@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/litellm/key-errors.d.ts

@@ -0,0 +1,169 @@
+/**
+ * The typed refusals `LiteLLM.Key` raises on top of `@distilled.cloud/litellm`'s own SDK errors.
+ *
+ * ⛔ NOT ONE OF THESE CARRIES A KEY VALUE. They name the alias, the environment VARIABLE and the
+ *   rule broken, never what the variable held: an error is logged, retried and pasted into a PR.
+ *   The SDK's own errors are the other half: `generateKey` (key-operations.ts) turns the one that
+ *   holds the request, and so the value, into `LitellmKeyTransportError` below.
+ */
+import type * as keys from '@distilled.cloud/litellm/key_management';
+import type { HttpClientErrorReason } from 'effect/unstable/http/HttpClientError';
+import type { LitellmKeyCallbackMetadataDeclaredError, LitellmKeyCallbackMetadataLiveError } from './key-metadata-errors.ts';
+declare const LitellmKeyValueRequiredError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyValueRequiredError";
+} & Readonly<A>;
+/** A create is needed and the declaration names no `key` — LiteLLM would mint a value nobody holds. */
+export declare class LitellmKeyValueRequiredError extends LitellmKeyValueRequiredError_base<{
+    readonly keyAlias: string;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyDebugLoggingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyDebugLoggingError";
+} & Readonly<A>;
+/**
+ * distilled prints request and response BODIES to stderr while `DISTILLED_DEBUG_HTTP` is set, and
+ * `/key/generate` carries the key in both. Refused before any request, as `fetchMeshNodeToken` does.
+ */
+export declare class LitellmKeyDebugLoggingError extends LitellmKeyDebugLoggingError_base<{
+    readonly keyAlias: string;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyTransportError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyTransportError";
+} & Readonly<A>;
+/**
+ * `/key/generate` failed on the wire (or its answer could not be read), so nobody knows whether the
+ * key exists.
+ *
+ * ⛔ THIS IS WHAT STANDS IN FOR AN `HttpClientError`, WHICH CARRIES ITS REQUEST, AND THE REQUEST BODY
+ *   OF `/key/generate` IS `{"key":"sk-…"}`. Measured 2026-09-29 with a synthetic value: on a dropped
+ *   connection `JSON.stringify(error)`, `Bun.inspect(error, { depth: 10 })` and Effect's JSON logger
+ *   all printed the key, and so did the failure of a deploy over it. A defect from reading a broken
+ *   answer (`protocol-rest.ts` reads it with `Effect.orDie`) carries the same request. So `reason` is
+ *   the `HttpClientError` reason's TAG (a string) and nothing else is kept: no request, no cause, no
+ *   description (a cause is free text from `fetch`).
+ */
+export declare class LitellmKeyTransportError extends LitellmKeyTransportError_base<{
+    readonly keyAlias: string;
+    readonly reason: HttpClientErrorReason['_tag'] | 'Defect';
+}> {
+    get message(): string;
+}
+declare const LitellmKeyAliasEmptyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyAliasEmptyError";
+} & Readonly<A>;
+/** An empty alias: `/key/list` would read `key_alias=` as no filter, and nothing could find the key again. */
+export declare class LitellmKeyAliasEmptyError extends LitellmKeyAliasEmptyError_base<{}> {
+    get message(): string;
+}
+declare const LitellmKeyValueMissingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyValueMissingError";
+} & Readonly<A>;
+/** `key: { fromEnv }` names a variable the deploying process does not have (or has empty). */
+export declare class LitellmKeyValueMissingError extends LitellmKeyValueMissingError_base<{
+    readonly keyAlias: string;
+    readonly variable: string;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyValueMalformedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyValueMalformedError";
+} & Readonly<A>;
+/** The variable's value breaks the rule `/key/generate` states for a user-defined key. */
+export declare class LitellmKeyValueMalformedError extends LitellmKeyValueMalformedError_base<{
+    readonly keyAlias: string;
+    readonly variable: string;
+    readonly rule: string;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyValueNotHonouredError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyValueNotHonouredError";
+} & Readonly<A>;
+/**
+ * `/key/generate` answered with a different value than the one sent, so the row exists under a
+ * key nobody holds. `removed` says whether the row was deleted again on the way out.
+ */
+export declare class LitellmKeyValueNotHonouredError extends LitellmKeyValueNotHonouredError_base<{
+    readonly keyAlias: string;
+    readonly removed: boolean;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyValueMismatchError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyValueMismatchError";
+} & Readonly<A>;
+/**
+ * An ADOPTED key was declared with a `key` whose value is not the key the live row holds. The
+ * value is compared only as a sha256 in memory against the row's `token` (`hash_token`, the
+ * vendor's own store) — never in state, never in an error — and a mismatch is refused, because a
+ * seat that reads the same variable would hold a key that authenticates nothing while the plan
+ * reported success. `/key/update` cannot change a key's value (`prepare_key_update_data` pops
+ * `key`), so there is nothing to write: the operator must fix the variable or drop the `key`.
+ */
+export declare class LitellmKeyValueMismatchError extends LitellmKeyValueMismatchError_base<{
+    readonly keyAlias: string;
+    readonly variable: string;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyAliasChangedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyAliasChangedError";
+} & Readonly<A>;
+/**
+ * The alias is the identity: `/key/update` and `/key/delete` find a key by it, and this resource
+ * never holds the value that could find it any other way. A different alias is a different key.
+ */
+export declare class LitellmKeyAliasChangedError extends LitellmKeyAliasChangedError_base<{
+    readonly from: string;
+    readonly to: string;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyAmbiguousAliasError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyAmbiguousAliasError";
+} & Readonly<A>;
+/** More than one live key carries the alias, so nothing can say which one is declared. */
+export declare class LitellmKeyAmbiguousAliasError extends LitellmKeyAmbiguousAliasError_base<{
+    readonly keyAlias: string;
+    readonly count: number;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyUnreadableError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyUnreadableError";
+} & Readonly<A>;
+/** `/key/list` answered something that is not a list of key rows. */
+export declare class LitellmKeyUnreadableError extends LitellmKeyUnreadableError_base<{
+    readonly keyAlias: string;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyAbsentAfterWriteError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyAbsentAfterWriteError";
+} & Readonly<A>;
+/** A write returned no error but the alias is not listed afterwards. */
+export declare class LitellmKeyAbsentAfterWriteError extends LitellmKeyAbsentAfterWriteError_base<{
+    readonly keyAlias: string;
+}> {
+    get message(): string;
+}
+declare const LitellmKeyFieldNotAppliedError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyFieldNotAppliedError";
+} & Readonly<A>;
+/**
+ * The write returned no error but the row still differs from the declaration. `/key/update` is a
+ * merge patch (its docstring), so this is a proxy that did not apply a field — refused, never
+ * reported as done.
+ */
+export declare class LitellmKeyFieldNotAppliedError extends LitellmKeyFieldNotAppliedError_base<{
+    readonly keyAlias: string;
+    readonly fields: readonly string[];
+}> {
+    get message(): string;
+}
+export type KeyError = keys.ListKeysKeyListGetError | keys.GenerateKeyFnKeyGeneratePostError | keys.UpdateKeyFnKeyUpdatePostError | keys.DeleteKeyFnKeyDeletePostError | LitellmKeyDebugLoggingError | LitellmKeyTransportError | LitellmKeyAliasEmptyError | LitellmKeyValueRequiredError | LitellmKeyValueMissingError | LitellmKeyValueMalformedError | LitellmKeyValueNotHonouredError | LitellmKeyValueMismatchError | LitellmKeyAliasChangedError | LitellmKeyAmbiguousAliasError | LitellmKeyCallbackMetadataDeclaredError | LitellmKeyCallbackMetadataLiveError | LitellmKeyUnreadableError | LitellmKeyAbsentAfterWriteError | LitellmKeyFieldNotAppliedError;
+export {};
+//# sourceMappingURL=key-errors.d.ts.map

