission)) {
+    fields.push(`object_permission.${wire}`);
+  }
+  return fields;
+};
+var differing7 = (live, props) => [
+  ...teamFieldsDiffering(live, props),
+  ...rosterPending(live.members, props.members) ? ["members"] : []
+];
+var createBody8 = (props, teamId) => ({
+  team_alias: props.teamAlias,
+  team_id: teamId,
+  ...props.models === undefined ? {} : { models: [...props.models] },
+  ...props.blocked === undefined ? {} : { blocked: props.blocked },
+  ...props.accessGroupIds === undefined ? {} : { access_group_ids: [...props.accessGroupIds] },
+  ...props.objectPermission === undefined ? {} : { object_permission: permissionBody(props.objectPermission) }
+});
+var updateBody6 = (props, live) => {
+  const changed = new Set(teamFieldsDiffering(live, props));
+  if (changed.size === 0)
+    return;
+  const permission = new Set([...changed].filter((field) => field.startsWith("object_permission.")).map((field) => field.slice(18)));
+  return {
+    team_id: live.teamId,
+    ...changed.has("team_alias") ? { team_alias: props.teamAlias } : {},
+    ...changed.has("models") ? { models: [...props.models ?? []] } : {},
+    ...changed.has("blocked") ? { blocked: props.blocked ?? false } : {},
+    ...changed.has("access_group_ids") ? { access_group_ids: [...props.accessGroupIds ?? []] } : {},
+    ...props.objectPermission !== undefined && permission.size > 0 ? { object_permission: permissionBody(props.objectPermission, permission) } : {}
+  };
+};
+
+// src/litellm/team-operations.ts
+import * as team from "@distilled.cloud/litellm/team_management";
+import * as Effect25 from "effect/Effect";
+var readTeam = (teamId) => throughFetch(team.getTeamInfoTeamInfo({ team_id: teamId })).pipe(Effect25.map((response) => {
+  const row = toAttributes8(bodyOf(response));
+  return row?.teamId === teamId ? row : undefined;
+}), Effect25.catch((error) => isNotFound(error) ? Effect25.succeed(undefined) : Effect25.fail(error)));
+var createTeam = (body) => throughFetch(team.postNewTeamTeamNew(body)).pipe(Effect25.asVoid);
+var updateTeam = (body) => throughFetch(team.updateTeamTeamUpdatePost(body)).pipe(Effect25.asVoid);
+var addMembers = (teamId, members) => throughFetch(team.teamMemberAddTeamMemberAddPost({
+  member: members.map((member) => ({ role: member.role ?? "user", user_id: member.userId })),
+  team_id: teamId
+})).pipe(Effect25.asVoid);
+var setMemberRole = (teamId, member) => throughFetch(team.teamMemberUpdateTeamMemberUpdatePost({
+  role: member.role ?? "user",
+  team_id: teamId,
+  user_id: member.userId
+})).pipe(Effect25.asVoid);
+var listTeamIds = () => throughFetch(team.listTeamTeamListGet({})).pipe(Effect25.map((response) => {
+  const rows = bodyOf(response);
+  return Array.isArray(rows) ? rows.flatMap((row) => {
+    const id = asRow(row)?.["team_id"];
+    return typeof id === "string" ? [id] : [];
+  }) : [];
+}));
+var deleteTeam = (teamId) => throughFetch(team.deleteTeamTeamDeletePost({ team_ids: [teamId] })).pipe(Effect25.asVoid, Effect25.catchTag("NotFound", (original) => listTeamIds().pipe(Effect25.flatMap((ids) => ids.includes(teamId) ? Effect25.fail(original) : Effect25.void))));
+
+// src/litellm/team.ts
+var RESOURCE7 = "LiteLLM.Team";
+var LiteLLMTeam = Resource8("LiteLLM.Team", {
+  defaultRemovalPolicy: "retain"
+});
+var isLiteLLMTeam = (value5) => Predicate9.hasProperty(value5, "Type") && value5.Type === "LiteLLM.Team";
+var idOf3 = (id, instanceId, props, output) => output?.teamId !== undefined ? Effect26.succeed(output.teamId) : props.teamId !== undefined ? Effect26.succeed(props.teamId) : createPhysicalName4({ id, instanceId, lowercase: true, maxLength: 64 });
+var teamHandlers = {
+  read: ({ id, instanceId, olds, output }) => Effect26.gen(function* () {
+    if (output === undefined) {
+      yield* dieIfInvalid(RESOURCE7, String(olds.teamAlias), firstProblem6(olds));
+    }
+    const live = yield* readTeam(yield* idOf3(id, instanceId, olds, output));
+    if (live === undefined)
+      return;
+    return output === undefined ? Unowned9(live) : live;
+  }),
+  diff: ({ news, output }) => Effect26.gen(function* () {
+    if (!isResolved8(news))
+      return;
+    yield* failIfInvalid(RESOURCE7, String(news.teamAlias), firstProblem6(news));
+    if (output === undefined)
+      return;
+    if (news.teamId !== undefined && news.teamId !== output.teamId) {
+      return { action: "replace", deleteFirst: false };
+    }
+    return differing7(output, news).length === 0 ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({ id, instanceId, news, output }) => Effect26.gen(function* () {
+    yield* failIfInvalid(RESOURCE7, String(news.teamAlias), firstProblem6(news));
+    const teamId = yield* idOf3(id, instanceId, news, output);
+    const before = yield* readTeam(teamId);
+    if (before === undefined)
+      yield* createTeam(createBody8(news, teamId));
+    else {
+      const body = updateBody6(news, before);
+      if (body !== undefined)
+        yield* updateTeam(body);
+    }
+    if (news.members !== undefined) {
+      const live = yield* readTeam(teamId);
+      if (live === undefined) {
+        return yield* Effect26.fail(new LitellmRegistryAbsentAfterWriteError({ name: news.teamAlias, resource: RESOURCE7 }));
+      }
+      const missing = membersToAdd(live.members, news.members);
+      if (missing.length > 0)
+        yield* addMembers(teamId, missing);
+      for (const member of roleChanges(live.members, news.members)) {
+        yield* setMemberRole(teamId, member);
+      }
+    }
+    const after = yield* readTeam(teamId);
+    if (after === undefined) {
+      return yield* Effect26.fail(new LitellmRegistryAbsentAfterWriteError({ name: news.teamAlias, resource: RESOURCE7 }));
+    }
+    const left = differing7(after, news);
+    if (left.length > 0) {
+      return yield* Effect26.fail(new LitellmRegistryNotConvergedError({
+        fields: left,
+        name: news.teamAlias,
+        resource: RESOURCE7
+      }));
+    }
+    return after;
+  }),
+  delete: ({ output }) => deleteTeam(output.teamId),
+  list: () => Effect26.succeed([])
+};
+var LiteLLMTeamProvider = () => Provider8.effect(LiteLLMTeam, Effect26.succeed(LiteLLMTeam.Provider.of(teamHandlers)));
+// src/litellm/tool-policy.ts
+import { Resource as Resource9 } from "alchemy";
+import { Unowned as Unowned10 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved9 } from "alchemy/Diff";
+import * as Provider9 from "alchemy/Provider";
+import * as Effect28 from "effect/Effect";
+import * as Predicate10 from "effect/Predicate";
+
+// src/litellm/tool-policy-types.ts
+var DEFAULT_TOOL_POLICY = "untrusted";
+var INPUT_POLICIES = ["untrusted", "trusted", "blocked"];
+var OUTPUT_POLICIES = ["untrusted", "trusted"];
+
+// src/litellm/tool-policy-form.ts
+var shadowed = (name) => name === "list" || name === "spend" || name === "policy/options" || ["/detail", "/logs"].some((suffix) => name.endsWith(suffix));
+var firstProblem7 = (props) => {
+  if (isBlank3(props.toolName) || props.toolName !== props.toolName.trim()) {
+    return "`toolName` must be a non-blank name with no leading or trailing space";
+  }
+  if (shadowed(props.toolName)) {
+    return "`toolName` is one the /v1/tool route table answers itself (list, spend, policy/options, …/detail, …/logs), so it could never be read back";
+  }
+  if (props.inputPolicy === undefined && props.outputPolicy === undefined) {
