From 6b591c34f141d4977078da2e7d67ad320d898f13 Mon Sep 17 00:00:00 2001
From: KunalG67 <kunalgarhewal13@gmail.com>
Date: Mon, 27 Apr 2026 17:15:11 +0530
Subject: [PATCH 01/33] fix(ovhcloud): migrate reasoning_content->reasoning and
 duration->seconds fields

OVHCloud is deprecating two response fields on 2026-05-11:
- reasoning_content replaced by reasoning (LLM reasoning models)
- duration replaced by seconds (Speech-to-Text models)

Adds backward-compatible support for both field names during the
transition window, preferring the new field when present and falling
back to the legacy field.

Fixes #26586
---
 .../audio_transcription/transformation.py     |  8 ++
 litellm/llms/ovhcloud/chat/transformation.py  | 14 +++-
 ...loud_audio_transcription_transformation.py | 43 +++++++++++
 .../test_ovhcloud_chat_transformation.py      | 73 +++++++++++++++++++
 4 files changed, 134 insertions(+), 4 deletions(-)

diff --git a/litellm/llms/ovhcloud/audio_transcription/transformation.py b/litellm/llms/ovhcloud/audio_transcription/transformation.py
index 7ff6dc986be..e3c8308d507 100644
--- a/litellm/llms/ovhcloud/audio_transcription/transformation.py
+++ b/litellm/llms/ovhcloud/audio_transcription/transformation.py
@@ -156,5 +156,13 @@ class OVHCloudAudioTranscriptionConfig(BaseAudioTranscriptionConfig):
         text = response_json.get("text") or response_json.get("transcript") or ""
         response = TranscriptionResponse(text=text)
 
+        # OVHCloud field migration (deadline: 2026-05-11):
+        # `duration` is replaced by `seconds` in STT responses.
+        # Prefer `seconds`, fall back to `duration`, normalize to `duration`
+        # so downstream consumers see a consistent key.
+        duration = response_json.get("seconds") or response_json.get("duration")
+        if duration is not None:
+            response_json["duration"] = duration
+
         response._hidden_params = response_json
         return response
diff --git a/litellm/llms/ovhcloud/chat/transformation.py b/litellm/llms/ovhcloud/chat/transformation.py
index ae9271ddb16..4100c548f2c 100644
--- a/litellm/llms/ovhcloud/chat/transformation.py
+++ b/litellm/llms/ovhcloud/chat/transformation.py
@@ -98,10 +98,16 @@ class OVHCloudChatCompletionStreamingHandler(BaseModelResponseIterator):
 
             new_choices = []
             for choice in chunk["choices"]:
-                if "delta" in choice and "reasoning" in choice["delta"]:
-                    choice["delta"]["reasoning_content"] = choice["delta"].get(
-                        "reasoning"
-                    )
+                if "delta" in choice:
+                    delta = choice["delta"]
+                    # OVHCloud field migration (deadline: 2026-05-11):
+                    # `reasoning_content` is replaced by `reasoning`.
+                    # Normalise to `reasoning_content` so downstream consumers
+                    # see a consistent key during the transition window.
+                    reasoning_new = delta.get("reasoning")
+                    reasoning_legacy = delta.get("reasoning_content")
+                    if reasoning_new is not None and reasoning_legacy is None:
+                        delta["reasoning_content"] = reasoning_new
                 new_choices.append(choice)
 
             return ModelResponseStream(
diff --git a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_audio_transcription_transformation.py b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_audio_transcription_transformation.py
index 8cc46dc98d0..e9abf50ba75 100644
--- a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_audio_transcription_transformation.py
+++ b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_audio_transcription_transformation.py
@@ -54,3 +54,46 @@ def test_ovhcloud_audio_transcription_config_installed():
 
     assert config is not None
     assert isinstance(config, BaseAudioTranscriptionConfig)
+
+
+
+class TestOVHCloudDurationFieldMigration:
+    """Tests for OVHCloud duration -> seconds field migration."""
+
+    def test_seconds_field_mapped_to_duration(self):
+        """New `seconds` field should be normalized to `duration`."""
+        from litellm.llms.ovhcloud.audio_transcription.transformation import (
+            OVHCloudAudioTranscriptionConfig,
+        )
+        from unittest.mock import MagicMock
+
+        config = OVHCloudAudioTranscriptionConfig()
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "text": "Hello world",
+            "seconds": 3.14,
+        }
+
+        result = config.transform_audio_transcription_response(mock_response)
+
+        assert result.text == "Hello world"
+        assert result._hidden_params["duration"] == 3.14
+
+    def test_legacy_duration_field_still_works(self):
+        """Legacy `duration` field should still be accepted."""
+        from litellm.llms.ovhcloud.audio_transcription.transformation import (
+            OVHCloudAudioTranscriptionConfig,
+        )
+        from unittest.mock import MagicMock
+
+        config = OVHCloudAudioTranscriptionConfig()
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "text": "Hello world",
+            "duration": 2.71,
+        }
+
+        result = config.transform_audio_transcription_response(mock_response)
+
+        assert result.text == "Hello world"
+        assert result._hidden_params["duration"] == 2.71
\ No newline at end of file
diff --git a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
index a1b3b31f786..88ce3b4c296 100644
--- a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
+++ b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
@@ -292,3 +292,76 @@ def test_ovhcloud_with_custom_base_url():
 
 if __name__ == "__main__":
     pytest.main([__file__, "-v"])
+
+
+class TestOVHCloudReasoningFieldMigration:
+    """Tests for OVHCloud reasoning_content -> reasoning field migration."""
+
+    def test_streaming_new_reasoning_field(self):
+        """New `reasoning` field should be mapped to `reasoning_content`."""
+        handler = OVHCloudChatCompletionStreamingHandler(
+            streaming_response=iter([]),
+                        sync_stream=True,
+        )
+        chunk = {
+            "id": "test-id",
+            "created": 1234567890,
+            "model": "test-model",
+            "choices": [
+                {
+                    "delta": {
+                        "role": "assistant",
+                        "reasoning": "Let me think...",
+                    },
+                    "index": 0,
+                }
+            ],
+        }
+        result = handler.chunk_parser(chunk)
+        assert result.choices[0]["delta"]["reasoning_content"] == "Let me think..."
+
+    def test_streaming_legacy_reasoning_content_unchanged(self):
+        """Legacy `reasoning_content` field should pass through untouched."""
+        handler = OVHCloudChatCompletionStreamingHandler(
+            streaming_response=iter([]),
+                        sync_stream=True,
+        )
+        chunk = {
+            "id": "test-id",
+            "created": 1234567890,
+            "model": "test-model",
+            "choices": [
+                {
+                    "delta": {
+                        "role": "assistant",
+                        "reasoning_content": "Already correct field.",
+                    },
+                    "index": 0,
+                }
+            ],
+        }
+        result = handler.chunk_parser(chunk)
+        assert result.choices[0]["delta"]["reasoning_content"] == "Already correct field."
+
+    def test_streaming_both_fields_legacy_wins(self):
+        """When both fields present, existing `reasoning_content` is not overwritten."""
+        handler = OVHCloudChatCompletionStreamingHandler(
+            streaming_response=iter([]),
+                        sync_stream=True,
+        )
+        chunk = {
+            "id": "test-id",
+            "created": 1234567890,
+            "model": "test-model",
+            "choices": [
+                {
+                    "delta": {
+                        "reasoning": "new field",
+                        "reasoning_content": "legacy field",
+                    },
+                    "index": 0,
+                }
+            ],
+        }
+        result = handler.chunk_parser(chunk)
+        assert result.choices[0]["delta"]["reasoning_content"] == "legacy field"
\ No newline at end of file

From e55e73d69b0be420a7092fcfa1159db2b7bd2d0e Mon Sep 17 00:00:00 2001
From: KunalG67 <kunalgarhewal13@gmail.com>
Date: Mon, 27 Apr 2026 17:37:27 +0530
Subject: [PATCH 02/33] fix(ovhcloud): use explicit None check for seconds
 field in STT response

Replaces falsy or with explicit is not None check so that a valid
seconds=0.0 value is not silently dropped during field migration.

