cmpnd 0.56.0__tar.gz → 0.58.0__tar.gz

{cmpnd-0.56.0 → cmpnd-0.58.0}/AGENTS.md

@@ -123,6 +123,40 @@ parameter, and a spec-less mock accepts one anyway.
 with real LLMs (`CMPND_E2E_*` keys). It never uses a mock or an in-process
 fake, and it runs only locally.
 
+## DSPy versions under test
+
+The SDK supports DSPy 3.3.x and 3.4.x, and `dependencies` floors DSPy at
+3.3.0. `pyproject.toml` declares one dependency group per DSPy version the
+`sdk-test` matrix tests, such as `dspy-3-4-1 = ["dspy==3.4.1"]`.
+`[tool.uv] conflicts` makes the groups mutually exclusive, so `uv.lock` holds a
+whole tree for each DSPy. Dependency groups never reach the wheel, so users
+still install against the `dspy>=…` floor in `dependencies`.
+
+- A plain `uv sync` or `uv run` installs the default group, the newest tested
+  DSPy.
+- `scripts/install-test-env.sh <python> <dspy>` builds `.venv` from one group's
+  locked tree, as each `sdk-test` leg in `ci-sdk.yml` does. From the repo root,
+  run `just sdk-test-env 3.13 3.3.0`, then, from `python-sdk/`,
+  `.venv/bin/python -m pytest tests/ -k "not e2e"`. `uv sync --extra dev` in
+  `python-sdk/` returns to the default group.
+- `--latest` resolves every package fresh, as a user's install today would.
+  With the DSPy version `newest` it pins no DSPy either. The daily
+  `sdk-latest-dependencies.yml` run uses both: every sdk-test leg, plus one
+  leg on the newest DSPy, which is the first to see a DSPy release no group
+  tests yet. A failure there alerts Slack.
+- A DSPy release can pin some packages exactly, such as gepa (`dspy==3.3.0`
+  pins gepa 0.1.1). Its group locks those packages at the pinned versions. The
+  `mcp` extra floors DSPy at 3.3.1, so it conflicts with the `dspy-3-3-0`
+  group.
+
+To test another DSPy version, add its group to `[dependency-groups]` and to
+the first `conflicts` list, add a conflict with the `mcp` extra if it is below
+3.3.1, add the leg to `sdk-test`'s matrix and to
+`sdk-latest-dependencies.yml`, and run `uv lock`.
+`.github/scripts/test_workflows.py` fails while the groups and the matrix
+disagree. To move the default, change `default-groups` and refresh the span
+reference fixture with `uv run python -m tests.span_reference_fixture`.
+
 ## Two packages, one published distribution
 
 `cmpnd` (`cmpnd/`) is the SDK. `cmpnd_ingest` (`ingest/cmpnd_ingest/`) is the

{cmpnd-0.56.0 → cmpnd-0.58.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cmpnd
-Version: 0.56.0
+Version: 0.58.0
 Summary: DSPy observability and deployment SDK for cmpnd
 Project-URL: Homepage, https://cmpnd.ai
 Author-email: cmpnd <hello@cmpnd.ai>
@@ -17,7 +17,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.11
-Requires-Dist: dspy>=3.1.3
+Requires-Dist: dspy>=3.3.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: ipython>=8.20
 Requires-Dist: pydantic>=2.0
@@ -205,6 +205,145 @@ The platform makes the program the first time your organization uses the
 program name. Later deploys under the same program name go to the same
 program, and so do the traces of a client that runs it.
 