+    return "declare `inputPolicy`, `outputPolicy` or both (LiteLLM answers 400 to neither)";
+  }
+  if (props.inputPolicy !== undefined && !INPUT_POLICIES.includes(props.inputPolicy)) {
+    return `\`inputPolicy\` must be one of ${INPUT_POLICIES.join(", ")}`;
+  }
+  if (props.outputPolicy !== undefined && !OUTPUT_POLICIES.includes(props.outputPolicy)) {
+    return `\`outputPolicy\` must be one of ${OUTPUT_POLICIES.join(", ")}`;
+  }
+  return;
+};
+var toAttributes9 = (value5) => {
+  const row = asRow(value5);
+  if (row === undefined)
+    return;
+  const toolId = row["tool_id"];
+  const toolName = row["tool_name"];
+  if (typeof toolId !== "string" || typeof toolName !== "string")
+    return;
+  const policy = (field) => typeof row[field] === "string" && row[field] !== "" ? row[field] : "untrusted";
+  return {
+    inputPolicy: policy("input_policy"),
+    outputPolicy: policy("output_policy"),
+    toolId,
+    toolName
+  };
+};
+var differing8 = (live, props) => {
+  const fields = [];
+  if (props.inputPolicy !== undefined && live.inputPolicy !== props.inputPolicy) {
+    fields.push("input_policy");
+  }
+  if (props.outputPolicy !== undefined && live.outputPolicy !== props.outputPolicy) {
+    fields.push("output_policy");
+  }
+  return fields;
+};
+var updateBody7 = (props, live) => {
+  const changed = live === undefined ? undefined : new Set(differing8(live, props));
+  return {
+    tool_name: props.toolName,
+    ...props.inputPolicy !== undefined && (changed === undefined || changed.has("input_policy")) ? { input_policy: props.inputPolicy } : {},
+    ...props.outputPolicy !== undefined && (changed === undefined || changed.has("output_policy")) ? { output_policy: props.outputPolicy } : {}
+  };
+};
+
+// src/litellm/tool-policy-operations.ts
+import * as tools from "@distilled.cloud/litellm/tools";
+import * as Effect27 from "effect/Effect";
+var readTool = (toolName) => throughFetch(tools.getToolV1ToolToolNameGet({ tool_name: toolName })).pipe(Effect27.map((response) => {
+  const row = toAttributes9(bodyOf(response));
+  return row?.toolName === toolName ? row : undefined;
+}), Effect27.catch((error) => isNotFound(error) ? Effect27.succeed(undefined) : Effect27.fail(error)));
+var writeToolPolicy = (body) => throughFetch(tools.updateToolPolicyV1ToolPolicyPost(body)).pipe(Effect27.asVoid);
+var resetToolPolicy = (props) => readTool(props.toolName).pipe(Effect27.flatMap((live) => {
+  if (live === undefined)
+    return Effect27.void;
+  const inputStale = props.inputPolicy !== undefined && live.inputPolicy !== DEFAULT_TOOL_POLICY;
+  const outputStale = props.outputPolicy !== undefined && live.outputPolicy !== DEFAULT_TOOL_POLICY;
+  if (!inputStale && !outputStale)
+    return Effect27.void;
+  return writeToolPolicy({
+    tool_name: props.toolName,
+    ...inputStale ? { input_policy: DEFAULT_TOOL_POLICY } : {},
+    ...outputStale ? { output_policy: DEFAULT_TOOL_POLICY } : {}
+  });
+}));
+
+// src/litellm/tool-policy.ts
+var RESOURCE8 = "LiteLLM.ToolPolicy";
+var LiteLLMToolPolicy = Resource9("LiteLLM.ToolPolicy", {
+  defaultRemovalPolicy: "retain"
+});
+var isLiteLLMToolPolicy = (value5) => Predicate10.hasProperty(value5, "Type") && value5.Type === "LiteLLM.ToolPolicy";
+var toolPolicyHandlers = {
+  read: ({ olds, output }) => Effect28.gen(function* () {
+    if (output === undefined) {
+      yield* dieIfInvalid(RESOURCE8, String(olds.toolName), firstProblem7(olds));
+    }
+    const live = yield* readTool(output?.toolName ?? olds.toolName);
+    if (live === undefined)
+      return;
+    return output === undefined ? Unowned10(live) : live;
+  }),
+  diff: ({
+    news,
+    output
+  }) => Effect28.gen(function* () {
+    if (!isResolved9(news))
+      return;
+    yield* failIfInvalid(RESOURCE8, String(news.toolName), firstProblem7(news));
+    if (output === undefined)
+      return;
+    if (news.toolName !== output.toolName) {
+      return { action: "replace", deleteFirst: false };
+    }
+    return differing8(output, news).length === 0 ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({ news }) => Effect28.gen(function* () {
+    yield* failIfInvalid(RESOURCE8, String(news.toolName), firstProblem7(news));
+    const before = yield* readTool(news.toolName);
+    if (before === undefined || differing8(before, news).length > 0) {
+      yield* writeToolPolicy(updateBody7(news, before));
+    }
+    const after = yield* readTool(news.toolName);
+    if (after === undefined) {
+      return yield* Effect28.fail(new LitellmRegistryAbsentAfterWriteError({ name: news.toolName, resource: RESOURCE8 }));
+    }
+    const left = differing8(after, news);
+    if (left.length > 0) {
+      return yield* Effect28.fail(new LitellmRegistryNotConvergedError({
+        fields: left,
+        name: news.toolName,
+        resource: RESOURCE8
+      }));
+    }
+    return after;
+  }),
+  delete: ({ olds }) => resetToolPolicy(olds),
+  list: () => Effect28.succeed([])
+};
+var LiteLLMToolPolicyProvider = () => Provider9.effect(LiteLLMToolPolicy, Effect28.succeed(LiteLLMToolPolicy.Provider.of(toolPolicyHandlers)));
+// src/litellm/toolset.ts
+import { Resource as Resource10 } from "alchemy";
+import { Unowned as Unowned11 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved10 } from "alchemy/Diff";
+import * as Provider10 from "alchemy/Provider";
+import * as Effect30 from "effect/Effect";
+import * as Predicate11 from "effect/Predicate";
+
+// src/litellm/toolset-form.ts
+var pairKey = (tool) => JSON.stringify([tool.serverId, tool.toolName]);
+var canonicalTools = (tools2) => [...new Map(tools2.map((tool) => [pairKey(tool), tool])).values()].sort((a, b) => pairKey(a).localeCompare(pairKey(b)));
+var sameTools = (left, right) => {
+  const a = canonicalTools(left).map(pairKey);
+  const b = canonicalTools(right).map(pairKey);
+  return a.length === b.length && a.every((each, index) => each === b[index]);
+};
+var firstProblem8 = (props) => {
+  if (isBlank3(props.toolsetName) || props.toolsetName !== props.toolsetName.trim()) {
+    return "`toolsetName` must be a non-blank name with no leading or trailing space";
+  }
+  if (props.toolsetName.includes("/")) {
+    return "`toolsetName` contains `/`: a toolset is served at /toolset/{toolset_name}/mcp, so that name can never be addressed";
+  }
+  if (props.description !== undefined && isBlank3(props.description)) {
+    return "`description` is blank; leave it out to keep the live text";
+  }
+  if (!Array.isArray(props.tools))
+    return "`tools` must be a list (an empty one is `[]`)";
+  const bad = firstBadEntry(props.tools.map((tool) => tool.serverId)) ?? firstBadEntry(props.tools.map((tool) => tool.toolName));
+  if (bad !== undefined)
+    return `a tool has a blank or padded serverId or toolName (${JSON.stringify(bad)})`;
+  const keys = props.tools.map(pairKey);
+  const twice = keys.find((key, index) => keys.indexOf(key) !== index);
+  if (twice !== undefined)
+    return `\`tools\` lists ${twice} twice`;
+  return;
+};
+var toAttributes10 = (value5) => {
+  const row = asRow(value5);
+  if (row === undefined)
+    return;
+  const toolsetId = row["toolset_id"];
+  const toolsetName = row["toolset_name"];
+  if (typeof toolsetId !== "string" || typeof toolsetName !== "string")
+    return;
+  const tools2 = [];
+  for (const entry of Array.isArray(row["tools"]) ? row["tools"] : []) {
+    const pair = asRow(entry);
+    if (typeof pair?.["server_id"] === "string" && typeof pair["tool_name"] === "string") {