Addresses Greptile review feedback on #26595
---
 .../audio_transcription/transformation.py       |  6 +++++-
 ...hcloud_audio_transcription_transformation.py | 17 ++++++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/litellm/llms/ovhcloud/audio_transcription/transformation.py b/litellm/llms/ovhcloud/audio_transcription/transformation.py
index e3c8308d507..f49f31d7ecd 100644
--- a/litellm/llms/ovhcloud/audio_transcription/transformation.py
+++ b/litellm/llms/ovhcloud/audio_transcription/transformation.py
@@ -160,7 +160,11 @@ class OVHCloudAudioTranscriptionConfig(BaseAudioTranscriptionConfig):
         # `duration` is replaced by `seconds` in STT responses.
         # Prefer `seconds`, fall back to `duration`, normalize to `duration`
         # so downstream consumers see a consistent key.
-        duration = response_json.get("seconds") or response_json.get("duration")
+        duration = (
+            response_json["seconds"]
+            if "seconds" in response_json and response_json["seconds"] is not None
+            else response_json.get("duration")
+        )
         if duration is not None:
             response_json["duration"] = duration
 
diff --git a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_audio_transcription_transformation.py b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_audio_transcription_transformation.py
index e9abf50ba75..c8751fb2d95 100644
--- a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_audio_transcription_transformation.py
+++ b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_audio_transcription_transformation.py
@@ -96,4 +96,19 @@ class TestOVHCloudDurationFieldMigration:
         result = config.transform_audio_transcription_response(mock_response)
 
         assert result.text == "Hello world"
-        assert result._hidden_params["duration"] == 2.71
\ No newline at end of file
+        assert result._hidden_params["duration"] == 2.71
+
+
+
+    def test_seconds_zero_mapped_to_duration(self):
+        """seconds=0.0 must not be treated as falsy and lost."""
+        from litellm.llms.ovhcloud.audio_transcription.transformation import (
+            OVHCloudAudioTranscriptionConfig,
+        )
+        from unittest.mock import MagicMock
+
+        config = OVHCloudAudioTranscriptionConfig()
+        mock_response = MagicMock()
+        mock_response.json.return_value = {"text": "silence", "seconds": 0.0}
+        result = config.transform_audio_transcription_response(mock_response)
+        assert result._hidden_params["duration"] == 0.0        
\ No newline at end of file

From c0da139540345e1319c5936435f611a6aa307c44 Mon Sep 17 00:00:00 2001
From: Aneesh-Fiddler <aneeshfiddler@gmail.com>
Date: Mon, 27 Apr 2026 22:51:39 +0530
Subject: [PATCH 03/33] fix(otel): populate gen_ai.output.messages and
 gen_ai.system_instructions for Responses API

Fixes #25840

The OTel integration's set_attributes() method never populates
gen_ai.output.messages, gen_ai.system_instructions, or
gen_ai.response.finish_reasons for /v1/responses calls because
ResponsesAPIResponse uses 'output' instead of 'choices' and the
system prompt arrives as 'instructions' instead of 'system_instructions'.

Changes:
- Add elif branch for response_obj.get('output') to extract response
  text from Responses API output items (type='message'/output_text)
  and tool calls (type='function_call')
- Coalesce system_instructions/instructions/system kwargs so the
  system prompt is captured for Responses API, Anthropic Messages
  API, and Vertex AI Gemini paths
- Handle plain-string system prompts without unnecessary wrapping
- Extract response_obj.get('status') as finish reason for Responses API
- Add _transform_responses_api_output_to_otel() method
---
 litellm/integrations/opentelemetry.py | 111 +++++++++++++++++++++++---
 1 file changed, 101 insertions(+), 10 deletions(-)

diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py
index b6d91d0b76d..b26850657d3 100644
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@@ -1678,17 +1678,35 @@ class OpenTelemetry(CustomLogger):
                     value=safe_dumps(transformed_messages),
                 )
 
-            if kwargs.get("system_instructions"):
-                transformed_system_instructions = (
-                    self._transform_messages_to_otel_semantic_conventions(
-                        kwargs.get("system_instructions")
+            # Coalesce the different kwarg names that carry the system
+            # prompt depending on the call path:
+            #   - "system_instructions" — Vertex AI Gemini chat-completion
+            #   - "instructions"        — OpenAI Responses API
+            #   - "system"              — Anthropic Messages API
+            system_instructions = (
+                kwargs.get("system_instructions")
+                or kwargs.get("instructions")
+                or kwargs.get("system")
+            )
+            if system_instructions:
+                if isinstance(system_instructions, str):
+                    # Plain text system prompt — no transformation needed
+                    self.safe_set_attribute(
+                        span=span,
+                        key=SpanAttributes.GEN_AI_SYSTEM_INSTRUCTIONS.value,
+                        value=system_instructions,
+                    )
+                else:
+                    transformed_system_instructions = (
+                        self._transform_messages_to_otel_semantic_conventions(
+                            system_instructions
+                        )
+                    )
+                    self.safe_set_attribute(
+                        span=span,
+                        key=SpanAttributes.GEN_AI_SYSTEM_INSTRUCTIONS.value,
+                        value=safe_dumps(transformed_system_instructions),
                     )
-                )
-                self.safe_set_attribute(
-                    span=span,
-                    key=SpanAttributes.GEN_AI_SYSTEM_INSTRUCTIONS.value,
-                    value=safe_dumps(transformed_system_instructions),
-                )
 
             self.safe_set_attribute(
                 span=span,
@@ -1747,6 +1765,32 @@ class OpenTelemetry(CustomLogger):
                                         value=value,
                                     )
 
+                elif response_obj.get("output"):
+                    # Responses API: ResponsesAPIResponse has an "output"
+                    # list instead of "choices".  Each item with
+                    # type="message" contains a "content" list of
+                    # OutputText objects (type="output_text").
+                    output_messages = (
+                        self._transform_responses_api_output_to_otel(
+                            response_obj.get("output")
+                        )
+                    )
+                    if output_messages:
+                        self.safe_set_attribute(
+                            span=span,
+                            key=SpanAttributes.GEN_AI_OUTPUT_MESSAGES.value,
+                            value=safe_dumps(output_messages),
+                        )
+
+                    # Extract finish reason from ResponsesAPIResponse.status
+                    status = response_obj.get("status")
+                    if status:
+                        self.safe_set_attribute(
+                            span=span,
+                            key=SpanAttributes.GEN_AI_RESPONSE_FINISH_REASONS.value,
+                            value=safe_dumps([status]),
+                        )
+
         except Exception as e:
             self.handle_callback_failure(
                 callback_name=self.callback_name or "opentelemetry"
@@ -1842,6 +1886,53 @@ class OpenTelemetry(CustomLogger):
             transformed.append(transformed_msg)
         return transformed
 
+    def _transform_responses_api_output_to_otel(
+        self, output: List[dict]
+    ) -> List[dict]:
+        """
+        Transform Responses API output items into OTEL GenAI 1.38 format.
+
+        The Responses API returns output as a list of items, each with a
+        ``type`` field.  Message items (``type="message"``) contain a
+        ``content`` list of ``OutputText`` objects with ``type="output_text"``
+        and ``text`` fields.
+
+        This method converts them to the same ``{"role": ..., "parts": [...]}``
+        format used by ``_transform_choices_to_otel_semantic_conventions``.
+        """
+        transformed = []
+        for item in output:
+            if not isinstance(item, dict):
+                continue
+            if item.get("type") == "message":
+                role = item.get("role", "assistant")
+                parts = []
+                for content in item.get("content", []):
+                    if not isinstance(content, dict):
+                        continue
+                    if content.get("type") == "output_text":
+                        text = content.get("text", "")
+                        if text:
+                            parts.append({"type": "text", "content": text})
+                if parts:
+                    transformed.append({"role": role, "parts": parts})
+            elif item.get("type") == "function_call":
+                # Surface tool calls from Responses API output
+                tool_call = {
+                    "role": "assistant",
+                    "parts": [
+                        {
+                            "type": "tool_call",
+                            "name": item.get("name", ""),
+                            "arguments": item.get("arguments", ""),
+                        }
+                    ],
+                }
+                if item.get("call_id"):
+                    tool_call["parts"][0]["id"] = item["call_id"]
+                transformed.append(tool_call)
+        return transformed
+
     def set_raw_request_attributes(self, span: Span, kwargs, response_obj):
         try:
             # Only set provider-specific raw payload attributes on this span.