+### Credentials
+
+A hosted program spends a credential your organization sealed, and the deploy
+names it. The program's code stays the code you run on your laptop:
+
+```python
+lm = dspy.LM("openai/deepseek-4.1-flash", api_base="https://gw.lunaroute.com/v1")  # unchanged
+
+luna = cmpnd.credentials.get("luna-exec")
+deployed = sdk.deploy_program(program, credential=luna)
+# deploy: default-lm: chat_completions openai/deepseek-4.1-flash → luna-exec (https://gw.lunaroute.com)
+```
+
+- `cmpnd.credentials.get(name)` returns a `cmpnd.Credential` holding the name,
+  the protocols its endpoint serves and its `api_base`. It holds no key. A name
+  the organization does not hold raises `cmpnd.CredentialNotFound`, which lists
+  the names it does hold and the nearest one. `cmpnd.credentials.list()`
+  returns them all.
+- `credential=` takes a `cmpnd.Credential`, never a string. A string raises
+  and shows the `cmpnd.credentials.get(...)` line to write.
+- Without `credential=`, the deployment spends the organization's default,
+  which an owner sets with `cmpnd credentials default NAME`.
+- The deployment records the credential's name. Each call spends the newest
+  credential sealed under that name, so an owner who rotates a key needs no
+  redeploy.
+- The deploy prints the protocol, model and credential of each binding, as
+  above. A server that prints none chose the credential from the model's
+  provider prefix, and the SDK warns.
+- A hosted call goes to the credential's `api_base`. The LM's own `api_base`
+  serves your laptop run and is not sent.
+
+Keys never leave your laptop. The SDK sends no key on the LM, and a key reaches
+the platform only through `cmpnd credentials create`. `cmpnd deploy FILE`
+refuses source whose import builds an LM carrying a key, and names the module,
+the model and the field.
+
+### The same source on your laptop and hosted
+
+A program's logic runs unchanged on your laptop and hosted. On your laptop it
+spends the key in your environment. Hosted, it spends a credential your
+organization sealed. Keep the logic in one file and let a small entry point
+choose where it runs.
+
+The program file holds the logic and names its model. It holds no key:
+
+```python
+# qa.py
+import dspy
+
+lm = dspy.LM("openai/gpt-5-mini")  # no api_key: litellm reads OPENAI_API_KEY on your laptop
+program = dspy.Predict("question -> answer")
+
+
+def metric(gold, pred, trace=None, pred_name=None, pred_trace=None, lms=None):
+    verdict = dspy.Predict("answer, gold -> correct: bool")(answer=pred.answer, gold=gold.answer, lm=lms["critic"])
+    return dspy.Prediction(score=float(verdict.correct), feedback="correct" if verdict.correct else "wrong")
+```
+
+Seal the key once for the organization and make it the default:
+
+```bash
+printf '%s' "$OPENAI_API_KEY" | cmpnd credentials create --name openai --preset openai
+cmpnd credentials default openai
+```
+
+The entry point is the only code that knows where the run happens:
+
+```python
+# main.py
+import functools
+import sys
+
+import cmpnd
+import dspy
+
+from qa import lm, metric, program
+
+HOSTED = "--hosted" in sys.argv
+
+sdk = cmpnd.Client()
+qa = cmpnd.Program("qa", module=program, lm=lm)
+reflection = dspy.LM("openai/gpt-5", max_tokens=32000)
+lms = {"critic": dspy.LM("openai/gpt-5-mini")}
+train, val = load_examples()  # your dspy.Example lists
+
+if HOSTED:
+    deployed = sdk.deploy_program(qa)  # spends the default credential, openai
+    print(sdk.run_deployment(deployed, question="What is DSPy?"))
+    best = sdk.optimize_deployment(
+        deployed,
+        trainset=train,
+        valset=val,
+        metric=metric,  # the platform hands it lms
+        reflection_lm=cmpnd.HostedLM(reflection),
+        lms={name: cmpnd.HostedLM(model) for name, model in lms.items()},
+        auto="light",
+    )
+else:
+    print(sdk.run_program(qa, question="What is DSPy?"))  # spends $OPENAI_API_KEY
+    gepa = dspy.GEPA(metric=functools.partial(metric, lms=lms), reflection_lm=reflection, auto="light")
+    best = sdk.optimize_program(qa, gepa, trainset=train, valset=val)
+```
+
+`python main.py` runs everything on your laptop, and `python main.py --hosted`
+runs it on the platform. `cmpnd deploy qa.py qa` deploys the same file from the
+terminal.
+
+| | On your laptop | Hosted |
+|---|---|---|
+| Key | the provider's variable in your environment, such as `OPENAI_API_KEY` | the credential the call names, else the organization's default |
+| Address | the LM's `api_base`, else the provider's endpoint | the credential's `api_base` |
+| Model | `gpt-5-mini`, the model after its first `/` | `gpt-5-mini` |
+| The metric's `lms` | the dict the entry point binds | the run's `lms=`, which the platform hands it |
+
+These rules keep the program file portable:
+
+- **Leave the key off the program's LM** and let litellm read the provider's
+  own variable. For a key in a variable litellm does not read, write
+  `api_key=os.environ.get("NAME")`. cmpnd imports a deploy file with an empty
+  environment, so the key is `None` there and present on your laptop.
+- **Never write a key into the file, and never read it as
+  `os.environ["NAME"]` at module scope.** The deploy refuses the first. The
+  second raises `KeyError` hosted, where the environment holds no key.
+- **Seal the credential at the address your laptop LM reaches.** A program
+  that sets `api_base="https://gw.lunaroute.com/v1"` needs a credential sealed
+  there, with `--preset lunaroute` or `--api-base`. Hosted calls go to the
+  credential's address and ignore the LM's `api_base`. The deploy prints the
+  address it chose, so you can compare the two.
+- **Wrap a model you hand the hosted optimization in `cmpnd.HostedLM`.** The
+  entry point builds `reflection_lm=` and each `lms=` entry, so those LMs may
+  hold a key for the laptop run. The wrapper leaves that key on your machine.
+  `optimize_deployment` refuses a key on an unwrapped LM, because there it would
+  look spent. `cmpnd.HostedLM(model, credential=c)` makes a model spend a
+  credential other than the run's.
+
+A judge built on `dspy.experimental.TypeSafe` also runs unchanged in both
+places. [`docs/sdk-instrumentation.md`](docs/sdk-instrumentation.md), under
+"System One judges", describes the hosted side.
+
 ### Options
 
 ```python
@@ -213,6 +352,7 @@ sdk.deploy_program(
     metric=None,       # optional: a metric callable, packaged for optimization
     timeout=300,       # optional: seconds to wait for the deployment to be ready
     metadata=None,     # optional: a JSON-serializable dict, at most 64 KiB, stored with the deployment
+    credential=None,   # optional: a cmpnd.Credential the program's model spends
 )
 ```
 