+      tools2.push({ serverId: pair["server_id"], toolName: pair["tool_name"] });
+    }
+  }
+  return {
+    description: stringOrNull(row["description"]),
+    toolsetId,
+    toolsetName,
+    tools: canonicalTools(tools2)
+  };
+};
+var differing9 = (live, props) => {
+  const fields = [];
+  if (live.toolsetName !== props.toolsetName)
+    fields.push("toolset_name");
+  if (props.description !== undefined && live.description !== props.description) {
+    fields.push("description");
+  }
+  if (!sameTools(live.tools, props.tools))
+    fields.push("tools");
+  return fields;
+};
+var wireTools = (tools2) => tools2.map((tool) => ({ server_id: tool.serverId, tool_name: tool.toolName }));
+var createBody9 = (props) => ({
+  toolset_name: props.toolsetName,
+  tools: wireTools(props.tools),
+  ...props.description === undefined ? {} : { description: props.description }
+});
+var updateBody8 = (props, live) => {
+  const changed = new Set(differing9(live, props));
+  return {
+    toolset_id: live.toolsetId,
+    ...changed.has("toolset_name") ? { toolset_name: props.toolsetName } : {},
+    ...changed.has("description") ? { description: props.description ?? null } : {},
+    ...changed.has("tools") ? { tools: wireTools(props.tools) } : {}
+  };
+};
+
+// src/litellm/toolset-operations.ts
+import * as mcp2 from "@distilled.cloud/litellm/mcp_management";
+import * as Effect29 from "effect/Effect";
+var RESOURCE9 = "LiteLLM.Toolset";
+var listToolsets = () => throughFetch(mcp2.fetchMcpToolsetsV1McpToolsetGet({})).pipe(Effect29.flatMap((response) => {
+  const rows = bodyOf(response);
+  if (!Array.isArray(rows)) {
+    return Effect29.fail(new LitellmRegistryUnreadableError({ reason: "not an array", resource: RESOURCE9 }));
+  }
+  const parsed = rows.map(toAttributes10);
+  return parsed.every((row) => row !== undefined) ? Effect29.succeed(parsed) : Effect29.fail(new LitellmRegistryUnreadableError({
+    reason: "a row has no id or name",
+    resource: RESOURCE9
+  }));
+}));
+var readToolset = (toolsetId) => throughFetch(mcp2.fetchMcpToolsetV1McpToolsetToolsetIdGet({ toolset_id: toolsetId })).pipe(Effect29.map((response) => {
+  const row = toAttributes10(bodyOf(response));
+  return row?.toolsetId === toolsetId ? row : undefined;
+}), Effect29.catch((error) => isNotFound(error) ? Effect29.succeed(undefined) : Effect29.fail(error)));
+var createToolset = (body) => throughFetch(mcp2.addMcpToolsetV1McpToolsetPost(body)).pipe(Effect29.map((response) => toAttributes10(bodyOf(response))));
+var updateToolset = (body) => throughFetch(mcp2.editMcpToolsetV1McpToolsetPut(body)).pipe(Effect29.asVoid);
+var deleteToolset = (toolsetId) => throughFetch(mcp2.removeMcpToolsetV1McpToolsetToolsetIdDelete({ toolset_id: toolsetId })).pipe(Effect29.asVoid, Effect29.catch((original) => readToolset(toolsetId).pipe(Effect29.catch(() => Effect29.fail(original)), Effect29.flatMap((row) => row === undefined ? Effect29.void : Effect29.fail(original)))));
+
+// src/litellm/toolset.ts
+var RESOURCE10 = "LiteLLM.Toolset";
+var LiteLLMToolset = Resource10("LiteLLM.Toolset", {
+  defaultRemovalPolicy: "retain"
+});
+var isLiteLLMToolset = (value5) => Predicate11.hasProperty(value5, "Type") && value5.Type === "LiteLLM.Toolset";
+var locate5 = (props, output) => Effect30.gen(function* () {
+  if (output !== undefined)
+    return yield* readToolset(output.toolsetId);
+  const named = (yield* listToolsets()).filter((row) => row.toolsetName === props.toolsetName);
+  if (named.length > 1) {
+    return yield* Effect30.fail(new LitellmRegistryAmbiguousError({
+      ids: named.map((row) => row.toolsetId),
+      name: props.toolsetName,
+      resource: RESOURCE10
+    }));
+  }
+  return named[0];
+});
+var toolsetHandlers = {
+  read: ({ olds, output }) => Effect30.gen(function* () {
+    if (output === undefined) {
+      yield* dieIfInvalid(RESOURCE10, String(olds.toolsetName), firstProblem8(olds));
+    }
+    const live = yield* locate5(olds, output);
+    if (live === undefined)
+      return;
+    return output === undefined ? Unowned11(live) : live;
+  }),
+  diff: ({ news, output }) => Effect30.gen(function* () {
+    if (!isResolved10(news))
+      return;
+    yield* failIfInvalid(RESOURCE10, String(news.toolsetName), firstProblem8(news));
+    if (output === undefined)
+      return;
+    return differing9(output, news).length === 0 ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({ news, output }) => Effect30.gen(function* () {
+    yield* failIfInvalid(RESOURCE10, String(news.toolsetName), firstProblem8(news));
+    const before = yield* locate5(news, output);
+    let toolsetId;
+    if (before === undefined) {
+      const created = yield* createToolset(createBody9(news));
+      if (created === undefined) {
+        return yield* Effect30.fail(new LitellmRegistryUnreadableError({
+          reason: "the create answered something that is not a toolset",
+          resource: RESOURCE10
+        }));
+      }
+      toolsetId = created.toolsetId;
+    } else {
+      toolsetId = before.toolsetId;
+      if (differing9(before, news).length > 0)
+        yield* updateToolset(updateBody8(news, before));
+    }
+    const after = yield* readToolset(toolsetId);
+    if (after === undefined) {
+      return yield* Effect30.fail(new LitellmRegistryAbsentAfterWriteError({ name: news.toolsetName, resource: RESOURCE10 }));
+    }
+    const left = differing9(after, news);
+    if (left.length > 0) {
+      return yield* Effect30.fail(new LitellmRegistryNotConvergedError({
+        fields: left,
+        name: news.toolsetName,
+        resource: RESOURCE10
+      }));
+    }
+    return after;
+  }),
+  delete: ({ output }) => deleteToolset(output.toolsetId),
+  list: () => Effect30.succeed([])
+};
+var LiteLLMToolsetProvider = () => Provider10.effect(LiteLLMToolset, Effect30.succeed(LiteLLMToolset.Provider.of(toolsetHandlers)));
+// src/litellm/model.ts
+import { Resource as Resource11 } from "alchemy";
+import { Unowned as Unowned13 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved11 } from "alchemy/Diff";
+import { createPhysicalName as createPhysicalName6 } from "alchemy/PhysicalName";
+import * as Provider11 from "alchemy/Provider";
+import * as Effect36 from "effect/Effect";
+import * as Predicate12 from "effect/Predicate";
+
+// src/litellm/model-errors.ts
+import * as Data6 from "effect/Data";
+
+class LitellmModelInvalidError extends Data6.TaggedError("LitellmModelInvalidError") {
+  get message() {
+    return `LiteLLM.Model "${this.modelName}": ${this.problem}.`;
+  }
+}
+
+class LitellmModelAmbiguousNameError extends Data6.TaggedError("LitellmModelAmbiguousNameError") {
+  get message() {
+    return `LiteLLM.Model "${this.modelName}": ${this.ids.length} live deployments carry that name ` + `(${this.ids.join(", ")}). Declare \`id\` to choose one.`;
+  }
+}
+
+class LitellmModelUnreadableError extends Data6.TaggedError("LitellmModelUnreadableError") {
+  get message() {
+    return `LiteLLM.Model: the deployment list is unreadable (${this.reason}).`;
+  }
+}
+
+class LitellmModelAbsentAfterWriteError extends Data6.TaggedError("LitellmModelAbsentAfterWriteError") {
+  get message() {
+    return `LiteLLM.Model "${this.modelName}": the write of ${this.id} returned no error but the ` + "deployment is absent from the list and from the by-id read.";
+  }
+}
+
+class LitellmModelNotConvergedError extends Data6.TaggedError("LitellmModelNotConvergedError") {