From 4d2e13c9070b74b0945613516e09917e15421023 Mon Sep 17 00:00:00 2001
From: Aneesh-Fiddler <aneeshfiddler@gmail.com>
Date: Mon, 27 Apr 2026 23:12:34 +0530
Subject: [PATCH 04/33] test(otel): add tests for Responses API output
 messages, system instructions, and finish reasons

Add 21 tests covering the new Responses API OTel attribute handling:

TestOpenTelemetryResponsesAPI (13 tests):
- gen_ai.output.messages from output items (text, function_call, mixed, multi-part)
- gen_ai.response.finish_reasons from ResponsesAPIResponse.status
- gen_ai.system_instructions from instructions/system/system_instructions kwargs
- Precedence and absence edge cases
- Regression test for existing choices-based responses

TestTransformResponsesAPIOutput (8 tests):
- Message with output_text, function_call items, unknown types
- Edge cases: empty output, empty text, missing call_id, default role, non-dict items
---
 .../integrations/test_opentelemetry.py        | 456 ++++++++++++++++++
 1 file changed, 456 insertions(+)

diff --git a/tests/test_litellm/integrations/test_opentelemetry.py b/tests/test_litellm/integrations/test_opentelemetry.py
index f7106471894..5f294005641 100644
--- a/tests/test_litellm/integrations/test_opentelemetry.py
+++ b/tests/test_litellm/integrations/test_opentelemetry.py
@@ -2859,3 +2859,459 @@ class TestResponseIdFallback(unittest.TestCase):
         otel.set_attributes(mock_span, kwargs, response_obj)
 