@@ -270,11 +410,32 @@ from the deployment.
 `reflection_lm` is the model that proposes each new instruction. The search is
 only as good as this model, so it is usually a strong model and not the one
 being optimized. A `dspy.LM` passes its sampling settings to the provider. A
-bare model name gives the same model with no sampling settings. The platform
-supplies the credential and the endpoint, so the SDK refuses an `api_key`,
-`api_base` or `base_url` on the LM before any network call. On a hosted org,
-both live on the provider credential (Account → Model Providers), keyed by the
-model's protocol. One `openai` credential serves every `openai/*` model.
+bare model name gives the same model with no sampling settings. A run spends
+sealed credentials only, so the SDK refuses a key on the LM before any network
+call. `cmpnd.HostedLM(lm)` keeps a key your laptop runs spend on this machine
+and passes the LM's model and sampling.
+
+`credential=` names the run's credential, which every binding that names none
+spends: the program's model, the reflection model and each entry of `lms`. A
+binding names its own credential through a wrapper for its protocol:
+
+```python
+luna = cmpnd.credentials.get("luna-exec")      # serves chat_completions and system_one
+openai = cmpnd.credentials.get("openai")
+best = sdk.optimize_deployment(
+    deployed, trainset=train, valset=val, metric=metric,
+    credential=luna,
+    reflection_lm=cmpnd.HostedLM(dspy.LM("openai/gpt-5"), credential=openai),
+    lms={"judge": cmpnd.SystemOne("lunaroute/djev", credential=luna)},
+    auto="light",
+)
+```
+
+`cmpnd.HostedLM(lm, credential=c)` wraps a chat LM, and
+`cmpnd.SystemOne(model, credential=c)` declares a System One model. A binding
+without a credential spends the run's, or the organization's default. The
+platform refuses a credential whose endpoint does not serve a binding's
+protocol, and names the `credential=` to add.
 
 The SDK checks the metric before any network call. GEPA writes each new
 instruction from the textual feedback the metric returns, so it needs a
@@ -322,9 +483,9 @@ rules:
   names.
 - `"default-lm"` is reserved for the program's own model, which comes from the
   deployment. Declaring it raises an error that names it.
-- The platform refuses a model your org holds no credential for when it dispatches
-  the run, before the run starts. These LMs, like `reflection_lm`, must not set
-  `api_key`, `api_base` or `base_url`.
+- The platform refuses a binding it finds no credential for when it dispatches
+  the run, before the run starts. These LMs, like `reflection_lm`, must not
+  carry a key.
 