+  get message() {
+    return `LiteLLM.Model "${this.modelName}": after the write, ${this.id} still differs from the ` + `declaration in ${this.fields.join(", ")}.`;
+  }
+}
+
+class LitellmModelForeignRowError extends Data6.TaggedError("LitellmModelForeignRowError") {
+  get message() {
+    const remedy = this.replace ? "It is the new identity of a replace, which --adopt does not cover: remove it first." : "Deploy with --adopt to take it over, or remove it first.";
+    return `LiteLLM.Model "${this.modelName}": the live row ${this.id} already exists and this stack ` + `holds no state for it. Nothing was written. ${remedy}`;
+  }
+}
+
+class LitellmModelPriorGenerationError extends Data6.TaggedError("LitellmModelPriorGenerationError") {
+  get message() {
+    return `LiteLLM.Model "${this.modelName}": the live row ${this.id} is an older generation still ` + `recorded on ${this.fqn}. Nothing was written. Taking it over would store that id on the ` + "in-flight replacement, and destroy() then deletes the old generation by the same id. " + "Drop this resource's state row (alchemy state rm, which leaves the deployment) and " + "deploy again with --adopt. Do not delete the live row.";
+  }
+}
+
+class LitellmModelConfigFileRowError extends Data6.TaggedError("LitellmModelConfigFileRowError") {
+  get message() {
+    return `LiteLLM.Model "${this.modelName}": the live row ${this.id} is served from the proxy's ` + "config file (db_model: false), not from the database, so the DB API cannot manage it. " + "Remove it from the config file first.";
+  }
+}
+
+// src/litellm/model-claim.ts
+import * as Effect33 from "effect/Effect";
+
+// src/ownership/adopting.ts
+import * as Effect32 from "effect/Effect";
+
+// src/ownership/probe.ts
+import { Unowned as Unowned12 } from "alchemy/AdoptPolicy";
+import * as Effect31 from "effect/Effect";
+var provenOurs = (ask, settled2) => Effect31.gen(function* () {
+  const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
+  if (recorded === "absent")
+    return false;
+  if (recorded === "partial") {
+    yield* Effect31.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    return false;
+  }
+  const unproven = (reason) => Effect31.as(Effect31.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  return yield* settled2.pipe(Effect31.catch(unproven), Effect31.catchDefect(unproven));
+});
+var ownedRead = (ask, found, settled2) => Effect31.gen(function* () {
+  if (found === undefined || ask.output !== undefined)
+    return found;
+  return (yield* provenOurs(ask, settled2)) ? found : Unowned12(found);
+});
+
+// src/ownership/adopting.ts
+var adopting = (owner, settled2) => Effect32.gen(function* () {
+  if (owner.output === undefined)
+    return false;
+  const generation = yield* recordedGeneration(owner.fqn, owner.instanceId);
+  if (generation === undefined || generation.adopting === true)
+    return true;
+  if (generation.attr !== undefined && generation.attr !== null)
+    return false;
+  return !(yield* provenOurs(owner, settled2(generation.props)));
+});
+
+// src/litellm/model-claim.ts
+var claimStatelessRow = (args) => Effect33.gen(function* () {
+  const older = yield* olderGenerationIds(args.fqn, args.instanceId);
+  if (older.includes(args.beforeId)) {
+    return yield* Effect33.fail(new LitellmModelPriorGenerationError({
+      fqn: args.fqn,
+      id: args.beforeId,
+      modelName: args.news.modelName
+    }));
+  }
+  const unpinned = args.news.id === undefined;
+  const ours = unpinned && args.beforeId === args.wanted;
+  const owner = { fqn: args.fqn, instanceId: args.instanceId, output: args.output };
+  const isAdoption = yield* adopting(owner, () => Effect33.succeed(false));
+  const creating = yield* isCreate(args.fqn, args.instanceId);
+  const mayAdopt = unpinned ? creating && (yield* adoptEnabled(args.fqn)) : yield* adoptsAtApply(owner);
+  if (!ours && !isAdoption && !mayAdopt) {
+    const replace = unpinned ? !creating : !creating && !(yield* unfinished(args.instanceId));
+    return yield* Effect33.fail(new LitellmModelForeignRowError({
+      id: args.beforeId,
+      modelName: args.news.modelName,
+      replace
+    }));
+  }
+});
+
+// src/litellm/model-types.ts
+var isBlank4 = (value5) => typeof value5 !== "string" || value5.trim() === "";
+var hasProviderPrefix = (model) => /^[a-z0-9_-]+\//i.test(model);
+
+// src/litellm/model-credential.ts
+var declaredValues = (props) => {
+  const values = { model: props.model };
+  if (props.apiBase !== undefined)
+    values["api_base"] = props.apiBase;
+  if (props.apiKey !== undefined)
+    values["api_key"] = `os.environ/${props.apiKey.fromEnv}`;
+  return values;
+};
+var sealFromValues = (values) => seal(values);
+var sealState = (props, sealed) => sealMatches(sealed, declaredValues(props)) ? "match" : "stale";
+
+// src/litellm/model-form.ts
+var firstProblem9 = (props) => {
+  if (isBlank4(props.modelName) || props.modelName !== props.modelName.trim()) {
+    return "`modelName` must be a non-empty string without leading or trailing whitespace";
+  }
+  if (props.id !== undefined && isBlank4(props.id)) {
+    return "`id` must be a non-empty string when declared";
+  }
+  if (isBlank4(props.model))
+    return "`model` must be a non-empty string";
+  if (!hasProviderPrefix(props.model)) {
+    return `\`model\` must carry a provider prefix, e.g. "xai/${props.model}": LiteLLM routes by it`;
+  }
+  if (props.model.toLowerCase().startsWith("openai/") && props.modelName.toLowerCase().startsWith("grok")) {
+    return '`model` must not use the "openai/" prefix on a grok group: Grok is xAI, declare "xai/…"';
+  }
+  if (props.apiBase !== undefined) {
+    const url = urlProblem(props.apiBase);
+    if (url !== undefined)
+      return url;
+  }
+  if (props.apiKey !== undefined && (typeof props.apiKey !== "object" || typeof props.apiKey.fromEnv !== "string")) {
+    return "`apiKey` takes `{ fromEnv: 'NAME' }`, never a value: the value would land in Alchemy's unencrypted state";
+  }
+  if (props.apiKey !== undefined && isBlank4(props.apiKey.fromEnv)) {
+    return "`apiKey.fromEnv` must name an environment variable";
+  }
+  return;
+};
+var declaredDigest = (props) => sealFromValues(declaredValues(props));
+var sameSet3 = (live, declared) => new Set(live).size === new Set(declared).size && declared.every((entry) => live.includes(entry));
+var differing10 = (live, props) => {
+  const out = [];
+  if (live.modelName !== props.modelName)
+    out.push("model_name");
+  if (live.model !== null && live.model !== props.model) {
+    out.push("model");
+  }
+  if (props.mode !== undefined && live.mode !== props.mode)
+    out.push("mode");
+  if (props.baseModel !== undefined && live.baseModel !== props.baseModel)
+    out.push("base_model");
+  if (!sameSet3(live.accessGroups, props.accessGroups ?? []))
+    out.push("access_groups");
+  return out;
+};
+var toAttributes11 = (row) => {
+  const info = row["model_info"] ?? {};
+  const params = row["litellm_params"];
+  const carriedModel = typeof params === "object" && params !== null ? params["model"] : undefined;
+  const id = row["id"] ?? info["id"];
+  return {
+    accessGroups: Array.isArray(info["access_groups"]) ? info["access_groups"].map(String) : [],
+    baseModel: typeof info["base_model"] === "string" ? info["base_model"] : null,
+    dbModel: info["db_model"] === false ? false : true,
+    id: String(id),