         mock_span.set_attribute.assert_any_call("litellm.call_id", call_id)
+
+
+
+class TestOpenTelemetryResponsesAPI(unittest.TestCase):
+    """
+    Tests for Responses API (/v1/responses) OTel span attributes.
+
+    The Responses API uses ``output`` (list of output items) instead of
+    ``choices``, ``instructions`` instead of ``system_instructions``, and
+    ``status`` instead of per-choice ``finish_reason``.
+
+    See: https://github.com/BerriAI/litellm/issues/25840
+    """
+
+    def _base_kwargs(self, **overrides):
+        """Return minimal kwargs for set_attributes with Responses API defaults."""
+        kwargs = {
+            "model": "gpt-4o",
+            "messages": [{"role": "user", "content": "What is 2+2?"}],
+            "optional_params": {},
+            "litellm_params": {"custom_llm_provider": "openai"},
+            "standard_logging_object": {
+                "id": "resp_abc123",
+                "call_type": "responses",
+                "metadata": {},
+            },
+        }
+        kwargs.update(overrides)
+        return kwargs
+
+    def _responses_api_response_obj(self, text="The answer is 4.", status="completed"):
+        """Return a dict mimicking ResponsesAPIResponse with a message output."""
+        return {
+            "id": "resp_abc123",
+            "model": "gpt-4o",
+            "status": status,
+            "output": [
+                {
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [
+                        {
+                            "type": "output_text",
+                            "text": text,
+                        }
+                    ],
+                }
+            ],
+            "usage": {
+                "prompt_tokens": 10,
+                "completion_tokens": 20,
+                "total_tokens": 30,
+            },
+        }
+
+    def _get_attr(self, mock_span, attr_name):
+        """Extract the value set for a specific attribute name, or None."""
+        calls = [
+            call
+            for call in mock_span.set_attribute.call_args_list
+            if call[0][0] == attr_name
+        ]
+        if not calls:
+            return None
+        return calls[0][0][1]
+
+    # ------------------------------------------------------------------
+    # gen_ai.output.messages
+    # ------------------------------------------------------------------
+
+    def test_output_messages_populated_for_responses_api(self):
+        """gen_ai.output.messages must be set when response has output items."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        kwargs = self._base_kwargs()
+        response_obj = self._responses_api_response_obj(text="The answer is 4.")
+
+        otel.set_attributes(span=mock_span, kwargs=kwargs, response_obj=response_obj)
+
+        raw = self._get_attr(mock_span, "gen_ai.output.messages")
+        self.assertIsNotNone(raw, "gen_ai.output.messages should be set")
+
+        parsed = json.loads(raw)
+        self.assertIsInstance(parsed, list)
+        self.assertEqual(len(parsed), 1)
+        self.assertEqual(parsed[0]["role"], "assistant")
+        self.assertIn("parts", parsed[0])
+        self.assertEqual(parsed[0]["parts"][0]["type"], "text")
+        self.assertEqual(parsed[0]["parts"][0]["content"], "The answer is 4.")
+
+    def test_output_messages_with_multiple_content_items(self):
+        """Multiple output_text items in a single message should all appear as parts."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        response_obj = {
+            "id": "resp_multi",
+            "model": "gpt-4o",
+            "status": "completed",
+            "output": [
+                {
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [
+                        {"type": "output_text", "text": "First paragraph."},
+                        {"type": "output_text", "text": "Second paragraph."},
+                    ],
+                }
+            ],
+        }
+
+        otel.set_attributes(
+            span=mock_span, kwargs=self._base_kwargs(), response_obj=response_obj
+        )
+
+        raw = self._get_attr(mock_span, "gen_ai.output.messages")
+        parsed = json.loads(raw)
+        self.assertEqual(len(parsed[0]["parts"]), 2)
+        self.assertEqual(parsed[0]["parts"][0]["content"], "First paragraph.")
+        self.assertEqual(parsed[0]["parts"][1]["content"], "Second paragraph.")
+
+    def test_output_messages_with_function_call(self):
+        """function_call output items should appear as tool_call parts."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        response_obj = {
+            "id": "resp_fc",
+            "model": "gpt-4o",
+            "status": "completed",
+            "output": [
+                {
+                    "type": "function_call",
+                    "name": "get_weather",
+                    "call_id": "call_abc",
+                    "arguments": '{"location": "SF"}',
+                }
+            ],
+        }
+
+        otel.set_attributes(
+            span=mock_span, kwargs=self._base_kwargs(), response_obj=response_obj
+        )
+
+        raw = self._get_attr(mock_span, "gen_ai.output.messages")
+        parsed = json.loads(raw)
+        self.assertEqual(len(parsed), 1)
+        self.assertEqual(parsed[0]["role"], "assistant")
+        self.assertEqual(parsed[0]["parts"][0]["type"], "tool_call")
+        self.assertEqual(parsed[0]["parts"][0]["name"], "get_weather")
+        self.assertEqual(parsed[0]["parts"][0]["arguments"], '{"location": "SF"}')
+        self.assertEqual(parsed[0]["parts"][0]["id"], "call_abc")
+
+    def test_output_messages_mixed_message_and_function_call(self):
+        """Mixed output with both message and function_call items."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        response_obj = {
+            "id": "resp_mixed",
+            "model": "gpt-4o",
+            "status": "completed",
+            "output": [
+                {
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [
+                        {"type": "output_text", "text": "Let me check the weather."},
+                    ],
+                },
+                {
+                    "type": "function_call",
+                    "name": "get_weather",
+                    "call_id": "call_xyz",
+                    "arguments": "{}",
+                },
+            ],
+        }
+
+        otel.set_attributes(
+            span=mock_span, kwargs=self._base_kwargs(), response_obj=response_obj
+        )
+
+        raw = self._get_attr(mock_span, "gen_ai.output.messages")
+        parsed = json.loads(raw)
+        self.assertEqual(len(parsed), 2)
+        self.assertEqual(parsed[0]["role"], "assistant")
+        self.assertEqual(parsed[0]["parts"][0]["content"], "Let me check the weather.")
+        self.assertEqual(parsed[1]["parts"][0]["type"], "tool_call")
+
+    def test_output_messages_empty_text_skipped(self):
+        """Output items with empty text should not produce parts."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        response_obj = {
+            "id": "resp_empty",
+            "model": "gpt-4o",
+            "status": "completed",
+            "output": [
+                {
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [{"type": "output_text", "text": ""}],
+                }
+            ],
+        }
+
+        otel.set_attributes(
+            span=mock_span, kwargs=self._base_kwargs(), response_obj=response_obj
+        )
+
+        # No output messages should be set since the text is empty
+        raw = self._get_attr(mock_span, "gen_ai.output.messages")
+        self.assertIsNone(raw, "Empty output text should not produce gen_ai.output.messages")
+
+    def test_choices_still_work(self):
+        """Existing choices-based responses must still work (no regression)."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        kwargs = {
+            "model": "gpt-4",
+            "messages": [{"role": "user", "content": "Hello"}],
+            "optional_params": {},
+            "litellm_params": {"custom_llm_provider": "openai"},
+            "standard_logging_object": {
+                "id": "test-id",
+                "call_type": "completion",
+                "metadata": {},
+            },
+        }
+
+        response_obj = {
+            "id": "chatcmpl-123",
+            "model": "gpt-4",
+            "choices": [
+                {
+                    "finish_reason": "stop",
+                    "message": {"role": "assistant", "content": "Hi there!"},
+                }
+            ],
+            "usage": {"prompt_tokens": 5, "completion_tokens": 10, "total_tokens": 15},
+        }
+
+        otel.set_attributes(span=mock_span, kwargs=kwargs, response_obj=response_obj)
+
+        raw = self._get_attr(mock_span, "gen_ai.output.messages")
+        parsed = json.loads(raw)
+        self.assertEqual(parsed[0]["parts"][0]["content"], "Hi there!")
+        self.assertEqual(parsed[0]["finish_reason"], "stop")
+
+    # ------------------------------------------------------------------
+    # gen_ai.response.finish_reasons
+    # ------------------------------------------------------------------
+
+    def test_finish_reasons_from_status(self):
+        """gen_ai.response.finish_reasons should use ResponsesAPIResponse.status."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        otel.set_attributes(
+            span=mock_span,
+            kwargs=self._base_kwargs(),
+            response_obj=self._responses_api_response_obj(status="completed"),
+        )
+
+        raw = self._get_attr(mock_span, "gen_ai.response.finish_reasons")
+        self.assertIsNotNone(raw)
+        parsed = json.loads(raw)
+        self.assertEqual(parsed, ["completed"])
+
+    def test_finish_reasons_incomplete_status(self):
+        """Non-completed status values should still be captured."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        otel.set_attributes(
+            span=mock_span,
+            kwargs=self._base_kwargs(),
+            response_obj=self._responses_api_response_obj(status="incomplete"),
+        )
+
+        raw = self._get_attr(mock_span, "gen_ai.response.finish_reasons")
+        parsed = json.loads(raw)
+        self.assertEqual(parsed, ["incomplete"])
+
+    # ------------------------------------------------------------------
+    # gen_ai.system_instructions
+    # ------------------------------------------------------------------
+
+    def test_system_instructions_from_instructions_kwarg(self):
+        """Responses API passes system prompt as kwargs['instructions']."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        kwargs = self._base_kwargs(instructions="You are a math tutor.")
+        response_obj = self._responses_api_response_obj()
+
+        otel.set_attributes(span=mock_span, kwargs=kwargs, response_obj=response_obj)
+
+        value = self._get_attr(mock_span, "gen_ai.system_instructions")
+        self.assertEqual(value, "You are a math tutor.")
+
+    def test_system_instructions_from_system_kwarg(self):
+        """Anthropic Messages API passes system prompt as kwargs['system']."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        kwargs = self._base_kwargs(system="You are a helpful assistant.")
+        response_obj = self._responses_api_response_obj()
+
+        otel.set_attributes(span=mock_span, kwargs=kwargs, response_obj=response_obj)
+
+        value = self._get_attr(mock_span, "gen_ai.system_instructions")
+        self.assertEqual(value, "You are a helpful assistant.")
+
+    def test_system_instructions_from_system_instructions_kwarg(self):
+        """Vertex AI Gemini path uses kwargs['system_instructions'] (existing behavior)."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        kwargs = self._base_kwargs(
+            system_instructions=[{"role": "system", "content": "Be concise."}]
+        )
+        response_obj = self._responses_api_response_obj()
+
+        otel.set_attributes(span=mock_span, kwargs=kwargs, response_obj=response_obj)
+
+        raw = self._get_attr(mock_span, "gen_ai.system_instructions")
+        self.assertIsNotNone(raw)
+        parsed = json.loads(raw)
+        self.assertEqual(parsed[0]["role"], "system")
+        self.assertIn("parts", parsed[0])
+
+    def test_system_instructions_precedence(self):
+        """system_instructions takes precedence over instructions and system."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        kwargs = self._base_kwargs(
+            system_instructions="From Gemini",
+            instructions="From Responses API",
+            system="From Anthropic",
+        )
+        response_obj = self._responses_api_response_obj()
+
+        otel.set_attributes(span=mock_span, kwargs=kwargs, response_obj=response_obj)
+
+        # system_instructions (string) should win — it's checked first
+        value = self._get_attr(mock_span, "gen_ai.system_instructions")
+        self.assertEqual(value, "From Gemini")
+
+    def test_no_system_instructions_when_absent(self):
+        """No gen_ai.system_instructions attr when none of the kwargs are set."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        kwargs = self._base_kwargs()
+        response_obj = self._responses_api_response_obj()
+
+        otel.set_attributes(span=mock_span, kwargs=kwargs, response_obj=response_obj)
+
+        value = self._get_attr(mock_span, "gen_ai.system_instructions")
+        self.assertIsNone(value)
+
+
+class TestTransformResponsesAPIOutput(unittest.TestCase):
+    """
+    Unit tests for _transform_responses_api_output_to_otel.
+    """
+
+    def test_message_with_output_text(self):
+        otel = OpenTelemetry()
+        output = [
+            {
+                "type": "message",
+                "role": "assistant",
+                "content": [{"type": "output_text", "text": "Hello!"}],
+            }
+        ]
+        result = otel._transform_responses_api_output_to_otel(output)
+        self.assertEqual(len(result), 1)
+        self.assertEqual(result[0]["role"], "assistant")
+        self.assertEqual(result[0]["parts"], [{"type": "text", "content": "Hello!"}])
+
+    def test_function_call_item(self):
+        otel = OpenTelemetry()
+        output = [
+            {
+                "type": "function_call",
+                "name": "search",
+                "call_id": "call_1",
+                "arguments": '{"q": "test"}',
+            }
+        ]
+        result = otel._transform_responses_api_output_to_otel(output)
+        self.assertEqual(len(result), 1)
+        self.assertEqual(result[0]["role"], "assistant")
+        self.assertEqual(result[0]["parts"][0]["type"], "tool_call")
+        self.assertEqual(result[0]["parts"][0]["name"], "search")
+        self.assertEqual(result[0]["parts"][0]["id"], "call_1")
+
+    def test_function_call_without_call_id(self):
+        otel = OpenTelemetry()
+        output = [
+            {
+                "type": "function_call",
+                "name": "search",
+                "arguments": "{}",
+            }
+        ]
+        result = otel._transform_responses_api_output_to_otel(output)
+        self.assertNotIn("id", result[0]["parts"][0])
+
+    def test_unknown_type_ignored(self):
+        otel = OpenTelemetry()
+        output = [{"type": "reasoning", "content": "thinking..."}]
+        result = otel._transform_responses_api_output_to_otel(output)
+        self.assertEqual(result, [])
+
+    def test_non_dict_items_ignored(self):
+        otel = OpenTelemetry()
+        output = ["not a dict", 42, None]
+        result = otel._transform_responses_api_output_to_otel(output)
+        self.assertEqual(result, [])
+
+    def test_empty_output(self):
+        otel = OpenTelemetry()
+        result = otel._transform_responses_api_output_to_otel([])
+        self.assertEqual(result, [])
+
+    def test_message_with_empty_text_skipped(self):
+        otel = OpenTelemetry()
+        output = [
+            {
+                "type": "message",
+                "role": "assistant",
+                "content": [{"type": "output_text", "text": ""}],
+            }
+        ]
+        result = otel._transform_responses_api_output_to_otel(output)
+        self.assertEqual(result, [])
+
+    def test_message_default_role(self):
+        """Messages without explicit role should default to assistant."""
+        otel = OpenTelemetry()
+        output = [
+            {
+                "type": "message",
+                "content": [{"type": "output_text", "text": "Hi"}],
+            }
+        ]
+        result = otel._transform_responses_api_output_to_otel(output)
+        self.assertEqual(result[0]["role"], "assistant")

From e70b0c97a4c8d6aef4efd7d1738172acfe4510ea Mon Sep 17 00:00:00 2001
From: Aneesh-Fiddler <aneeshfiddler@gmail.com>
Date: Tue, 28 Apr 2026 11:26:14 +0530
Subject: [PATCH 05/33] style: apply black formatting to opentelemetry.py

---
 litellm/integrations/opentelemetry.py | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py
index b26850657d3..664aeadc7c2 100644
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@@ -1770,10 +1770,8 @@ class OpenTelemetry(CustomLogger):
                     # list instead of "choices".  Each item with
                     # type="message" contains a "content" list of
                     # OutputText objects (type="output_text").
-                    output_messages = (
-                        self._transform_responses_api_output_to_otel(
-                            response_obj.get("output")
-                        )
+                    output_messages = self._transform_responses_api_output_to_otel(
+                        response_obj.get("output")
                     )
                     if output_messages:
                         self.safe_set_attribute(
@@ -1886,9 +1884,7 @@ class OpenTelemetry(CustomLogger):
             transformed.append(transformed_msg)
         return transformed
 
-    def _transform_responses_api_output_to_otel(
-        self, output: List[dict]
-    ) -> List[dict]:
+    def _transform_responses_api_output_to_otel(self, output: List[dict]) -> List[dict]:
         """
         Transform Responses API output items into OTEL GenAI 1.38 format.
 