 The `lms` parameter does not change the arity check. Five or more positional
 arguments make a feedback metric, and a metric without `lms` never receives
@@ -340,8 +501,9 @@ sdk.optimize_deployment(
     valset=val,              # required: validation examples
     metric=metric,           # required: the metric, arity-checked
     config=None,             # optional: optimizer config, allow-listed by the platform
-    reflection_lm=None,      # required: a dspy.LM or a bare model name
-    lms=None,                # optional: name -> dspy.LM, the run's named models
+    reflection_lm=None,      # required: a dspy.LM, a bare model name or a cmpnd.HostedLM
+    lms=None,                # optional: name -> dspy.LM, cmpnd.HostedLM or cmpnd.SystemOne
+    credential=None,         # optional: the cmpnd.Credential every other binding spends
     max_metric_calls=None,   # budget: the metric-call ceiling for one step
     auto=None,               # budget: "light", "medium" or "heavy"
     may_author_code=None,    # optional: False keeps each dspy.Flex at its deployed source

{cmpnd-0.56.0 → cmpnd-0.58.0}/README.md

@@ -154,6 +154,145 @@ The platform makes the program the first time your organization uses the
 program name. Later deploys under the same program name go to the same
 program, and so do the traces of a client that runs it.
 
+### Credentials
+
+A hosted program spends a credential your organization sealed, and the deploy
+names it. The program's code stays the code you run on your laptop:
+
+```python
+lm = dspy.LM("openai/deepseek-4.1-flash", api_base="https://gw.lunaroute.com/v1")  # unchanged
+
+luna = cmpnd.credentials.get("luna-exec")
+deployed = sdk.deploy_program(program, credential=luna)
+# deploy: default-lm: chat_completions openai/deepseek-4.1-flash → luna-exec (https://gw.lunaroute.com)
+```
+
+- `cmpnd.credentials.get(name)` returns a `cmpnd.Credential` holding the name,
+  the protocols its endpoint serves and its `api_base`. It holds no key. A name
+  the organization does not hold raises `cmpnd.CredentialNotFound`, which lists
+  the names it does hold and the nearest one. `cmpnd.credentials.list()`
+  returns them all.
+- `credential=` takes a `cmpnd.Credential`, never a string. A string raises
+  and shows the `cmpnd.credentials.get(...)` line to write.
+- Without `credential=`, the deployment spends the organization's default,
+  which an owner sets with `cmpnd credentials default NAME`.
+- The deployment records the credential's name. Each call spends the newest
+  credential sealed under that name, so an owner who rotates a key needs no
+  redeploy.
+- The deploy prints the protocol, model and credential of each binding, as
+  above. A server that prints none chose the credential from the model's
+  provider prefix, and the SDK warns.
+- A hosted call goes to the credential's `api_base`. The LM's own `api_base`
+  serves your laptop run and is not sent.
+
+Keys never leave your laptop. The SDK sends no key on the LM, and a key reaches
+the platform only through `cmpnd credentials create`. `cmpnd deploy FILE`
+refuses source whose import builds an LM carrying a key, and names the module,
+the model and the field.
+
+### The same source on your laptop and hosted
+
+A program's logic runs unchanged on your laptop and hosted. On your laptop it
+spends the key in your environment. Hosted, it spends a credential your
+organization sealed. Keep the logic in one file and let a small entry point
+choose where it runs.
+
+The program file holds the logic and names its model. It holds no key:
+
+```python
+# qa.py
+import dspy
+
+lm = dspy.LM("openai/gpt-5-mini")  # no api_key: litellm reads OPENAI_API_KEY on your laptop
+program = dspy.Predict("question -> answer")
+
+
+def metric(gold, pred, trace=None, pred_name=None, pred_trace=None, lms=None):
+    verdict = dspy.Predict("answer, gold -> correct: bool")(answer=pred.answer, gold=gold.answer, lm=lms["critic"])
+    return dspy.Prediction(score=float(verdict.correct), feedback="correct" if verdict.correct else "wrong")