+    mode: typeof info["mode"] === "string" ? info["mode"] : null,
+    model: typeof carriedModel === "string" ? redactUrl(carriedModel) : null,
+    modelName: String(row["model_name"] ?? ""),
+    paramsSeal: ""
+  };
+};
+var LEAVE_ALONE_PARAMS = [
+  "allow_client_keepalive_override",
+  "merge_reasoning_content_in_choices",
+  "use_in_pass_through",
+  "use_litellm_proxy",
+  "use_xai_oauth"
+];
+var managedParams = (props) => {
+  const params = { model: props.model };
+  if (props.apiBase !== undefined)
+    params["api_base"] = props.apiBase;
+  if (props.apiKey !== undefined)
+    params["api_key"] = `os.environ/${props.apiKey.fromEnv}`;
+  return params;
+};
+var patchParams = (props) => ({
+  ...managedParams(props),
+  ...Object.fromEntries(LEAVE_ALONE_PARAMS.map((key) => [key, null]))
+});
+var modelInfoOf = (props) => ({
+  ...props.baseModel === undefined ? {} : { base_model: props.baseModel },
+  ...props.mode === undefined ? {} : { mode: props.mode },
+  access_groups: [...props.accessGroups ?? []],
+  id: null
+});
+var createBody10 = (props, modelId) => {
+  const body = {
+    litellm_params: managedParams(props),
+    model_info: { ...modelInfoOf(props), id: modelId },
+    model_name: props.modelName
+  };
+  return body;
+};
+var patchBody2 = (props, live) => {
+  const renamed = live.modelName !== props.modelName;
+  return {
+    model_id: live.id,
+    litellm_params: patchParams(props),
+    model_info: { ...modelInfoOf(props), id: live.id },
+    ...renamed ? { model_name: props.modelName } : {}
+  };
+};
+
+// src/litellm/model-locate.ts
+import { createPhysicalName as createPhysicalName5 } from "alchemy/PhysicalName";
+import * as Effect35 from "effect/Effect";
+
+// src/litellm/model-operations.ts
+import * as models from "@distilled.cloud/litellm/model_management";
+import * as Effect34 from "effect/Effect";
+var hasRowId = (row) => {
+  if (typeof row !== "object" || row === null)
+    return false;
+  const record = row;
+  const info = typeof record["model_info"] === "object" && record["model_info"] !== null ? record["model_info"] : {};
+  return typeof record["id"] === "string" || typeof info["id"] === "string";
+};
+var rowsOf = (response) => {
+  const rows = Array.isArray(response) ? response : Array.isArray(response?.data) ? response.data : response?.body;
+  return Array.isArray(rows) && rows.every(hasRowId) ? Effect34.succeed(rows.map(toAttributes11)) : Effect34.fail(new LitellmModelUnreadableError({
+    reason: Array.isArray(rows) ? "a row has no model id" : "not a list of deployments"
+  }));
+};
+var listModels = () => throughFetch(models.getModelInfoV1ModelInfo({})).pipe(Effect34.flatMap(rowsOf));
+var readModelRow = (modelId) => throughFetch(models.getModelInfoV1ModelInfo({ litellm_model_id: modelId })).pipe(Effect34.mapError((error) => error), Effect34.catchTag("NotFound", () => Effect34.succeed(undefined)), Effect34.catchTag("BadRequest", (error) => listModels().pipe(Effect34.flatMap((rows) => rows.some((row) => row.id === modelId) ? Effect34.fail(error) : Effect34.succeed(undefined)))), Effect34.flatMap((response) => response === undefined ? Effect34.succeed(undefined) : rowsOf(response).pipe(Effect34.map((rows) => rows.find((row) => row.id === modelId)))));
+var createModel = (body) => throughFetch(models.addNewModelModelNewPost(body)).pipe(Effect34.asVoid);
+var patchModel = (body) => throughFetch(models.patchModelModelModelIdUpdatePatch(body)).pipe(Effect34.asVoid);
+var deleteModel = (modelId) => throughFetch(models.deleteModelModelDeletePost({ id: modelId })).pipe(Effect34.asVoid, Effect34.catchTag("BadRequest", (original) => listModels().pipe(Effect34.flatMap((rows) => rows.some((row) => row.id === modelId) ? Effect34.fail(original) : Effect34.void))));
+
+// src/litellm/model-locate.ts
+var locate6 = (rows, props, output) => {
+  const pinned = output?.id ?? props.id;
+  if (pinned !== undefined)
+    return Effect35.succeed(rows.find((row) => row.id === pinned));
+  const named = rows.filter((row) => row.modelName === props.modelName);
+  return named.length > 1 ? Effect35.fail(new LitellmModelAmbiguousNameError({
+    ids: named.map((row) => row.id),
+    modelName: props.modelName
+  })) : Effect35.succeed(named[0]);
+};
+var wantedId2 = (id, instanceId, props, output) => output?.id !== undefined ? Effect35.succeed(output.id) : props.id !== undefined ? Effect35.succeed(props.id) : createPhysicalName5({ id, instanceId, lowercase: true, maxLength: 64 });
+var findLive2 = (id, instanceId, props, output) => Effect35.gen(function* () {
+  const listed = yield* locate6(yield* listModels(), props, output);
+  if (listed !== undefined)
+    return listed;
+  return yield* readModelRow(yield* wantedId2(id, instanceId, props, output));
+});
+
+// src/litellm/model.ts
+var LiteLLMModel = Resource11("LiteLLM.Model", {
+  defaultRemovalPolicy: "retain"
+});
+var isLiteLLMModel = (value5) => Predicate12.hasProperty(value5, "Type") && value5.Type === "LiteLLM.Model";
+var refuse3 = (props) => {
+  const problem = firstProblem9(props);
+  return problem === undefined ? Effect36.void : Effect36.fail(new LitellmModelInvalidError({ problem, modelName: String(props.modelName) }));
+};
+var modelHandlers = {
+  read: ({ id, instanceId, olds, output }) => Effect36.gen(function* () {
+    const problem = output === undefined ? firstProblem9(olds) : undefined;
+    if (problem !== undefined) {
+      return yield* Effect36.die(new LitellmModelInvalidError({ problem, modelName: String(olds.modelName) }));
+    }
+    const found = yield* findLive2(id, instanceId, olds, output);
+    if (found === undefined)
+      return;
+    if (output === undefined && olds.id === undefined) {
+      const physical = yield* createPhysicalName6({
+        id,
+        instanceId,
+        lowercase: true,
+        maxLength: 64
+      });
+      if (found.id === physical)
+        return found;
+    }
+    return output === undefined ? Unowned13(found) : { ...found, paramsSeal: output.paramsSeal };
+  }),
+  diff: ({
+    instanceId,
+    news,
+    output
+  }) => Effect36.gen(function* () {
+    if (!isResolved11(news))
+      return;
+    yield* refuse3(news);
+    if (output === undefined)
+      return yield* noteUnfinished(instanceId);
+    if (news.id !== undefined && news.id !== output.id) {
+      return { action: "replace", deleteFirst: false };
+    }
+    if (news.modelName !== output.modelName && news.id === undefined) {
+      return { action: "replace", deleteFirst: false };
+    }
+    return differing10(output, news).length === 0 && sealState(news, output.paramsSeal) === "match" ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({ fqn, id, instanceId, news, output }) => Effect36.gen(function* () {
+    yield* refuse3(news);
+    const before = yield* findLive2(id, instanceId, news, output);
+    let sealed = output?.paramsSeal ?? "";
+    let modelId;
+    if (before === undefined) {
+      const wanted = yield* wantedId2(id, instanceId, news, output);
+      yield* createModel(createBody10(news, wanted));
+      modelId = wanted;
+      sealed = declaredDigest(news);
+    } else {
+      if (before.dbModel === false) {
+        return yield* Effect36.fail(new LitellmModelConfigFileRowError({ id: before.id, modelName: news.modelName }));
+      }
+      const stateless = output === undefined || output.paramsSeal === "";
+      if (stateless) {
+        yield* claimStatelessRow({