package/dist/litellm/key-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-errors.d.ts","sourceRoot":"","sources":["../../src/litellm/key-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,yCAAyC,CAAC;AAErE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,KAAK,EACV,uCAAuC,EACvC,mCAAmC,EACpC,MAAM,0BAA0B,CAAC;;;;AAElC,uGAAuG;AACvG,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;CAC3D,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,8GAA8G;AAC9G,qBAAa,yBAA0B,SAAQ,+BAA8C,EAAE,CAAC;IAC9F,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,8FAA8F;AAC9F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,0FAA0F;AAC1F,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;GAGG;AACH,qBAAa,+BAAgC,SAAQ,qCAEnD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,0FAA0F;AAC1F,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,qEAAqE;AACrE,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,wEAAwE;AACxE,qBAAa,+BAAgC,SAAQ,qCAEnD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;AAED,MAAM,MAAM,QAAQ,GAChB,IAAI,CAAC,uBAAuB,GAC5B,IAAI,CAAC,iCAAiC,GACtC,IAAI,CAAC,6BAA6B,GAClC,IAAI,CAAC,6BAA6B,GAClC,2BAA2B,GAC3B,wBAAwB,GACxB,yBAAyB,GACzB,4BAA4B,GAC5B,2BAA2B,GAC3B,6BAA6B,GAC7B,+BAA+B,GAC/B,4BAA4B,GAC5B,2BAA2B,GAC3B,6BAA6B,GAC7B,uCAAuC,GACvC,mCAAmC,GACnC,yBAAyB,GACzB,+BAA+B,GAC/B,8BAA8B,CAAC"}