+```
+
+Seal the key once for the organization and make it the default:
+
+```bash
+printf '%s' "$OPENAI_API_KEY" | cmpnd credentials create --name openai --preset openai
+cmpnd credentials default openai
+```
+
+The entry point is the only code that knows where the run happens:
+
+```python
+# main.py
+import functools
+import sys
+
+import cmpnd
+import dspy
+
+from qa import lm, metric, program
+
+HOSTED = "--hosted" in sys.argv
+
+sdk = cmpnd.Client()
+qa = cmpnd.Program("qa", module=program, lm=lm)
+reflection = dspy.LM("openai/gpt-5", max_tokens=32000)
+lms = {"critic": dspy.LM("openai/gpt-5-mini")}
+train, val = load_examples()  # your dspy.Example lists
+
+if HOSTED:
+    deployed = sdk.deploy_program(qa)  # spends the default credential, openai
+    print(sdk.run_deployment(deployed, question="What is DSPy?"))
+    best = sdk.optimize_deployment(
+        deployed,
+        trainset=train,
+        valset=val,
+        metric=metric,  # the platform hands it lms
+        reflection_lm=cmpnd.HostedLM(reflection),
+        lms={name: cmpnd.HostedLM(model) for name, model in lms.items()},
+        auto="light",
+    )
+else:
+    print(sdk.run_program(qa, question="What is DSPy?"))  # spends $OPENAI_API_KEY
+    gepa = dspy.GEPA(metric=functools.partial(metric, lms=lms), reflection_lm=reflection, auto="light")
+    best = sdk.optimize_program(qa, gepa, trainset=train, valset=val)
+```
+
+`python main.py` runs everything on your laptop, and `python main.py --hosted`
+runs it on the platform. `cmpnd deploy qa.py qa` deploys the same file from the
+terminal.
+
+| | On your laptop | Hosted |
+|---|---|---|
+| Key | the provider's variable in your environment, such as `OPENAI_API_KEY` | the credential the call names, else the organization's default |
+| Address | the LM's `api_base`, else the provider's endpoint | the credential's `api_base` |
+| Model | `gpt-5-mini`, the model after its first `/` | `gpt-5-mini` |
+| The metric's `lms` | the dict the entry point binds | the run's `lms=`, which the platform hands it |
+
+These rules keep the program file portable:
+
+- **Leave the key off the program's LM** and let litellm read the provider's
+  own variable. For a key in a variable litellm does not read, write
+  `api_key=os.environ.get("NAME")`. cmpnd imports a deploy file with an empty
+  environment, so the key is `None` there and present on your laptop.
+- **Never write a key into the file, and never read it as
+  `os.environ["NAME"]` at module scope.** The deploy refuses the first. The
+  second raises `KeyError` hosted, where the environment holds no key.
+- **Seal the credential at the address your laptop LM reaches.** A program
+  that sets `api_base="https://gw.lunaroute.com/v1"` needs a credential sealed
+  there, with `--preset lunaroute` or `--api-base`. Hosted calls go to the
+  credential's address and ignore the LM's `api_base`. The deploy prints the
+  address it chose, so you can compare the two.
+- **Wrap a model you hand the hosted optimization in `cmpnd.HostedLM`.** The
+  entry point builds `reflection_lm=` and each `lms=` entry, so those LMs may
+  hold a key for the laptop run. The wrapper leaves that key on your machine.
+  `optimize_deployment` refuses a key on an unwrapped LM, because there it would
+  look spent. `cmpnd.HostedLM(model, credential=c)` makes a model spend a
+  credential other than the run's.
+
+A judge built on `dspy.experimental.TypeSafe` also runs unchanged in both
+places. [`docs/sdk-instrumentation.md`](docs/sdk-instrumentation.md), under
+"System One judges", describes the hosted side.
+
 ### Options
 
 ```python
@@ -162,6 +301,7 @@ sdk.deploy_program(
     metric=None,       # optional: a metric callable, packaged for optimization
     timeout=300,       # optional: seconds to wait for the deployment to be ready
     metadata=None,     # optional: a JSON-serializable dict, at most 64 KiB, stored with the deployment
+    credential=None,   # optional: a cmpnd.Credential the program's model spends
 )
 ```
 