+          beforeId: before.id,
+          fqn,
+          instanceId,
+          news,
+          output,
+          wanted: yield* wantedId2(id, instanceId, news, output)
+        });
+      }
+      modelId = before.id;
+      const drifted = differing10(before, news);
+      const sealStale = sealState(news, sealed) === "stale";
+      const sealNeedsStamp = sealStale && (sealed !== "" || news.apiKey !== undefined || news.apiBase !== undefined);
+      if (drifted.length > 0 || sealNeedsStamp) {
+        yield* patchModel(patchBody2(news, before));
+      }
+      if (drifted.length > 0 || sealStale)
+        sealed = declaredDigest(news);
+    }
+    const after = (yield* listModels()).find((row) => row.id === modelId) ?? (yield* readModelRow(modelId));
+    if (after === undefined) {
+      return yield* Effect36.fail(new LitellmModelAbsentAfterWriteError({ id: modelId, modelName: news.modelName }));
+    }
+    const left = differing10(after, news);
+    if (left.length > 0) {
+      return yield* Effect36.fail(new LitellmModelNotConvergedError({
+        fields: left,
+        id: modelId,
+        modelName: news.modelName
+      }));
+    }
+    return { ...after, paramsSeal: sealed };
+  }),
+  delete: ({ output }) => deleteModel(output.id),
+  list: () => Effect36.succeed([])
+};
+var LiteLLMModelProvider = () => Provider11.effect(LiteLLMModel, Effect36.succeed(LiteLLMModel.Provider.of(modelHandlers)));
+// src/litellm/key.ts
+import { Resource as Resource12 } from "alchemy";
+import { Unowned as Unowned14 } from "alchemy/AdoptPolicy";
+import { isResolved as isResolved12 } from "alchemy/Diff";
+import * as Provider12 from "alchemy/Provider";
+import * as Effect39 from "effect/Effect";
+import * as Predicate14 from "effect/Predicate";
+
+// src/litellm/key-errors.ts
+import * as Data7 from "effect/Data";
+
+class LitellmKeyValueRequiredError extends Data7.TaggedError("LitellmKeyValueRequiredError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}' does not exist and declares no \`key\`. Creating it would ` + 'mint a value nobody holds. Declare `key: { fromEnv: "NAME" }`, or adopt an existing key.';
+  }
+}
+
+class LitellmKeyDebugLoggingError extends Data7.TaggedError("LitellmKeyDebugLoggingError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': DISTILLED_DEBUG_HTTP is set, so the SDK would print the ` + "key to stderr in /key/generate's request and response. Unset it and run again. Nothing was written.";
+  }
+}
+
+class LitellmKeyTransportError extends Data7.TaggedError("LitellmKeyTransportError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': the /key/generate request failed (${this.reason}) before an ` + "answer could be read, so the key MAY have been created. This error keeps neither the request " + "nor its cause: the request body holds the key's value. Look for the alias in LiteLLM. A key " + "that landed is taken over by the next deploy with --adopt; one that did not is created by it.";
+  }
+}
+
+class LitellmKeyAliasEmptyError extends Data7.TaggedError("LitellmKeyAliasEmptyError") {
+  get message() {
+    return "LiteLLM.Key: keyAlias is empty. The alias is the key's identity. Nothing was written.";
+  }
+}
+
+class LitellmKeyValueMissingError extends Data7.TaggedError("LitellmKeyValueMissingError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': the environment variable ${this.variable} is unset or empty ` + "in the deploying process. Nothing was written.";
+  }
+}
+
+class LitellmKeyValueMalformedError extends Data7.TaggedError("LitellmKeyValueMalformedError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': the value of ${this.variable} is not usable — ${this.rule}. ` + "Nothing was written.";
+  }
+}
+
+class LitellmKeyValueNotHonouredError extends Data7.TaggedError("LitellmKeyValueNotHonouredError") {
+  get message() {
+    const outcome = this.removed ? "The row was deleted again." : "The row could NOT be deleted again: remove it by hand.";
+    return `LiteLLM.Key '${this.keyAlias}': /key/generate answered with a different value than the one ` + `sent, so the key would authenticate nobody. ${outcome}`;
+  }
+}
+
+class LitellmKeyValueMismatchError extends Data7.TaggedError("LitellmKeyValueMismatchError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': the value of ${this.variable} is not the key this alias ` + "holds. Nothing was written. /key/update cannot change a key value, so fix the variable or " + "drop the `key` and manage the existing key without one.";
+  }
+}
+
+class LitellmKeyAliasChangedError extends Data7.TaggedError("LitellmKeyAliasChangedError") {
+  get message() {
+    return `LiteLLM.Key alias changed from '${this.from}' to '${this.to}'. The alias is the key's ` + "identity and a rename would need the same value under a new row: declare the new alias as " + "a new resource and remove the old one with RemovalPolicy.destroy(). Nothing was written.";
+  }
+}
+
+class LitellmKeyAmbiguousAliasError extends Data7.TaggedError("LitellmKeyAmbiguousAliasError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': ${this.count} live keys carry this alias, so none can be ` + "called the declared one. Resolve the duplicates in LiteLLM first. Nothing was written.";
+  }
+}
+
+class LitellmKeyUnreadableError extends Data7.TaggedError("LitellmKeyUnreadableError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': /key/list did not answer full key rows (a hash list means ` + "return_full_object was ignored). Nothing was written.";
+  }
+}
+
+class LitellmKeyAbsentAfterWriteError extends Data7.TaggedError("LitellmKeyAbsentAfterWriteError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': the write returned no error but the alias is not listed.`;
+  }
+}
+
+class LitellmKeyFieldNotAppliedError extends Data7.TaggedError("LitellmKeyFieldNotAppliedError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': the write returned no error but ${this.fields.join(", ")} ` + "still differ from the declaration.";
+  }
+}
+
+// src/litellm/key-form.ts
+import * as Redacted5 from "effect/Redacted";
+
+// src/litellm/key-metadata.ts
+import { deepEqual as deepEqual2 } from "alchemy/Diff";
+var CALLBACK_SLOTS = ["callback_settings", "logging", "secret_manager_settings"];
+var isObject = (value5) => typeof value5 === "object" && value5 !== null && !Array.isArray(value5);
+var callbackSlotsIn = (metadata) => metadata === undefined ? [] : CALLBACK_SLOTS.filter((slot) => Object.hasOwn(metadata, slot));
+var splitMetadata = (raw) => {
+  if (!isObject(raw))
+    return { metadata: {}, withheld: [] };
+  const withheld = callbackSlotsIn(raw);
+  return {
+    metadata: Object.fromEntries(Object.entries(raw).filter(([name]) => !withheld.includes(name))),
+    withheld
+  };
+};
+var metadataDiffers = (live, declared) => declared !== undefined && Object.entries(declared).some(([name, value5]) => !deepEqual2(live[name], value5));
+var mergedMetadata = (live, declared) => ({
+  ...live,
+  ...declared
+});
+
+// src/litellm/key-form.ts
+var sameSet4 = (a, b) => {
+  const left = [...a].sort();
+  const right = [...b].sort();
+  return left.length === right.length && left.every((value6, i) => value6 === right[i]);
+};
+var expiryDiffers = (live, wanted) => live.duration !== wanted || wanted === null !== (live.expires === null);
+var differing11 = (live, props) => {
+  const out = [];
+  if (props.budgetId !== undefined && live.budgetId !== props.budgetId)
+    out.push("budget_id");