package/dist/litellm/key-form.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Props, attributes, wire bodies and comparison for `LiteLLM.Key`, testable without a server.
+ *
+ * ⛔ THERE IS NO SECRET IN THIS FILE'S OUTPUT. `KeyAttributes` has no `key`, no `token` and no hash:
+ *   `/key/list` rows carry `token` (LiteLLM's hash of the key) and `toAttributes` drops it, because
+ *   attributes are persisted unencrypted (key-secret.ts). The value is unwrapped in `createBody`, at
+ *   the last moment before the wire, and compared with a live row only as a sha256 in memory
+ *   (`verifyKeyValue`, key-secret.ts) against the raw row's `token` — the hash itself never reaches
+ *   state. The callback slots of `metadata` are dropped too (key-metadata.ts).
+ * ★ THE ROW IS READ THROUGH `/key/list?key_alias=…&return_full_object=true`. Measured 2026-09-28
+ *   (litellm-key-access): a bare list and `get_key` come back with `models: []` for keys whose real
+ *   allowlist lives in the full object. The generated `UserAPIKeyAuth` row declares every column
+ *   compared here (`budget_id`, `models`, `allowed_routes`, `team_id`, `metadata`, `expires`).
+ * ⛔ A DECLARATION MANAGES ONLY WHAT IT NAMES. An omitted `budgetId`, `models`, `allowedRoutes`,
+ *   `teamId` or `duration` is neither compared nor sent, so a live value stays. Reading omission as
+ *   "clear it" FAILS OPEN on a credential: `[]` is "all models" and "no route restriction" to
+ *   LiteLLM, and no budget drops the tier's limits. On an adopted key (whose plan says `adopted`, never
+ *   what the apply will write, and which `--adopt` given for another resource takes over too) that
+ *   would widen a live key without the plan ever showing an `update`. Clearing is an explicit
+ *   declaration: `models: []`, `allowedRoutes: []`, `budgetId: null`, `teamId: null`, `duration: null`.
+ *   `/key/update` is a merge patch for the COLUMNS (its docstring), so an unsent one is left as it is.
+ * ⛔ `metadata` IS A MERGE, NOT A COLUMN OF THE DECLARER'S: LiteLLM keeps guardrails, per-model limits
+ *   and more inside it, and `/key/update` replaces it wholesale. See key-metadata.ts.
+ * ⚠️ NOT MODELLED, so a declaration of them could never be diffed: `max_budget`, `soft_budget`,
+ *   `object_permission`, `blocked`, `spend`, and the top-level rate limits. Bind a `LiteLLM.Budget`
+ *   for limits. The ones that live in `metadata` (guardrails, tags, `model_rpm_limit`, …) are left
+ *   alone by the merge, and can be declared as `metadata` keys.
+ */
+import type * as keys from '@distilled.cloud/litellm/key_management';
+import * as Redacted from 'effect/Redacted';
+import type { FromEnv } from '../secrets/write-only.ts';
+import { type Metadata } from './key-metadata.ts';
+export interface KeyProps {
+    /** The alias LiteLLM knows the key by: its identity, unique per proxy. Declare an existing key's alias to adopt it. */
+    readonly keyAlias: string;
+    /**
+     * The key's VALUE, by the NAME of the environment variable holding it (`{ fromEnv: 'SEAT_KEY' }`).
+     * Write-only and create-only: required to create the key, never stored. On an EXISTING key a
+     * declared value is compared with the row in memory only (sha256 against the row's `token`), and a
+     * mismatch is refused — `/key/update` cannot change a key's value. Omit it to manage an existing
+     * key's settings without ever holding its value.
+     */
+    readonly key?: FromEnv;
+    /**
+     * The `LiteLLM.Budget` tier the key binds to (`budget.budgetId`, so the tier is created first).
+     * Omitted = not managed, a live binding stays. `null` = unbind, which drops the tier's limits.
+     */
+    readonly budgetId?: string | null;
+    /**
+     * Model names the key may call. Omitted = not managed, a live scope stays (a NEW key then starts
+     * with LiteLLM's default). `[]` = ALL models, LiteLLM's reading: declared on a scoped key it WIDENS it.
+     */
+    readonly models?: readonly string[];
+    /**
+     * Routes the key may call, exact or wildcard (`/chat/completions`, `/v1/*`). Omitted = not
+     * managed. `[]` = no route restriction: declared on a restricted key it WIDENS it.
+     */
+    readonly allowedRoutes?: readonly string[];
+    /** The team the key belongs to. Omitted = not managed. `null` = detach. */
+    readonly teamId?: string | null;
+    /**
+     * The `metadata` keys this declaration manages, a MERGE (key-metadata.ts): other live keys are
+     * carried, never removed, and a key is cleared by declaring it `null`. Stored in state, so no
+     * secrets. `logging`, `callback_settings` and `secret_manager_settings` are refused.
+     */
+    readonly metadata?: Metadata;
+    /**
+     * Validity from creation: `'30s'`, `'30m'`, `'30h'`, `'30d'`. Omitted = not managed (a live expiry
+     * stays; a new key never expires). `null` = never expires, which clears a live expiry.
+     */
+    readonly duration?: string | null;
+}
+export interface KeyAttributes {
+    readonly keyAlias: string;
+    readonly budgetId: string | null;
+    readonly models: readonly string[];
+    readonly allowedRoutes: readonly string[];
+    readonly teamId: string | null;
+    /** The row's `metadata` WITHOUT the callback slots (`withheld`): those carry secret keys and state is unencrypted. */
+    readonly metadata: Metadata;
+    /**
+     * The `duration` this provider last WROTE. The row carries only `expires`, an absolute time, so
+     * the declared duration cannot be read back; state remembers it. `null` for an adopted row.
+     */
+    readonly duration: string | null;
+    /** When the key stops authenticating, as the row says. Observed, never declared. */
+    readonly expires: string | null;
+    /**
+     * The NAMES of the `metadata` callback slots the row has and this resource never reads. A metadata
+     * write is refused while any is present: `/key/update` replaces the column and could not carry them.
+     */
+    readonly withheld: readonly string[];
+}
+/**
+ * Wire names of the fields the declaration NAMES where the live row disagrees. An omitted prop is
+ * never here (the header's "manages only what it names"), so nothing omitted is ever written.
+ */
+export declare const differing: (live: KeyAttributes, props: KeyProps) => readonly string[];
+/**
+ * Create body: only what is declared, plus the value.
+ * ⛔ `Redacted.value` IS CALLED HERE, TO SEND, AND IN key-secret.ts's `echoes`, TO COMPARE — nowhere else.
+ */
+export declare const createBody: (props: KeyProps, secret: Redacted.Redacted<string>) => keys.GenerateKeyFnKeyGeneratePostRequest;
+/**
+ * Update body: the alias (which finds the key, `key` omitted) and ONLY the declared fields that
+ * differ, each as the declaration wants it — a declared `null` on `budget_id`/`team_id`/`duration`
+ * as an explicit `null` (a key column, which "an explicit null clears"), a declared `[]` as `[]`.
+ * ★ `metadata` CARRIES EVERY LIVE KEY with the declared ones on top, because `/key/update` replaces
+ *   the column (key-metadata.ts). The caller has refused a key with `withheld` slots by now.
+ * ⛔ NEVER CARRIES `key`: an update must not be able to change which value authenticates.
+ */
+export declare const updateBody: (props: KeyProps, live: KeyAttributes) => keys.UpdateKeyFnKeyUpdatePostRequest;
+/**
+ * One row of `/key/list?return_full_object=true`. The row's `token` (LiteLLM's hash of the key), the
+ * `metadata` callback slots (only their names stay, as `withheld`), and every other column not named
+ * in `KeyAttributes`, are dropped here on purpose.
+ */
+export declare const toAttributes: (row: Record<string, unknown>) => KeyAttributes;
+//# sourceMappingURL=key-form.d.ts.map