From c30d58f7e30a0568c265814d70cea2301bea51a4 Mon Sep 17 00:00:00 2001
From: Aneesh-Fiddler <aneeshfiddler@gmail.com>
Date: Tue, 28 Apr 2026 12:30:39 +0530
Subject: [PATCH 06/33] fix: resolve mypy indexed assignment error in
 function_call handling

Build the tool_call part dict separately with an explicit type
annotation so mypy can track the type, avoiding the
'Unsupported target for indexed assignment' error on
tool_call["parts"][0]["id"].
---
 litellm/integrations/opentelemetry.py | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py
index 664aeadc7c2..8084a9d0f22 100644
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@@ -1914,19 +1914,14 @@ class OpenTelemetry(CustomLogger):
                     transformed.append({"role": role, "parts": parts})
             elif item.get("type") == "function_call":
                 # Surface tool calls from Responses API output
-                tool_call = {
-                    "role": "assistant",
-                    "parts": [
-                        {
-                            "type": "tool_call",
-                            "name": item.get("name", ""),
-                            "arguments": item.get("arguments", ""),
-                        }
-                    ],
+                part: dict = {
+                    "type": "tool_call",
+                    "name": item.get("name", ""),
+                    "arguments": item.get("arguments", ""),
                 }
                 if item.get("call_id"):
-                    tool_call["parts"][0]["id"] = item["call_id"]
-                transformed.append(tool_call)
+                    part["id"] = item["call_id"]
+                transformed.append({"role": "assistant", "parts": [part]})
         return transformed
 
     def set_raw_request_attributes(self, span: Span, kwargs, response_obj):

From 466b4ddae31beb94635f72adc796d731b485930f Mon Sep 17 00:00:00 2001
From: Aneesh-Fiddler <aneeshfiddler@gmail.com>
Date: Tue, 28 Apr 2026 13:33:33 +0530
Subject: [PATCH 07/33] =?UTF-8?q?fix:=20address=20review=20comments=20?=
 =?UTF-8?q?=E2=80=94=20Pydantic=20compat,=20falsy=20fallthrough,=20per-too?=
 =?UTF-8?q?l-call=20attrs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace isinstance(item, dict) with hasattr(item, 'get') so Pydantic
  model instances (ResponseOutputMessage, ResponseFunctionToolCall) are
  accepted alongside plain dicts (P1)
- Use 'is not None' guards instead of or-chain for system_instructions
  coalescing to prevent falsy values (e.g. []) falling through to the
  wrong kwarg (P2)
- Emit per-tool-call span attributes (gen_ai.completion.N.function_call.*)
  for Responses API function_call items, matching the choices branch
  parity with _tool_calls_kv_pair (P2)
- Add 4 new tests: Pydantic-like objects, falsy fallthrough guard,
  per-tool-call attribute emission, multiple tool call indexing
---
 litellm/integrations/opentelemetry.py         |  62 ++++++-
 .../integrations/test_opentelemetry.py        | 171 ++++++++++++++++++
 2 files changed, 227 insertions(+), 6 deletions(-)

diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py
index 8084a9d0f22..90e647d86bf 100644
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@@ -1683,10 +1683,16 @@ class OpenTelemetry(CustomLogger):
             #   - "system_instructions" — Vertex AI Gemini chat-completion
             #   - "instructions"        — OpenAI Responses API
             #   - "system"              — Anthropic Messages API
+            # Use `is not None` rather than truthiness to avoid falsy
+            # values (e.g. []) falling through to the wrong kwarg.
             system_instructions = (
                 kwargs.get("system_instructions")
-                or kwargs.get("instructions")
-                or kwargs.get("system")
+                if kwargs.get("system_instructions") is not None
+                else (
+                    kwargs.get("instructions")
+                    if kwargs.get("instructions") is not None
+                    else kwargs.get("system")
+                )
             )
             if system_instructions:
                 if isinstance(system_instructions, str):
@@ -1770,8 +1776,9 @@ class OpenTelemetry(CustomLogger):
                     # list instead of "choices".  Each item with
                     # type="message" contains a "content" list of
                     # OutputText objects (type="output_text").
+                    output_items = response_obj.get("output")
                     output_messages = self._transform_responses_api_output_to_otel(
-                        response_obj.get("output")
+                        output_items
                     )
                     if output_messages:
                         self.safe_set_attribute(
@@ -1780,6 +1787,43 @@ class OpenTelemetry(CustomLogger):
                             value=safe_dumps(output_messages),
                         )
 
+                    # Emit per-tool-call span attributes (parity with
+                    # the choices branch that calls _tool_calls_kv_pair).
+                    # Convert Responses API function_call items to the
+                    # ChatCompletionMessageToolCall format expected by
+                    # _tool_calls_kv_pair.
+                    tool_calls = []
+                    for out_item in output_items:
+                        if (
+                            hasattr(out_item, "get")
+                            and out_item.get("type") == "function_call"
+                        ):
+                            tool_calls.append(
+                                {
+                                    "function": {
+                                        "name": out_item.get("name", ""),
+                                        "arguments": out_item.get("arguments", ""),
+                                    }
+                                }
+                            )
+                    if tool_calls:
+                        kv_pairs = OpenTelemetry._tool_calls_kv_pair(tool_calls)  # type: ignore
+                        for key, value in kv_pairs.items():
+                            self.safe_set_attribute(
+                                span=span,
+                                key=key,
+                                value=value,
+                            )
+
+                    # Extract finish reason from ResponsesAPIResponse.status
+                    status = response_obj.get("status")
+                    if status:
+                        self.safe_set_attribute(
+                            span=span,
+                            key=SpanAttributes.GEN_AI_RESPONSE_FINISH_REASONS.value,
+                            value=safe_dumps([status]),
+                        )
+
                     # Extract finish reason from ResponsesAPIResponse.status
                     status = response_obj.get("status")
                     if status:
@@ -1884,7 +1928,7 @@ class OpenTelemetry(CustomLogger):
             transformed.append(transformed_msg)
         return transformed
 
-    def _transform_responses_api_output_to_otel(self, output: List[dict]) -> List[dict]:
+    def _transform_responses_api_output_to_otel(self, output: List) -> List[dict]:
         """
         Transform Responses API output items into OTEL GenAI 1.38 format.
 
@@ -1893,18 +1937,24 @@ class OpenTelemetry(CustomLogger):
         ``content`` list of ``OutputText`` objects with ``type="output_text"``
         and ``text`` fields.
 