+  if (props.models !== undefined && !sameSet4(live.models, props.models))
+    out.push("models");
+  if (props.allowedRoutes !== undefined && !sameSet4(live.allowedRoutes, props.allowedRoutes)) {
+    out.push("allowed_routes");
+  }
+  if (props.teamId !== undefined && live.teamId !== props.teamId)
+    out.push("team_id");
+  if (metadataDiffers(live.metadata, props.metadata))
+    out.push("metadata");
+  if (props.duration !== undefined && expiryDiffers(live, props.duration))
+    out.push("duration");
+  return out;
+};
+var createBody11 = (props, secret) => {
+  const body = {
+    key: Redacted5.value(secret),
+    key_alias: props.keyAlias
+  };
+  if (typeof props.budgetId === "string")
+    body.budget_id = props.budgetId;
+  if (props.models !== undefined)
+    body.models = [...props.models];
+  if (props.allowedRoutes !== undefined)
+    body.allowed_routes = [...props.allowedRoutes];
+  if (typeof props.teamId === "string")
+    body.team_id = props.teamId;
+  if (props.metadata !== undefined)
+    body.metadata = { ...props.metadata };
+  if (typeof props.duration === "string")
+    body.duration = props.duration;
+  return body;
+};
+var updateBody9 = (props, live) => {
+  const body = { key_alias: live.keyAlias };
+  for (const field of differing11(live, props)) {
+    if (field === "budget_id")
+      body.budget_id = props.budgetId ?? null;
+    if (field === "models")
+      body.models = [...props.models ?? []];
+    if (field === "allowed_routes")
+      body.allowed_routes = [...props.allowedRoutes ?? []];
+    if (field === "team_id")
+      body.team_id = props.teamId ?? null;
+    if (field === "metadata")
+      body.metadata = { ...mergedMetadata(live.metadata, props.metadata) };
+    if (field === "duration")
+      body.duration = props.duration ?? null;
+  }
+  return body;
+};
+var strings = (value6) => Array.isArray(value6) ? value6.filter((item) => typeof item === "string") : [];
+var stringOrNull2 = (value6) => typeof value6 === "string" ? value6 : null;
+var toAttributes12 = (row) => {
+  const { metadata, withheld } = splitMetadata(row["metadata"]);
+  return {
+    allowedRoutes: strings(row["allowed_routes"]),
+    budgetId: stringOrNull2(row["budget_id"]),
+    duration: null,
+    expires: stringOrNull2(row["expires"]),
+    keyAlias: String(row["key_alias"]),
+    metadata,
+    models: strings(row["models"]),
+    teamId: stringOrNull2(row["team_id"]),
+    withheld
+  };
+};
+
+// src/litellm/key-metadata-errors.ts
+import * as Data8 from "effect/Data";
+
+class LitellmKeyCallbackMetadataDeclaredError extends Data8.TaggedError("LitellmKeyCallbackMetadataDeclaredError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': metadata declares ${this.slots.join(", ")}, which carry ` + "callback credentials. LiteLLM stores them encrypted, so they would never read back equal, " + "and Alchemy state is unencrypted. Configure the key's logging in LiteLLM itself. Nothing was written.";
+  }
+}
+
+class LitellmKeyCallbackMetadataLiveError extends Data8.TaggedError("LitellmKeyCallbackMetadataLiveError") {
+  get message() {
+    return `LiteLLM.Key '${this.keyAlias}': the live key holds ${this.slots.join(", ")} in its metadata ` + "(callback credentials this resource never reads), and /key/update replaces the whole " + "metadata, so writing the declared metadata would strip them. Change that metadata in LiteLLM, " + "or stop declaring metadata for this key. Nothing was written.";
+  }
+}
+
+// src/litellm/key-operations.ts
+import * as keys from "@distilled.cloud/litellm/key_management";
+import * as Effect37 from "effect/Effect";
+import * as Predicate13 from "effect/Predicate";
+import { isHttpClientError as isHttpClientError2 } from "effect/unstable/http/HttpClientError";
+var findKey = (keyAlias) => keyAlias.trim() === "" ? Effect37.fail(new LitellmKeyAliasEmptyError) : findKeyByAlias(keyAlias);
+var findKeyByAlias = (keyAlias) => findKeyRowByAlias(keyAlias).pipe(Effect37.map((row) => row === undefined ? undefined : toAttributes12(row)));
+var findKeyRowByAlias = (keyAlias) => throughFetch(keys.listKeysKeyListGet({ key_alias: keyAlias, return_full_object: true })).pipe(Effect37.flatMap((response) => Effect37.gen(function* () {
+  const rows = response.keys ?? [];
+  if (rows.some((row) => typeof row !== "object" || row === null)) {
+    return yield* new LitellmKeyUnreadableError({ keyAlias });
+  }
+  const mine = rows.filter((row) => row["key_alias"] === keyAlias);
+  if (mine.length > 1) {
+    return yield* new LitellmKeyAmbiguousAliasError({ count: mine.length, keyAlias });
+  }
+  return mine[0];
+})));
+var readKeyToken = (keyAlias) => keyAlias.trim() === "" ? Effect37.fail(new LitellmKeyAliasEmptyError) : findKeyRowByAlias(keyAlias).pipe(Effect37.map((row) => row === undefined ? undefined : typeof row["token"] === "string" ? row["token"] : null));
+var carriesRequest2 = (value6) => isHttpClientError2(value6) || Predicate13.hasProperty(value6, "request");
+var generateKey = (body) => {
+  const keyAlias = body.key_alias ?? "";
+  return throughFetch(keys.generateKeyFnKeyGeneratePost(body)).pipe(Effect37.catchTag("HttpClientError", (error) => Effect37.fail(new LitellmKeyTransportError({ keyAlias, reason: error.reason._tag }))), Effect37.catchDefect((defect) => carriesRequest2(defect) ? Effect37.fail(new LitellmKeyTransportError({
+    keyAlias,
+    reason: isHttpClientError2(defect) ? defect.reason._tag : "Defect"
+  })) : Effect37.die(defect)));
+};
+var updateKey = (body) => throughFetch(keys.updateKeyFnKeyUpdatePost(body)).pipe(Effect37.asVoid);
+var deleteKey = (keyAlias) => findKey(keyAlias).pipe(Effect37.flatMap((live) => live === undefined ? Effect37.void : throughFetch(keys.deleteKeyFnKeyDeletePost({ key_aliases: [keyAlias] })).pipe(Effect37.asVoid, Effect37.catchTag("KeyNotFound", (original) => findKey(keyAlias).pipe(Effect37.flatMap((still) => still === undefined ? Effect37.void : Effect37.fail(original)))))));
+
+// src/litellm/key-secret.ts
+import { createHash } from "node:crypto";
+import * as Effect38 from "effect/Effect";
+import * as Redacted6 from "effect/Redacted";
+var PREFIX2 = "sk-";
+var MIN_LENGTH = 16;
+var RULE = `a user-defined key must start with '${PREFIX2}', be at least ${MIN_LENGTH} characters and contain no whitespace`;
+var resolveKeyValue = (keyAlias, ref) => Effect38.gen(function* () {
+  if (ref === undefined)
+    return yield* new LitellmKeyValueRequiredError({ keyAlias });
+  const variable = ref.fromEnv;
+  const value7 = resolveAll({ key: ref }).values["key"];
+  if (value7 === undefined)
+    return yield* new LitellmKeyValueMissingError({ keyAlias, variable });
+  if (!value7.startsWith(PREFIX2) || value7.length < MIN_LENGTH || /\s/.test(value7)) {
+    return yield* new LitellmKeyValueMalformedError({ keyAlias, rule: RULE, variable });
+  }
+  return Redacted6.make(value7);
+});
+var echoes = (returned, sent) => (Redacted6.isRedacted(returned) ? Redacted6.value(returned) : returned) === Redacted6.value(sent);
+var sha256 = (value7) => createHash("sha256").update(value7).digest("hex");
+var verifyKeyValue = (keyAlias, ref, token) => Effect38.gen(function* () {
+  if (ref === undefined)
+    return;
+  const variable = ref.fromEnv;
+  const value7 = resolveAll({ key: ref }).values["key"];
+  if (value7 === undefined)
+    return;
+  if (token === null || sha256(value7) !== token) {
+    return yield* new LitellmKeyValueMismatchError({ keyAlias, variable });
+  }