package/dist/litellm/key-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-form.d.ts","sourceRoot":"","sources":["../../src/litellm/key-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,yCAAyC,CAAC;AACrE,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,KAAK,QAAQ,EAAkD,MAAM,mBAAmB,CAAC;AAElG,MAAM,WAAW,QAAQ;IACvB,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sHAAsH;IACtH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAmBD;;;GAGG;AACH,eAAO,MAAM,SAAS,SAAU,aAAa,SAAS,QAAQ,KAAG,SAAS,MAAM,EAW/E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,UACd,QAAQ,UACP,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAChC,IAAI,CAAC,mCAaP,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,UACd,QAAQ,QACT,aAAa,KAClB,IAAI,CAAC,+BAWP,CAAC;AAOF;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,aAa3D,CAAC"}

package/dist/litellm/key-harness.d.ts

@@ -0,0 +1,41 @@
+import * as Effect from 'effect/Effect';
+import { startFakeLitellm } from './fake-litellm.ts';
+import { type FakeStack } from './fake-stack.ts';
+import { LiteLLMKey } from './key.ts';
+import type { KeyProps } from './key-form.ts';
+import type { LitellmOpContext } from './operations.ts';
+export declare const MASTER_KEY = "sk-test-master";
+/** A valid user-defined key (`sk-` and 16+ characters) that is obviously not a real one. */
+export declare const FAKE_KEY = "sk-FAKE-seat-key-000000000001";
+export declare const OTHER_FAKE_KEY = "sk-FAKE-seat-key-000000000002";
+export declare const VAR = "FAKE_LITELLM_SEAT_KEY";
+/** The row's `token` for a value, the same sha256 the fake and the vendor store (`hash_token`). */
+export declare const tokenFor: (value: string) => string;
+export type Fake = ReturnType<typeof startFakeLitellm>;
+export declare const newFake: (options?: Parameters<typeof startFakeLitellm>[0]) => Fake;
+export declare const keyStack: (fake: Fake, settings?: {
+    readonly noRetry?: boolean;
+}) => FakeStack;
+/** One declaration as a stack body. `name` is the resource's logical id. */
+export declare const declare: (props: KeyProps, name?: string) => Effect.Effect<void, never, import("alchemy").Provider<LiteLLMKey>>;
+/**
+ * Runs `body` with `values` in `process.env`, then puts the environment back exactly as it was.
+ * ⚠️ THE PROVIDER READS `process.env` AT CALL TIME (write-only.ts `resolveAll`), so the variable
+ *   has to be there for the whole deploy and gone after it.
+ */
+export declare const withEnv: <A>(values: Readonly<Record<string, string | undefined>>, body: () => Promise<A>) => Promise<A>;
+/** The message a rejected deploy carries, or `''` when it did not reject. */
+export declare const failureOf: (attempt: Promise<unknown>) => Promise<string>;
+/**
+ * Runs one handler effect against the fake outside any stack (a handler-level test), with the SDK's
+ * retry OFF: a test of a failing call wants the failure, not the backoff before it.
+ */
+export declare const runAgainst: <A, E>(fake: Fake, effect: Effect.Effect<A, E, LitellmOpContext>) => Promise<A>;
+/** A seeded live row shaped like `UserAPIKeyAuth`, with a hash `token` a resource must never surface. */
+export declare const liveRow: (fields?: Record<string, unknown>) => Record<string, unknown>;
+/**
+ * Someone changing a live key outside the stack — the dashboard's `/key/update` — through the fake's
+ * own route, so it replaces `metadata` the way LiteLLM does. It shows in `fake.keys.writes()`.
+ */
+export declare const dashboardEdit: (fake: Fake, keyAlias: string, patch: Record<string, unknown>) => Promise<void>;
+//# sourceMappingURL=key-harness.d.ts.map

package/dist/litellm/key-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-harness.d.ts","sourceRoot":"","sources":["../../src/litellm/key-harness.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAa,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAa,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C,4FAA4F;AAC5F,eAAO,MAAM,QAAQ,kCAAkC,CAAC;AACxD,eAAO,MAAM,cAAc,kCAAkC,CAAC;AAC9D,eAAO,MAAM,GAAG,0BAA0B,CAAC;AAE3C,mGAAmG;AACnG,eAAO,MAAM,QAAQ,UAAW,MAAM,KAAG,MACmB,CAAC;AAE7D,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEvD,eAAO,MAAM,OAAO,aAAc,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAG,IAClB,CAAC;AAE1D,eAAO,MAAM,QAAQ,SAAU,IAAI,aAAa;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,SACQ,CAAC;AAE1F,4EAA4E;AAC5E,eAAO,MAAM,OAAO,UAAW,QAAQ,sFAGnC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAAU,CAAC,UACrB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,QAC9C,MAAM,OAAO,CAAC,CAAC,CAAC,KACrB,OAAO,CAAC,CAAC,CAcX,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,SAAS,YAAmB,OAAO,CAAC,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAIvE,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,QACvB,IAAI,UACF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KAC5C,OAAO,CAAC,CAAC,CAQT,CAAC;AAEJ,yGAAyG;AACzG,eAAO,MAAM,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAYnF,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,SAClB,IAAI,YACA,MAAM,SACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,OAAO,CAAC,IAAI,CAOd,CAAC"}