+        Items may be plain dicts or Pydantic model instances (e.g.
+        ``ResponseOutputMessage``, ``ResponseFunctionToolCall``).  Both
+        expose a ``.get()`` method via ``BaseLiteLLMOpenAIResponseObject``,
+        so we use ``hasattr(item, "get")`` rather than ``isinstance(item,
+        dict)`` to accept either form.
+
         This method converts them to the same ``{"role": ..., "parts": [...]}``
         format used by ``_transform_choices_to_otel_semantic_conventions``.
         """
         transformed = []
         for item in output:
-            if not isinstance(item, dict):
+            if not hasattr(item, "get"):
                 continue
             if item.get("type") == "message":
                 role = item.get("role", "assistant")
                 parts = []
                 for content in item.get("content", []):
-                    if not isinstance(content, dict):
+                    if not hasattr(content, "get"):
                         continue
                     if content.get("type") == "output_text":
                         text = content.get("text", "")
diff --git a/tests/test_litellm/integrations/test_opentelemetry.py b/tests/test_litellm/integrations/test_opentelemetry.py
index 5f294005641..56aba4bc5ed 100644
--- a/tests/test_litellm/integrations/test_opentelemetry.py
+++ b/tests/test_litellm/integrations/test_opentelemetry.py
@@ -3315,3 +3315,174 @@ class TestTransformResponsesAPIOutput(unittest.TestCase):
         ]
         result = otel._transform_responses_api_output_to_otel(output)
         self.assertEqual(result[0]["role"], "assistant")
+
+
+    def test_pydantic_like_objects_accepted(self):
+        """Items with .get() but not isinstance(dict) should be accepted."""
+
+        class FakeOutputItem:
+            """Mimics BaseLiteLLMOpenAIResponseObject duck-typing."""
+
+            def __init__(self, data):
+                self._data = data
+
+            def get(self, key, default=None):
+                return self._data.get(key, default)
+
+        class FakeContent:
+            def __init__(self, data):
+                self._data = data
+
+            def get(self, key, default=None):
+                return self._data.get(key, default)
+
+        otel = OpenTelemetry()
+        output = [
+            FakeOutputItem(
+                {
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [
+                        FakeContent({"type": "output_text", "text": "Pydantic works!"}),
+                    ],
+                }
+            )
+        ]
+        result = otel._transform_responses_api_output_to_otel(output)
+        self.assertEqual(len(result), 1)
+        self.assertEqual(result[0]["parts"][0]["content"], "Pydantic works!")
+
+
+class TestSystemInstructionsPrecedence(unittest.TestCase):
+    """Tests for the is-not-None precedence in system_instructions coalescing."""
+
+    def _get_attr(self, mock_span, attr_name):
+        calls = [
+            call
+            for call in mock_span.set_attribute.call_args_list
+            if call[0][0] == attr_name
+        ]
+        if not calls:
+            return None
+        return calls[0][0][1]
+
+    def _base_kwargs(self, **overrides):
+        kwargs = {
+            "model": "gpt-4o",
+            "messages": [{"role": "user", "content": "Hi"}],
+            "optional_params": {},
+            "litellm_params": {"custom_llm_provider": "openai"},
+            "standard_logging_object": {
+                "id": "test-id",
+                "call_type": "responses",
+                "metadata": {},
+            },
+        }
+        kwargs.update(overrides)
+        return kwargs
+
+    def test_empty_list_system_instructions_does_not_fallthrough(self):
+        """An empty list for system_instructions should NOT fall through to instructions."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        kwargs = self._base_kwargs(
+            system_instructions=[],
+            instructions="Should not be used",
+        )
+        response_obj = {"id": "r1", "model": "gpt-4o"}
+
+        otel.set_attributes(span=mock_span, kwargs=kwargs, response_obj=response_obj)
+
+        # system_instructions is [] (falsy but not None), so it wins.
+        # Since it's an empty list, no attribute should be set (nothing to transform).
+        value = self._get_attr(mock_span, "gen_ai.system_instructions")
+        # The empty list is truthy for `is not None` but produces empty
+        # transformed output — the attribute should NOT contain "Should not be used".
+        if value is not None:
+            self.assertNotIn("Should not be used", str(value))
+
+
+class TestResponsesAPIToolCallSpanAttributes(unittest.TestCase):
+    """Tests for per-tool-call span attributes on Responses API function_call items."""
+
+    def _base_kwargs(self):
+        return {
+            "model": "gpt-4o",
+            "messages": [{"role": "user", "content": "What is the weather?"}],
+            "optional_params": {},
+            "litellm_params": {"custom_llm_provider": "openai"},
+            "standard_logging_object": {
+                "id": "resp_tc",
+                "call_type": "responses",
+                "metadata": {},
+            },
+        }
+
+    def test_per_tool_call_attributes_emitted(self):
+        """function_call output items should produce per-tool-call span attributes."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        response_obj = {
+            "id": "resp_tc",
+            "model": "gpt-4o",
+            "status": "completed",
+            "output": [
+                {
+                    "type": "function_call",
+                    "name": "get_weather",
+                    "call_id": "call_abc",
+                    "arguments": '{"location": "SF"}',
+                }
+            ],
+        }
+
+        otel.set_attributes(span=mock_span, kwargs=self._base_kwargs(), response_obj=response_obj)
+
+        # Verify per-tool-call attributes were set (same format as choices branch)
+        attr_names = [call[0][0] for call in mock_span.set_attribute.call_args_list]
+        tool_call_attrs = [a for a in attr_names if "function_call" in a]
+        self.assertTrue(len(tool_call_attrs) > 0, "Per-tool-call span attributes should be emitted")
+
+        # Verify the name attribute specifically
+        mock_span.set_attribute.assert_any_call(
+            "gen_ai.completion.0.function_call.name", "get_weather"
+        )
+        mock_span.set_attribute.assert_any_call(
+            "gen_ai.completion.0.function_call.arguments", '{"location": "SF"}'
+        )
+
+    def test_multiple_tool_calls_indexed(self):
+        """Multiple function_call items should be indexed correctly."""
+        otel = OpenTelemetry()
+        mock_span = MagicMock()
+
+        response_obj = {
+            "id": "resp_tc2",
+            "model": "gpt-4o",
+            "status": "completed",
+            "output": [
+                {
+                    "type": "function_call",
+                    "name": "get_weather",
+                    "call_id": "call_1",
+                    "arguments": "{}",
+                },
+                {
+                    "type": "function_call",
+                    "name": "get_time",
+                    "call_id": "call_2",
+                    "arguments": "{}",
+                },
+            ],
+        }
+
+        otel.set_attributes(span=mock_span, kwargs=self._base_kwargs(), response_obj=response_obj)
+
+        mock_span.set_attribute.assert_any_call(
+            "gen_ai.completion.0.function_call.name", "get_weather"
+        )
+        mock_span.set_attribute.assert_any_call(
+            "gen_ai.completion.1.function_call.name", "get_time"
+        )

From 982fed46321041c4bc46d02312aa731d6662bd88 Mon Sep 17 00:00:00 2001
From: KunalG67 <kunalgarhewal13@gmail.com>
Date: Tue, 28 Apr 2026 18:09:12 +0530
Subject: [PATCH 08/33] fix(ovhcloud): handle reasoning field migration in
 non-streaming responses

Adds transform_response to OVHCloudChatConfig to normalise the new

easoning field to 
easoning_content in non-streaming responses,
matching the existing streaming fix in chunk_parser.

Addresses maintainer feedback on #26595
---
 litellm/llms/ovhcloud/chat/transformation.py  | 50 ++++++++++++++++--
 .../test_ovhcloud_chat_transformation.py      | 52 ++++++++++++++++++-
 2 files changed, 97 insertions(+), 5 deletions(-)

diff --git a/litellm/llms/ovhcloud/chat/transformation.py b/litellm/llms/ovhcloud/chat/transformation.py
index 4100c548f2c..77d3683566c 100644
--- a/litellm/llms/ovhcloud/chat/transformation.py
+++ b/litellm/llms/ovhcloud/chat/transformation.py
@@ -5,17 +5,17 @@ Our unified API follows the OpenAI standard.
 More information on our website: https://endpoints.ai.cloud.ovh.net
 """
 
-from typing import Optional, Union, List
+from typing import Any, Optional, Union, List
 
 import httpx
-from litellm.utils import ModelResponseStream
+from litellm.utils import ModelResponse, ModelResponseStream
 from litellm.llms.openai.chat.gpt_transformation import OpenAIGPTConfig
 from litellm.llms.ovhcloud.utils import OVHCloudException
 from litellm.llms.base_llm.base_model_iterator import BaseModelResponseIterator
 from litellm.llms.base_llm.chat.transformation import BaseLLMException
+from litellm.llms.base_llm.chat.transformation import LiteLLMLoggingObj
 from litellm.types.llms.openai import AllMessageValues
 
-
 class OVHCloudChatConfig(OpenAIGPTConfig):
     @property
     def custom_llm_provider(self) -> Optional[str]:
@@ -75,6 +75,50 @@ class OVHCloudChatConfig(OpenAIGPTConfig):
         return response
 