@@ -219,11 +359,32 @@ from the deployment.
 `reflection_lm` is the model that proposes each new instruction. The search is
 only as good as this model, so it is usually a strong model and not the one
 being optimized. A `dspy.LM` passes its sampling settings to the provider. A
-bare model name gives the same model with no sampling settings. The platform
-supplies the credential and the endpoint, so the SDK refuses an `api_key`,
-`api_base` or `base_url` on the LM before any network call. On a hosted org,
-both live on the provider credential (Account → Model Providers), keyed by the
-model's protocol. One `openai` credential serves every `openai/*` model.
+bare model name gives the same model with no sampling settings. A run spends
+sealed credentials only, so the SDK refuses a key on the LM before any network
+call. `cmpnd.HostedLM(lm)` keeps a key your laptop runs spend on this machine
+and passes the LM's model and sampling.
+
+`credential=` names the run's credential, which every binding that names none
+spends: the program's model, the reflection model and each entry of `lms`. A
+binding names its own credential through a wrapper for its protocol:
+
+```python
+luna = cmpnd.credentials.get("luna-exec")      # serves chat_completions and system_one
+openai = cmpnd.credentials.get("openai")
+best = sdk.optimize_deployment(
+    deployed, trainset=train, valset=val, metric=metric,
+    credential=luna,
+    reflection_lm=cmpnd.HostedLM(dspy.LM("openai/gpt-5"), credential=openai),
+    lms={"judge": cmpnd.SystemOne("lunaroute/djev", credential=luna)},
+    auto="light",
+)
+```
+
+`cmpnd.HostedLM(lm, credential=c)` wraps a chat LM, and
+`cmpnd.SystemOne(model, credential=c)` declares a System One model. A binding
+without a credential spends the run's, or the organization's default. The
+platform refuses a credential whose endpoint does not serve a binding's
+protocol, and names the `credential=` to add.
 
 The SDK checks the metric before any network call. GEPA writes each new
 instruction from the textual feedback the metric returns, so it needs a
@@ -271,9 +432,9 @@ rules:
   names.
 - `"default-lm"` is reserved for the program's own model, which comes from the
   deployment. Declaring it raises an error that names it.
-- The platform refuses a model your org holds no credential for when it dispatches
-  the run, before the run starts. These LMs, like `reflection_lm`, must not set
-  `api_key`, `api_base` or `base_url`.
+- The platform refuses a binding it finds no credential for when it dispatches
+  the run, before the run starts. These LMs, like `reflection_lm`, must not
+  carry a key.
 
 The `lms` parameter does not change the arity check. Five or more positional
 arguments make a feedback metric, and a metric without `lms` never receives
@@ -289,8 +450,9 @@ sdk.optimize_deployment(
     valset=val,              # required: validation examples
     metric=metric,           # required: the metric, arity-checked
     config=None,             # optional: optimizer config, allow-listed by the platform
-    reflection_lm=None,      # required: a dspy.LM or a bare model name
-    lms=None,                # optional: name -> dspy.LM, the run's named models
+    reflection_lm=None,      # required: a dspy.LM, a bare model name or a cmpnd.HostedLM
+    lms=None,                # optional: name -> dspy.LM, cmpnd.HostedLM or cmpnd.SystemOne
+    credential=None,         # optional: the cmpnd.Credential every other binding spends
     max_metric_calls=None,   # budget: the metric-call ceiling for one step
     auto=None,               # budget: "light", "medium" or "heavy"
     may_author_code=None,    # optional: False keeps each dspy.Flex at its deployed source

{cmpnd-0.56.0 → cmpnd-0.58.0}/cmpnd/__init__.py

@@ -17,7 +17,7 @@ from typing import TYPE_CHECKING
 
 from cmpnd_ingest.client_floor import UpgradeRequiredWarning
 
-from . import authored, programs, traces
+from . import authored, credentials, programs, traces
 from ._http import ApiError
 from .callback import CmpndCallback, trace_id
 from .client import Client
@@ -27,6 +27,7 @@ from .context import (
     get_current_span,
     get_current_trace,
 )
+from .credentials import Credential, CredentialNotFound
 from .datasets import DatasetNotFoundError, VersionNotFoundError, load_dataset
 from .decorators import start_span, trace
 from .deployment import DeployFailed
@@ -39,7 +40,7 @@ from .deployment_metadata import (
 from .deployment_runs import RunResultExpired, RunSubmissionUncertain, RunWaitTimeout
 from .execution import DeployedProgram, RetryableProviderError
 from .exporter import flush_exporter, shutdown_exporter
-from .lm_configuration import SystemOne, configure_lm
+from .lm_configuration import HostedLM, SystemOne, configure_lm
 from .mcp_servers import (
     Bearer,
     McpToolReference,
@@ -70,6 +71,7 @@ __all__ = [
     "configure",
     "configure_lm",
     "SystemOne",
+    "HostedLM",
     "get_config",
     "require_config",
     # Main callback
@@ -95,6 +97,10 @@ __all__ = [
     "traces",
     # Program name checks (cmpnd.programs.validate_program_name)
     "programs",
+    # The organization's provider credentials (cmpnd.credentials.get / list)
+    "credentials",
+    "Credential",
+    "CredentialNotFound",
     # A program declared by name
     "Program",
     "program",