package/dist/litellm/key-metadata-errors.d.ts

@@ -0,0 +1,30 @@
+declare const LitellmKeyCallbackMetadataDeclaredError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyCallbackMetadataDeclaredError";
+} & Readonly<A>;
+/**
+ * The declaration names a callback slot. LiteLLM stores its `callback_vars` ENCRYPTED, so the row
+ * would never read back equal (every deploy would fail with `LitellmKeyFieldNotAppliedError`), and
+ * Alchemy state is unencrypted.
+ */
+export declare class LitellmKeyCallbackMetadataDeclaredError extends LitellmKeyCallbackMetadataDeclaredError_base<{
+    readonly keyAlias: string;
+    readonly slots: readonly string[];
+}> {
+    get message(): string;
+}
+declare const LitellmKeyCallbackMetadataLiveError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "LitellmKeyCallbackMetadataLiveError";
+} & Readonly<A>;
+/**
+ * The live key holds callback credentials in its `metadata` and the declaration wants a metadata
+ * key changed. `/key/update` REPLACES the column, and this resource never read those slots, so it
+ * could not send them back: writing would strip the key's logging. Refused before the write.
+ */
+export declare class LitellmKeyCallbackMetadataLiveError extends LitellmKeyCallbackMetadataLiveError_base<{
+    readonly keyAlias: string;
+    readonly slots: readonly string[];
+}> {
+    get message(): string;
+}
+export {};
+//# sourceMappingURL=key-metadata-errors.d.ts.map

package/dist/litellm/key-metadata-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-metadata-errors.d.ts","sourceRoot":"","sources":["../../src/litellm/key-metadata-errors.ts"],"names":[],"mappings":";;;AASA;;;;GAIG;AACH,qBAAa,uCAAwC,SAAQ,6CAE3D;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;GAIG;AACH,qBAAa,mCAAoC,SAAQ,yCAEvD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF"}

package/dist/litellm/key-metadata.d.ts

@@ -0,0 +1,22 @@
+export type Metadata = Readonly<Record<string, unknown>>;
+/** The slots that carry callback credentials: never in attributes, never declared, never written. */
+export declare const CALLBACK_SLOTS: readonly ['callback_settings', 'logging', 'secret_manager_settings'];
+/** The callback slots `metadata` names, sorted (`CALLBACK_SLOTS` is). */
+export declare const callbackSlotsIn: (metadata: Metadata | undefined) => readonly string[];
+/**
+ * A row's `metadata` as attributes hold it: everything but the callback slots, whose NAMES are
+ * returned beside it (`withheld`) so a write knows it could not carry them.
+ */
+export declare const splitMetadata: (raw: unknown) => {
+    readonly metadata: Record<string, unknown>;
+    readonly withheld: readonly string[];
+};
+/**
+ * Whether a key the declaration names differs from the live row. An absent live key differs from any
+ * declared value, `null` included (`deepEqual` tells `undefined` from `null`), so `{ seat: null }`
+ * writes a `null` once and is quiet after.
+ */
+export declare const metadataDiffers: (live: Metadata, declared: Metadata | undefined) => boolean;
+/** The body's `metadata`: every live key carried, the declared ones on top. */
+export declare const mergedMetadata: (live: Metadata, declared: Metadata | undefined) => Metadata;
+//# sourceMappingURL=key-metadata.d.ts.map

package/dist/litellm/key-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-metadata.d.ts","sourceRoot":"","sources":["../../src/litellm/key-metadata.ts"],"names":[],"mappings":"AAiCA,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzD,qGAAqG;AACrG,eAAO,MAAM,cAAc,YAAI,mBAAmB,EAAE,SAAS,EAAE,yBAAyB,CAAU,CAAC;AAKnG,yEAAyE;AACzE,eAAO,MAAM,eAAe,aAAc,QAAQ,GAAG,SAAS,KAAG,SAAS,MAAM,EACc,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,aAAa,QACnB,OAAO,KACX;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAOpF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,SAAU,QAAQ,YAAY,QAAQ,GAAG,SAAS,KAAG,OAEA,CAAC;AAElF,+EAA+E;AAC/E,eAAO,MAAM,cAAc,SAAU,QAAQ,YAAY,QAAQ,GAAG,SAAS,KAAG,QAG9E,CAAC"}