 
+    def transform_response(
+        self,
+        model: str,
+        raw_response: httpx.Response,
+        model_response: ModelResponse,
+        logging_obj: LiteLLMLoggingObj,
+        request_data: dict,
+        messages: List[AllMessageValues],
+        optional_params: dict,
+        litellm_params: dict,
+        encoding: Any,
+        api_key: Optional[str] = None,
+        json_mode: Optional[bool] = None,
+    ) -> ModelResponse:
+        # Call parent to do standard OpenAI response parsing
+        model_response = super().transform_response(
+            model=model,
+            raw_response=raw_response,
+            model_response=model_response,
+            logging_obj=logging_obj,
+            request_data=request_data,
+            messages=messages,
+            optional_params=optional_params,
+            litellm_params=litellm_params,
+            encoding=encoding,
+            api_key=api_key,
+            json_mode=json_mode,
+        )
+
+        # OVHCloud field migration (deadline: 2026-05-11):
+        # `reasoning_content` is replaced by `reasoning` in non-streaming responses.
+        # Normalise to `reasoning_content` so downstream consumers
+        # see a consistent key during the transition window.
+        for choice in model_response.choices:
+            message = getattr(choice, "message", None)
+            if message is not None:
+                reasoning_new = getattr(message, "reasoning", None)
+                reasoning_legacy = getattr(message, "reasoning_content", None)
+                if reasoning_new is not None and reasoning_legacy is None:
+                    message.reasoning_content = reasoning_new
+
+        return model_response        
+
+
 class OVHCloudChatCompletionStreamingHandler(BaseModelResponseIterator):
     """
     Handler for OVHCloud AI Endpoints streaming chat completion responses
diff --git a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
index 88ce3b4c296..b112f6d87f1 100644
--- a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
+++ b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
@@ -4,7 +4,7 @@ Unit tests for OVHCloud AI Endpoints chat integration.
 
 import os
 import sys
-
+import litellm
 import pytest
 
 from litellm.llms.ovhcloud.utils import OVHCloudException
@@ -364,4 +364,52 @@ class TestOVHCloudReasoningFieldMigration:
             ],
         }
         result = handler.chunk_parser(chunk)
-        assert result.choices[0]["delta"]["reasoning_content"] == "legacy field"
\ No newline at end of file
+        assert result.choices[0]["delta"]["reasoning_content"] == "legacy field"
+
+
+    def test_non_streaming_new_reasoning_field(self):
+            """Non-streaming: new `reasoning` field should be mapped to `reasoning_content`."""
+            from unittest.mock import MagicMock, patch
+            import json
+
+            config = OVHCloudChatConfig()
+
+            raw_response = MagicMock()
+            raw_response.status_code = 200
+            raw_response.headers = {"Content-Type": "application/json"}
+            raw_response.text = json.dumps({
+                "id": "test-id",
+                "object": "chat.completion",
+                "created": 1234567890,
+                "model": "test-model",
+                "choices": [
+                    {
+                        "index": 0,
+                        "message": {
+                            "role": "assistant",
+                            "content": "Hello!",
+                            "reasoning": "Let me think...",
+                        },
+                        "finish_reason": "stop",
+                    }
+                ],
+                "usage": {"prompt_tokens": 10, "completion_tokens": 5, "total_tokens": 15},
+            })
+            raw_response.json.return_value = json.loads(raw_response.text)
+
+            model_response = litellm.ModelResponse()
+
+            result = config.transform_response(
+                model="ovhcloud/test-model",
+                raw_response=raw_response,
+                model_response=model_response,
+                logging_obj=MagicMock(),
+                request_data={},
+                messages=[],
+                optional_params={},
+                litellm_params={},
+                encoding=None,
+                api_key="test-key",
+            )
+
+            assert result.choices[0].message.reasoning_content == "Let me think..."        
\ No newline at end of file

From 8f48d880da974e349deb63a47363a12c618a5301 Mon Sep 17 00:00:00 2001
From: KunalG67 <kunalgarhewal13@gmail.com>
Date: Tue, 28 Apr 2026 18:25:11 +0530
Subject: [PATCH 09/33] style: apply black formatting to ovhcloud chat
 transformation

---
 litellm/llms/ovhcloud/chat/transformation.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/litellm/llms/ovhcloud/chat/transformation.py b/litellm/llms/ovhcloud/chat/transformation.py
index 77d3683566c..b5752d16309 100644
--- a/litellm/llms/ovhcloud/chat/transformation.py
+++ b/litellm/llms/ovhcloud/chat/transformation.py
@@ -16,6 +16,7 @@ from litellm.llms.base_llm.chat.transformation import BaseLLMException
 from litellm.llms.base_llm.chat.transformation import LiteLLMLoggingObj
 from litellm.types.llms.openai import AllMessageValues
 
+
 class OVHCloudChatConfig(OpenAIGPTConfig):
     @property
     def custom_llm_provider(self) -> Optional[str]:
@@ -74,7 +75,6 @@ class OVHCloudChatConfig(OpenAIGPTConfig):
         response.update(extra_body)
         return response
 
-
     def transform_response(
         self,
         model: str,
@@ -116,7 +116,7 @@ class OVHCloudChatConfig(OpenAIGPTConfig):
                 if reasoning_new is not None and reasoning_legacy is None:
                     message.reasoning_content = reasoning_new
 
-        return model_response        
+        return model_response
 
 
 class OVHCloudChatCompletionStreamingHandler(BaseModelResponseIterator):

From 9928618788389e623aa0c57b9249d084bfe72482 Mon Sep 17 00:00:00 2001
From: Aneesh-Fiddler <aneeshfiddler@gmail.com>
Date: Tue, 28 Apr 2026 19:58:58 +0530
Subject: [PATCH 10/33] fix: remove duplicate gen_ai.response.finish_reasons
 block

---
 litellm/integrations/opentelemetry.py | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py
index 90e647d86bf..d116fc44658 100644
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@@ -1824,15 +1824,6 @@ class OpenTelemetry(CustomLogger):
                             value=safe_dumps([status]),
                         )
 
-                    # Extract finish reason from ResponsesAPIResponse.status
-                    status = response_obj.get("status")
-                    if status:
-                        self.safe_set_attribute(
-                            span=span,
-                            key=SpanAttributes.GEN_AI_RESPONSE_FINISH_REASONS.value,
-                            value=safe_dumps([status]),
-                        )
-
         except Exception as e:
             self.handle_callback_failure(
                 callback_name=self.callback_name or "opentelemetry"

From 90bcd232c37389397cdcb763737f150899f1f722 Mon Sep 17 00:00:00 2001
From: KunalG67 <kunalgarhewal13@gmail.com>
Date: Tue, 28 Apr 2026 23:09:17 +0530
Subject: [PATCH 11/33] fix(ovhcloud): remove dead transform_response override

The parent OpenAIGPTConfig already handles reasoning->reasoning_content
for non-streaming via _extract_reasoning_content. The override was dead
code giving false confidence. Streaming fix in chunk_parser is the only
change needed for chat completions.

Addresses Agent Shin review feedback on #26595
---
 litellm/llms/ovhcloud/chat/transformation.py  | 47 ++----------------
 .../test_ovhcloud_chat_transformation.py      | 48 +------------------
 2 files changed, 4 insertions(+), 91 deletions(-)

diff --git a/litellm/llms/ovhcloud/chat/transformation.py b/litellm/llms/ovhcloud/chat/transformation.py
index b5752d16309..140cb855323 100644
--- a/litellm/llms/ovhcloud/chat/transformation.py
+++ b/litellm/llms/ovhcloud/chat/transformation.py
@@ -5,15 +5,15 @@ Our unified API follows the OpenAI standard.
 More information on our website: https://endpoints.ai.cloud.ovh.net
 """
 
-from typing import Any, Optional, Union, List
+from typing import Optional, Union, List
 
 import httpx
-from litellm.utils import ModelResponse, ModelResponseStream
+from litellm.utils import ModelResponseStream
 from litellm.llms.openai.chat.gpt_transformation import OpenAIGPTConfig
 from litellm.llms.ovhcloud.utils import OVHCloudException
 from litellm.llms.base_llm.base_model_iterator import BaseModelResponseIterator
 from litellm.llms.base_llm.chat.transformation import BaseLLMException
-from litellm.llms.base_llm.chat.transformation import LiteLLMLoggingObj
+
 from litellm.types.llms.openai import AllMessageValues
 
 
@@ -75,48 +75,7 @@ class OVHCloudChatConfig(OpenAIGPTConfig):
         response.update(extra_body)
         return response
 
-    def transform_response(
-        self,
-        model: str,
-        raw_response: httpx.Response,
-        model_response: ModelResponse,
-        logging_obj: LiteLLMLoggingObj,
-        request_data: dict,
-        messages: List[AllMessageValues],
-        optional_params: dict,
-        litellm_params: dict,
-        encoding: Any,
-        api_key: Optional[str] = None,
-        json_mode: Optional[bool] = None,
-    ) -> ModelResponse:
-        # Call parent to do standard OpenAI response parsing
-        model_response = super().transform_response(
-            model=model,
-            raw_response=raw_response,
-            model_response=model_response,
-            logging_obj=logging_obj,
-            request_data=request_data,
-            messages=messages,
-            optional_params=optional_params,
-            litellm_params=litellm_params,
-            encoding=encoding,
-            api_key=api_key,
-            json_mode=json_mode,
-        )
 