+});
+var refuseDebugLogging2 = (keyAlias) => (globalThis.process?.env?.["DISTILLED_DEBUG_HTTP"] ?? "") !== "" ? Effect38.fail(new LitellmKeyDebugLoggingError({ keyAlias })) : Effect38.void;
+var hasKeyValue = (ref) => ref !== undefined && resolveAll({ key: ref }).values["key"] !== undefined;
+
+// src/litellm/key.ts
+var LiteLLMKey = Resource12("LiteLLM.Key", { defaultRemovalPolicy: "retain" });
+var isLiteLLMKey = (value7) => Predicate14.hasProperty(value7, "Type") && value7.Type === "LiteLLM.Key";
+var remembering = (live, output) => ({
+  ...live,
+  duration: output?.duration ?? null
+});
+var remembered = (news, before) => news.duration !== undefined ? news.duration : before?.duration ?? null;
+var refuseMetadata = (news, live) => Effect39.gen(function* () {
+  const declared = callbackSlotsIn(news.metadata);
+  if (declared.length > 0) {
+    return yield* new LitellmKeyCallbackMetadataDeclaredError({
+      keyAlias: news.keyAlias,
+      slots: declared
+    });
+  }
+  if (live !== undefined && live.withheld.length > 0 && differing11(live, news).includes("metadata")) {
+    return yield* new LitellmKeyCallbackMetadataLiveError({
+      keyAlias: news.keyAlias,
+      slots: live.withheld
+    });
+  }
+});
+var createKey = (news) => Effect39.gen(function* () {
+  yield* refuseDebugLogging2(news.keyAlias);
+  const secret = yield* resolveKeyValue(news.keyAlias, news.key);
+  const created = yield* generateKey(createBody11(news, secret));
+  if (echoes(created.key, secret))
+    return;
+  const removed = yield* deleteKey(news.keyAlias).pipe(Effect39.as(true), Effect39.orElseSucceed(() => false));
+  return yield* new LitellmKeyValueNotHonouredError({ keyAlias: news.keyAlias, removed });
+});
+var keyHandlers = {
+  read: ({ olds, output }) => Effect39.gen(function* () {
+    const live = yield* findKey(output?.keyAlias ?? olds.keyAlias);
+    if (live === undefined)
+      return;
+    return output === undefined ? Unowned14(live) : remembering(live, output);
+  }),
+  diff: ({ news, output }) => Effect39.gen(function* () {
+    if (!isResolved12(news))
+      return;
+    yield* refuseMetadata(news, output);
+    if (output === undefined)
+      return;
+    if (news.keyAlias !== output.keyAlias) {
+      return yield* new LitellmKeyAliasChangedError({ from: output.keyAlias, to: news.keyAlias });
+    }
+    if (hasKeyValue(news.key)) {
+      const token = yield* readKeyToken(news.keyAlias);
+      if (token === undefined)
+        return { action: "update" };
+      yield* verifyKeyValue(news.keyAlias, news.key, token);
+    }
+    return differing11(output, news).length === 0 ? { action: "noop" } : { action: "update" };
+  }),
+  reconcile: ({
+    fqn,
+    instanceId,
+    news,
+    output
+  }) => Effect39.gen(function* () {
+    const alias = news.keyAlias;
+    yield* refuseMetadata(news, undefined);
+    const found = yield* findKey(alias);
+    const before = found === undefined ? undefined : remembering(found, output);
+    if (before === undefined) {
+      yield* createKey(news);
+    } else {
+      yield* refuseTakeover({ fqn, instanceId, output }, `LiteLLM.Key ${alias}`);
+      if (hasKeyValue(news.key)) {
+        yield* verifyKeyValue(alias, news.key, (yield* readKeyToken(alias)) ?? null);
+      }
+      yield* refuseMetadata(news, before);
+      if (differing11(before, news).length > 0)
+        yield* updateKey(updateBody9(news, before));
+    }
+    const after = yield* findKey(alias);
+    if (after === undefined)
+      return yield* new LitellmKeyAbsentAfterWriteError({ keyAlias: alias });
+    const settled2 = { ...after, duration: remembered(news, before) };
+    const left = differing11(settled2, news);
+    if (left.length > 0) {
+      return yield* new LitellmKeyFieldNotAppliedError({ fields: left, keyAlias: alias });
+    }
+    return settled2;
+  }),
+  delete: ({ output }) => deleteKey(output.keyAlias),
+  list: () => Effect39.succeed([])
+};
+var LiteLLMKeyProvider = () => Provider12.effect(LiteLLMKey, Effect39.succeed(LiteLLMKey.Provider.of(keyHandlers)));
 // src/litellm/providers.ts
 import { CredentialsFromEnv } from "@distilled.cloud/litellm/Credentials";
 import * as Layer from "effect/Layer";
-var litellmProviders = (creds = CredentialsFromEnv) => Layer.mergeAll(LiteLLMPassThroughEndpointProvider(), LiteLLMBudgetProvider()).pipe(Layer.provideMerge(creds));
+var litellmProviders = (creds = CredentialsFromEnv) => Layer.mergeAll(LiteLLMPassThroughEndpointProvider(), LiteLLMBudgetProvider(), LiteLLMCredentialProvider(), LiteLLMMCPServerProvider(), LiteLLMAccessGroupProvider(), LiteLLMToolsetProvider(), LiteLLMToolPolicyProvider(), LiteLLMPolicyProvider(), LiteLLMPolicyAttachmentProvider(), LiteLLMTeamProvider(), LiteLLMKeyProvider(), LiteLLMModelProvider()).pipe(Layer.provideMerge(creds));
 export {
+  LiteLLMAccessGroup,
+  LiteLLMAccessGroupProvider,
   LiteLLMBudget,
   LiteLLMBudgetProvider,
+  LiteLLMCredential,
+  LiteLLMCredentialProvider,
+  LiteLLMKey,
+  LiteLLMKeyProvider,
+  LiteLLMMCPServer,
+  LiteLLMMCPServerProvider,
+  LiteLLMModel,
+  LiteLLMModelProvider,
   LiteLLMPassThroughEndpoint,
   LiteLLMPassThroughEndpointProvider,
+  LiteLLMPolicy,
+  LiteLLMPolicyAttachment,
+  LiteLLMPolicyAttachmentProvider,
+  LiteLLMPolicyProvider,
+  LiteLLMTeam,
+  LiteLLMTeamProvider,
+  LiteLLMToolPolicy,
+  LiteLLMToolPolicyProvider,
+  LiteLLMToolset,
+  LiteLLMToolsetProvider,
   LitellmBudgetFieldNotClearedError,
   LitellmBudgetHardCapUnjustifiedError,
   LitellmBudgetUnreadableError,
   LitellmConfigPathConflictError,
+  LitellmCredentialAbsentAfterWriteError,
+  LitellmCredentialEnvUnsetError,
+  LitellmCredentialInvalidError,
+  LitellmCredentialNotConvergedError,
+  LitellmCredentialUnreadableError,
+  LitellmKeyAbsentAfterWriteError,
+  LitellmKeyAliasChangedError,
+  LitellmKeyAliasEmptyError,
+  LitellmKeyAmbiguousAliasError,
+  LitellmKeyCallbackMetadataDeclaredError,
+  LitellmKeyCallbackMetadataLiveError,
+  LitellmKeyDebugLoggingError,
+  LitellmKeyFieldNotAppliedError,
+  LitellmKeyTransportError,
+  LitellmKeyUnreadableError,
+  LitellmKeyValueMalformedError,
+  LitellmKeyValueMissingError,
+  LitellmKeyValueNotHonouredError,
+  LitellmKeyValueRequiredError,
   LitellmLiteralSecretHeaderError,
+  LitellmMcpServerAbsentAfterWriteError,
+  LitellmMcpServerAmbiguousNameError,
+  LitellmMcpServerCredentialEnvUnsetError,
+  LitellmMcpServerDescriptionShadowedError,
+  LitellmMcpServerInvalidError,
+  LitellmMcpServerNotConvergedError,
+  LitellmMcpServerUnreadableError,
+  LitellmModelAbsentAfterWriteError,
+  LitellmModelAmbiguousNameError,
+  LitellmModelConfigFileRowError,
+  LitellmModelForeignRowError,
+  LitellmModelInvalidError,
+  LitellmModelNotConvergedError,
+  LitellmModelPriorGenerationError,
+  LitellmModelUnreadableError,
+  LitellmRegistryAbsentAfterWriteError,
+  LitellmRegistryAmbiguousError,
+  LitellmRegistryInvalidError,
+  LitellmRegistryNotConvergedError,
+  LitellmRegistryUnreadableError,
   LitellmUnaddressableRowError,
+  isLiteLLMAccessGroup,
   isLiteLLMBudget,
+  isLiteLLMCredential,
+  isLiteLLMKey,
+  isLiteLLMMCPServer,
+  isLiteLLMModel,
   isLiteLLMPassThroughEndpoint,
+  isLiteLLMPolicy,
+  isLiteLLMPolicyAttachment,
+  isLiteLLMTeam,
+  isLiteLLMToolPolicy,
+  isLiteLLMToolset,
   litellmProviders
 };
 
-//# debugId=0E62C0ABB834992A64756E2164756E21
+//# debugId=2E47E5AC1835F31A64756E2164756E21
 //# sourceMappingURL=index.js.map