package/dist/litellm/key-operations.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The four LiteLLM `/key/*` calls `LiteLLM.Key` uses, through the SDK's typed operations.
+ *
+ * ★ EVERY OPERATION HERE EXISTS IN `@distilled.cloud/litellm/key_management` (generated at LiteLLM
+ *   1.103.0) AND IS CALLED WITH ITS OWN REQUEST TYPE — none is guessed, none is hand-rolled:
+ *     `listKeysKeyListGet`        GET  /key/list      read, by `key_alias`, `return_full_object`
+ *     `generateKeyFnKeyGeneratePost` POST /key/generate  create, with the user-defined `key`
+ *     `updateKeyFnKeyUpdatePost`  POST /key/update    merge patch, found by `key_alias`
+ *     `deleteKeyFnKeyDeletePost`  POST /key/delete    by `key_aliases`
+ *   `/key/info` and `/v2/key/info` are NOT used: they take the key or its hash, and this resource
+ *   holds neither for an adopted key. Listing by alias needs no value.
+ * ⚠️ NO SEMAPHORE, unlike pass-through endpoints: every key is its own DB row (budget-operations.ts).
+ * ⚠️ THE SDK'S DEFAULT RETRY APPLIES TO `/key/generate` TOO. A create whose response was lost and is
+ *   then retried surfaces the proxy's duplicate-alias 400 rather than a second key; the next deploy
+ *   reads the row. UNVERIFIED against a live proxy — the retry policy is core's, not this file's.
+ * ⚠️ DELETE IS IDEMPOTENT BY THIS FUNCTION, not by the vendor. MEASURED in the litellm 1.103.0 wheel
+ *   (`key_management_endpoints.py`): `/key/delete` for an alias it does not hold answers 404 "No keys
+ *   found" (`delete_verification_tokens`, :4915-4918), and 403 for a caller that may not delete the
+ *   key (:4933-4936). The SDK types both as resource-specific tags, `KeyNotFound` and
+ *   `KeyDeleteForbidden` (a distilled patch, `patches/key_management/delete_key_fn_key_delete_post.json`,
+ *   each matched on the status AND a phrase of the vendor's message), so `catchTag` sees them: the
+ *   MESSAGE MATCH LIVES IN THE SDK, never here (S21). An absent alias is settled by the LIST, which
+ *   answers absence unambiguously, and a `KeyNotFound` (another caller won the race, or a retry of a
+ *   delete whose answer was lost) re-lists and is swallowed only if the key has gone since. Every
+ *   other failure, `KeyDeleteForbidden` included, propagates typed: a 404 that is not the vendor's
+ *   is core's `NotFound`, not absence. operations.ts's `deletePassThroughEndpoint` and
+ *   budget-operations.ts decide the same way, on their own tag.
+ */
+import * as keys from '@distilled.cloud/litellm/key_management';
+import * as Effect from 'effect/Effect';
+import { LitellmKeyAliasEmptyError, LitellmKeyAmbiguousAliasError, LitellmKeyTransportError, LitellmKeyUnreadableError } from './key-errors.ts';
+import { type KeyAttributes } from './key-form.ts';
+import { type LitellmOpContext } from './operations.ts';
+/**
+ * The one live key with this alias, or `undefined`. Two rows are an error, never a pick: the
+ * server filters by an EXACT alias by default, and this filters again so a proxy that matched a
+ * substring cannot hand back someone else's key.
+ */
+export declare const findKey: (keyAlias: string) => Effect.Effect<KeyAttributes | undefined, keys.ListKeysKeyListGetError | LitellmKeyUnreadableError | LitellmKeyAmbiguousAliasError | LitellmKeyAliasEmptyError, LitellmOpContext>;
+/**
+ * The row's `token` (the vendor's sha256 of the key), `null` when the row carries none, or
+ * `undefined` when the alias is absent. Absence must plan recreation, not a value mismatch.
+ * Read only for the in-memory mismatch check (`verifyKeyValue`); the hash is never persisted.
+ */
+export declare const readKeyToken: (keyAlias: string) => Effect.Effect<string | null | undefined, keys.ListKeysKeyListGetError | LitellmKeyUnreadableError | LitellmKeyAmbiguousAliasError | LitellmKeyAliasEmptyError, LitellmOpContext>;
+/**
+ * `/key/generate`. The response's `key` is `Redacted` (the SDK's `SensitiveValue`); never log the response.
+ * ⛔ THE REQUEST BODY IS `{"key":"sk-…"}`, AND A FAILED CALL CAN CARRY ITS REQUEST. Two ways, both
+ *   measured 2026-09-29 with a synthetic key (key-transport.test.ts): a transport failure is an
+ *   `HttpClientError` in the error channel, and a body that fails mid-read is the SAME error as a
+ *   DEFECT (`Effect.orDie` in `@distilled.cloud/core`'s `protocol-rest.ts`). Either would put the
+ *   plaintext in front of anything that serialises, inspects or logs the failure — while the SDK's
+ *   own `HttpClientError` is not something this resource can leave typed as it is. Both become
+ *   `LitellmKeyTransportError`, which keeps the alias and the reason's tag and nothing else.
+ *   The SDK's status errors (`BadRequest`, `Forbidden`, …) carry only the proxy's message text and
+ *   stay as they are, so a caller can still `catchTag` them.
+ */
+export declare const generateKey: (body: keys.GenerateKeyFnKeyGeneratePostRequest) => Effect.Effect<keys.GenerateKeyResponse, keys.BadRequest | import("@distilled.cloud/caddy").ConfigError | keys.Forbidden | LitellmKeyTransportError | keys.UnprocessableEntity | import("@distilled.cloud/litellm/Errors").DefaultErrors, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/** `/key/update`, found by the body's `key_alias`. */
+export declare const updateKey: (body: keys.UpdateKeyFnKeyUpdatePostRequest) => Effect.Effect<void, keys.UpdateKeyFnKeyUpdatePostError, import("@distilled.cloud/litellm/Credentials").Credentials>;
+/** `/key/delete` by alias, when the list shows the key; a no-op when it does not. */
+export declare const deleteKey: (keyAlias: string) => Effect.Effect<void, keys.DeleteKeyFnKeyDeletePostError | keys.ListKeysKeyListGetError | LitellmKeyUnreadableError | LitellmKeyAmbiguousAliasError | LitellmKeyAliasEmptyError, LitellmOpContext>;
+//# sourceMappingURL=key-operations.d.ts.map

package/dist/litellm/key-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-operations.d.ts","sourceRoot":"","sources":["../../src/litellm/key-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,IAAI,MAAM,yCAAyC,CAAC;AAChE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,KAAK,aAAa,EAAgB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,KAAK,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,OAAO,aACR,MAAM,KACf,MAAM,CAAC,MAAM,CACd,aAAa,GAAG,SAAS,EACvB,IAAI,CAAC,uBAAuB,GAC5B,yBAAyB,GACzB,6BAA6B,GAC7B,yBAAyB,EAC3B,gBAAgB,CAEgF,CAAC;AAmCnG;;;;GAIG;AACH,eAAO,MAAM,YAAY,aACb,MAAM,KACf,MAAM,CAAC,MAAM,CACd,MAAM,GAAG,IAAI,GAAG,SAAS,EACvB,IAAI,CAAC,uBAAuB,GAC5B,yBAAyB,GACzB,6BAA6B,GAC7B,yBAAyB,EAC3B,gBAAgB,CAQX,CAAC;AASR;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,SAAU,IAAI,CAAC,mCAAmC,ySAiBzE,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,SAAS,SAAU,IAAI,CAAC,+BAA+B,wHACG,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,SAAS,aACV,MAAM,KACf,MAAM,CAAC,MAAM,CACd,IAAI,EACF,IAAI,CAAC,6BAA6B,GAClC,IAAI,CAAC,uBAAuB,GAC5B,yBAAyB,GACzB,6BAA6B,GAC7B,yBAAyB,EAC3B,gBAAgB,CAiBf,CAAC"}

package/dist/litellm/key-secret.d.ts

@@ -0,0 +1,33 @@
+import * as Effect from 'effect/Effect';
+import * as Redacted from 'effect/Redacted';
+import { type FromEnv } from '../secrets/write-only.ts';
+import { LitellmKeyDebugLoggingError, LitellmKeyValueMalformedError, LitellmKeyValueMismatchError, LitellmKeyValueMissingError, LitellmKeyValueRequiredError } from './key-errors.ts';
+/**
+ * The declared value, `Redacted`, or a typed refusal naming the alias, the variable and the rule.
+ * Called only when a create is actually about to happen, never by `diff` or `read`, so a plan
+ * (which needs no secret) runs without the variable.
+ * ⚠️ AN EMPTY VARIABLE IS A MISSING ONE (`resolveAll`): a secret renderer that failed writes
+ *   `NAME=` and sending `''` would create a key that authenticates with nothing.
+ */
+export declare const resolveKeyValue: (keyAlias: string, ref: FromEnv | undefined) => Effect.Effect<Redacted.Redacted<string>, LitellmKeyValueRequiredError | LitellmKeyValueMissingError | LitellmKeyValueMalformedError>;
+/** Whether `/key/generate` echoed the value it was sent (the SDK hands it back `Redacted`). */
+export declare const echoes: (returned: string | Redacted.Redacted<string>, sent: Redacted.Redacted<string>) => boolean;
+/**
+ * Whether an ADOPTED key's declared `key: { fromEnv }` value is the key the live row holds.
+ *
+ * ⚠️ COMPARED AS A SHA256 AGAINST THE ROW'S `token`, never value-against-value, and the hash is
+ *   never written anywhere: a `Redacted` value unwrapped only long enough to digest it, then gone.
+ *   The row's `token` (`hash_token`) is the vendor's own sha256 hex of the key.
+ */
+export declare const verifyKeyValue: (keyAlias: string, ref: FromEnv | undefined, token: string | null) => Effect.Effect<void, LitellmKeyValueMismatchError>;
+/**
+ * ⛔ THE SDK PRINTS BODIES WHILE `DISTILLED_DEBUG_HTTP` IS SET (`@distilled.cloud/core`
+ *   `protocol-http.ts`: the first 400 characters of every request body; `protocol-rest.ts`: of every
+ *   response), and `/key/generate` carries the key in both. Measured by reading the pinned source
+ *   2026-09-29; `mesh-node-token.ts` refuses for the same reason. Only a create needs it: no other
+ *   call in this resource carries the value. Reads `process.env` because that is what distilled reads.
+ */
+export declare const refuseDebugLogging: (keyAlias: string) => Effect.Effect<void, LitellmKeyDebugLoggingError>;
+/** Whether verification can run; unset/empty variables skip the check, never a create. */
+export declare const hasKeyValue: (ref: FromEnv | undefined) => boolean;
+//# sourceMappingURL=key-secret.d.ts.map

package/dist/litellm/key-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-secret.d.ts","sourceRoot":"","sources":["../../src/litellm/key-secret.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,OAAO,EAAc,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,EAC5B,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,iBAAiB,CAAC;AAYzB;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,aAChB,MAAM,OACX,OAAO,GAAG,SAAS,KACvB,MAAM,CAAC,MAAM,CACd,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzB,4BAA4B,GAAG,2BAA2B,GAAG,6BAA6B,CAWxF,CAAC;AAEL,+FAA+F;AAC/F,eAAO,MAAM,MAAM,aACP,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QACtC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAC9B,OAC6F,CAAC;AAUjG;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,aACf,MAAM,OACX,OAAO,GAAG,SAAS,SACjB,MAAM,GAAG,IAAI,KACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAS/C,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,aACnB,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,CAGjC,CAAC;AAElB,0FAA0F;AAC1F,eAAO,MAAM,WAAW,QAAS,OAAO,GAAG,SAAS,KAAG,OACoB,CAAC"}

package/dist/litellm/key.d.ts

@@ -0,0 +1,78 @@
+/**
+ * `LiteLLM.Key` — one virtual key of LiteLLM's `LiteLLM_VerificationToken` (`/key/*`), bound to a
+ * `LiteLLM.Budget` tier, with its value kept out of Alchemy state.
+ *
+ * ★ ADOPT BY ALIAS. `keyAlias` is the identity: `/key/update` and `/key/delete` find a key by it
+ *   (their docstrings), and `/key/list` filters by it, so an existing key is taken over by declaring
+ *   its alias, with no value in hand. A live key with no state is `Unowned` and needs `--adopt`; the
+ *   apply re-checks it (`refuseTakeover`) for a create the planner could not probe — which is EVERY
+ *   key declared with `budgetId: tier.budgetId`, an Output until the tier exists.
+ * ⛔ THE VALUE IS WRITE-ONLY (key-secret.ts): `key: { fromEnv }` names the variable, the value goes
+ *   over the wire once in `/key/generate`, and no attribute, log line or error carries it. `diff`
+ *   checks a set variable against the live token in memory; an unset variable skips the check.
+ *   `read` never touches the environment, and no value or hash is added to state.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a key breaks whatever holds it (a seat's every call
+ *   401s). Dropping the declaration leaves the key live; `.pipe(RemovalPolicy.destroy())` opts in.
+ * ⛔ A RENAME IS REFUSED, not replaced. The new key would need the same value, and `/key/generate`
+ *   rejects a second key with a value it already holds; under `retain` the old row would still be
+ *   there. Declare the new alias as a new resource and destroy the old one.
+ * ★ A DECLARATION MANAGES ONLY WHAT IT NAMES (key-form.ts): an omitted prop is never compared or sent,
+ *   and `metadata` is a merge (key-metadata.ts), so an adopted key's scope, budget and guardrails are
+ *   never cleared by leaving them out.
+ * ⛔ NO CREDENTIAL IS A PROP; `litellmProviders`' layer supplies `Credentials`.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { LitellmKeyAbsentAfterWriteError, LitellmKeyAliasChangedError, LitellmKeyFieldNotAppliedError, LitellmKeyValueNotHonouredError } from './key-errors.ts';
+import { type KeyAttributes, type KeyProps } from './key-form.ts';
+import { LitellmKeyCallbackMetadataDeclaredError, LitellmKeyCallbackMetadataLiveError } from './key-metadata-errors.ts';
+export type { KeyAttributes, KeyProps };
+export type { KeyError } from './key-errors.ts';
+export interface LiteLLMKey extends Resource<'LiteLLM.Key', KeyProps, KeyAttributes> {
+}
+export declare const LiteLLMKey: import("alchemy").ResourceClass<LiteLLMKey>;
+export declare const isLiteLLMKey: (value: unknown) => value is LiteLLMKey;
+/** ⛔ TEST-ONLY EXPORT. Not on index.ts's barrel. */
+export declare const keyHandlers: {
+    read: ({ olds, output }: {
+        olds: KeyProps;
+        output: KeyAttributes | undefined;
+    }) => Effect.Effect<KeyAttributes | undefined, import("./key-errors.ts").LitellmKeyAliasEmptyError | import("./key-errors.ts").LitellmKeyAmbiguousAliasError | import("./key-errors.ts").LitellmKeyUnreadableError | import("@distilled.cloud/litellm/key_management").ListKeysKeyListGetError, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    diff: ({ news, output }: {
+        news: Input<KeyProps>;
+        output: KeyAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, LitellmKeyAliasChangedError | import("./key-errors.ts").LitellmKeyAliasEmptyError | import("./key-errors.ts").LitellmKeyAmbiguousAliasError | LitellmKeyCallbackMetadataDeclaredError | LitellmKeyCallbackMetadataLiveError | import("./key-errors.ts").LitellmKeyUnreadableError | import("./key-errors.ts").LitellmKeyValueMismatchError | import("@distilled.cloud/litellm/key_management").ListKeysKeyListGetError, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    reconcile: ({ fqn, instanceId, news, output, }: {
+        fqn: string;
+        instanceId: string;
+        news: KeyProps;
+        output: KeyAttributes | undefined;
+    }) => Effect.Effect<{
+        keyAlias: string;
+        budgetId: string | null;
+        models: readonly string[];
+        allowedRoutes: readonly string[];
+        teamId: string | null;
+        metadata: import("./key-metadata.ts").Metadata;
+        expires: string | null;
+        withheld: readonly string[];
+        duration: string | null;
+    }, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/litellm/key_management").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/litellm/key_management").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | LitellmKeyAbsentAfterWriteError | import("./key-errors.ts").LitellmKeyAliasEmptyError | import("./key-errors.ts").LitellmKeyAmbiguousAliasError | LitellmKeyCallbackMetadataDeclaredError | LitellmKeyCallbackMetadataLiveError | import("./key-errors.ts").LitellmKeyDebugLoggingError | LitellmKeyFieldNotAppliedError | import("./key-errors.ts").LitellmKeyTransportError | import("./key-errors.ts").LitellmKeyUnreadableError | import("./key-errors.ts").LitellmKeyValueMalformedError | import("./key-errors.ts").LitellmKeyValueMismatchError | import("./key-errors.ts").LitellmKeyValueMissingError | LitellmKeyValueNotHonouredError | import("./key-errors.ts").LitellmKeyValueRequiredError | import("@distilled.cloud/litellm/Errors").LitellmParseError | import("@distilled.cloud/litellm/key_management").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | import("@distilled.cloud/litellm/key_management").UnprocessableEntity, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    delete: ({ output }: {
+        output: KeyAttributes;
+    }) => Effect.Effect<void, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/litellm/key_management").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/litellm/key_management").KeyDeleteForbidden | import("@distilled.cloud/litellm/key_management").KeyNotFound | import("./key-errors.ts").LitellmKeyAliasEmptyError | import("./key-errors.ts").LitellmKeyAmbiguousAliasError | import("./key-errors.ts").LitellmKeyUnreadableError | import("@distilled.cloud/litellm/Errors").LitellmParseError | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/litellm/Errors").UnknownLitellmError | import("@distilled.cloud/litellm/key_management").UnprocessableEntity, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+    /**
+     * ⚠️ ENUMERATES NOTHING, ON PURPOSE. `nuke` walks `list` and deletes what it finds; a proxy's key
+     *   table holds every live credential the estate's services authenticate with, plus dashboard
+     *   session keys nobody declared — none of which this stack made.
+     */
+    list: () => Effect.Effect<never[], never, never>;
+};
+export declare const LiteLLMKeyProvider: () => import("effect/Layer").Layer<Provider.Provider<LiteLLMKey>, never, import("@distilled.cloud/litellm/Protocol").LitellmOpContext>;
+//# sourceMappingURL=key.d.ts.map

package/dist/litellm/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../src/litellm/key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,QAAQ,EAId,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,uCAAuC,EACvC,mCAAmC,EACpC,MAAM,0BAA0B,CAAC;AAUlC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AACxC,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,CAAC;CAAG;AAEvF,eAAO,MAAM,UAAU,6CAA0E,CAAC;AAElG,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,KAAK,IAAI,UACe,CAAC;AA4DvE,oDAAoD;AACpD,eAAO,MAAM,WAAW;IACtB,IAAI,qBAAqB;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAA;KAAE;IAO9E,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAA;KAAE;yBAarC,QAAQ;;yBAIrC,MAAM;;IAIzB,SAAS,uCAKN;QACD,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;KACnC;;;;;;;;;;;IAmCD,MAAM,eAAe;QAAE,MAAM,EAAE,aAAa,CAAA;KAAE;IAE9C;;;;OAIG;IACH,IAAI;CACL,CAAC;AAEF,eAAO,MAAM,kBAAkB,wIACmD,CAAC"}