-        # OVHCloud field migration (deadline: 2026-05-11):
-        # `reasoning_content` is replaced by `reasoning` in non-streaming responses.
-        # Normalise to `reasoning_content` so downstream consumers
-        # see a consistent key during the transition window.
-        for choice in model_response.choices:
-            message = getattr(choice, "message", None)
-            if message is not None:
-                reasoning_new = getattr(message, "reasoning", None)
-                reasoning_legacy = getattr(message, "reasoning_content", None)
-                if reasoning_new is not None and reasoning_legacy is None:
-                    message.reasoning_content = reasoning_new
-
-        return model_response
 
 
 class OVHCloudChatCompletionStreamingHandler(BaseModelResponseIterator):
diff --git a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
index b112f6d87f1..40d57c76d02 100644
--- a/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
+++ b/tests/test_litellm/llms/ovhcloud/test_ovhcloud_chat_transformation.py
@@ -4,7 +4,7 @@ Unit tests for OVHCloud AI Endpoints chat integration.
 
 import os
 import sys
-import litellm
+
 import pytest
 
 from litellm.llms.ovhcloud.utils import OVHCloudException
@@ -367,49 +367,3 @@ class TestOVHCloudReasoningFieldMigration:
         assert result.choices[0]["delta"]["reasoning_content"] == "legacy field"
 
 
-    def test_non_streaming_new_reasoning_field(self):
-            """Non-streaming: new `reasoning` field should be mapped to `reasoning_content`."""
-            from unittest.mock import MagicMock, patch
-            import json
-
-            config = OVHCloudChatConfig()
-
-            raw_response = MagicMock()
-            raw_response.status_code = 200
-            raw_response.headers = {"Content-Type": "application/json"}
-            raw_response.text = json.dumps({
-                "id": "test-id",
-                "object": "chat.completion",
-                "created": 1234567890,
-                "model": "test-model",
-                "choices": [
-                    {
-                        "index": 0,
-                        "message": {
-                            "role": "assistant",
-                            "content": "Hello!",
-                            "reasoning": "Let me think...",
-                        },
-                        "finish_reason": "stop",
-                    }
-                ],
-                "usage": {"prompt_tokens": 10, "completion_tokens": 5, "total_tokens": 15},
-            })
-            raw_response.json.return_value = json.loads(raw_response.text)
-
-            model_response = litellm.ModelResponse()
-
-            result = config.transform_response(
-                model="ovhcloud/test-model",
-                raw_response=raw_response,
-                model_response=model_response,
-                logging_obj=MagicMock(),
-                request_data={},
-                messages=[],
-                optional_params={},
-                litellm_params={},
-                encoding=None,
-                api_key="test-key",
-            )
-
-            assert result.choices[0].message.reasoning_content == "Let me think..."        
\ No newline at end of file

From d73e24c1f93664dc147ce8ef2c5a2ffcef6f9eb7 Mon Sep 17 00:00:00 2001
From: KunalG67 <kunalgarhewal13@gmail.com>
Date: Tue, 28 Apr 2026 23:19:13 +0530
Subject: [PATCH 12/33] fix(ovhcloud): remove dead transform_response override,
 parent already handles non-streaming via _extract_reasoning_content

---
 litellm/llms/ovhcloud/chat/transformation.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/litellm/llms/ovhcloud/chat/transformation.py b/litellm/llms/ovhcloud/chat/transformation.py
index 140cb855323..62f51f1e9da 100644
--- a/litellm/llms/ovhcloud/chat/transformation.py
+++ b/litellm/llms/ovhcloud/chat/transformation.py
@@ -76,8 +76,6 @@ class OVHCloudChatConfig(OpenAIGPTConfig):
         return response
 
 
-
-
 class OVHCloudChatCompletionStreamingHandler(BaseModelResponseIterator):
     """
     Handler for OVHCloud AI Endpoints streaming chat completion responses

From 53102529ca6e817cd398f23bcc0bd63501c9f169 Mon Sep 17 00:00:00 2001
From: Aneesh-Fiddler <aneeshfiddler@gmail.com>
Date: Wed, 29 Apr 2026 19:00:43 +0530
Subject: [PATCH 13/33] ci: retrigger checks after retargeting to
 litellm_oss_staging_04_27_2026


From c319a19c25d746dbcfd27ab3c69984f5d66eb358 Mon Sep 17 00:00:00 2001
From: Aneesh-Fiddler <aneeshfiddler@gmail.com>
Date: Thu, 30 Apr 2026 11:04:08 +0530
Subject: [PATCH 14/33] fix: handle raw Pydantic v2 models from openai SDK in
 output transformation

The openai SDK returns ResponseOutputMessage and ResponseOutputText as
raw Pydantic v2 models that lack .get() (unlike LiteLLM's own wrapper
objects). Add a _to_dict() helper that normalizes plain dicts,
BaseLiteLLMOpenAIResponseObject (has .get()), and raw Pydantic models
(has .model_dump()) into a consistent dict interface.
---
 litellm/integrations/opentelemetry.py | 54 +++++++++++++++++++--------
 1 file changed, 39 insertions(+), 15 deletions(-)

diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py
index d116fc44658..a12d67de4b4 100644
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@@ -1794,15 +1794,13 @@ class OpenTelemetry(CustomLogger):
                     # _tool_calls_kv_pair.
                     tool_calls = []
                     for out_item in output_items:
-                        if (
-                            hasattr(out_item, "get")
-                            and out_item.get("type") == "function_call"
-                        ):
+                        item_d = self._to_dict(out_item)
+                        if item_d and item_d.get("type") == "function_call":
                             tool_calls.append(
                                 {
                                     "function": {
-                                        "name": out_item.get("name", ""),
-                                        "arguments": out_item.get("arguments", ""),
+                                        "name": item_d.get("name", ""),
+                                        "arguments": item_d.get("arguments", ""),
                                     }
                                 }
                             )
@@ -1919,6 +1917,31 @@ class OpenTelemetry(CustomLogger):
             transformed.append(transformed_msg)
         return transformed
 
+    @staticmethod
+    def _to_dict(obj) -> Optional[dict]:
+        """Normalize an object to a plain dict.
+
+        Handles three forms that appear in practice:
+
+        1. Plain ``dict`` — returned as-is.
+        2. LiteLLM's ``BaseLiteLLMOpenAIResponseObject`` — exposes a
+           ``.get()`` method that delegates to ``__dict__``.
+        3. Raw Pydantic v2 models from the ``openai`` SDK (e.g.
+           ``ResponseOutputMessage``, ``ResponseOutputText``) — these do
+           **not** have ``.get()`` but do have ``.model_dump()``.
+
+        Returns ``None`` for anything else so callers can skip it.
+        """
+        if isinstance(obj, dict):
+            return obj
+        if hasattr(obj, "get"):
+            # BaseLiteLLMOpenAIResponseObject duck-type
+            return obj  # type: ignore[return-value]
+        if hasattr(obj, "model_dump"):
+            # Raw Pydantic v2 model (e.g. openai SDK types)
+            return obj.model_dump()  # type: ignore[union-attr]
+        return None
+
     def _transform_responses_api_output_to_otel(self, output: List) -> List[dict]:
         """
         Transform Responses API output items into OTEL GenAI 1.38 format.
@@ -1928,24 +1951,25 @@ class OpenTelemetry(CustomLogger):
         ``content`` list of ``OutputText`` objects with ``type="output_text"``
         and ``text`` fields.
 
-        Items may be plain dicts or Pydantic model instances (e.g.
-        ``ResponseOutputMessage``, ``ResponseFunctionToolCall``).  Both
-        expose a ``.get()`` method via ``BaseLiteLLMOpenAIResponseObject``,
-        so we use ``hasattr(item, "get")`` rather than ``isinstance(item,
-        dict)`` to accept either form.
+        Items may be plain dicts, LiteLLM wrapper objects (with ``.get()``),
+        or raw Pydantic v2 models from the ``openai`` SDK (with
+        ``.model_dump()``).  We normalize each item to a dict via
+        ``_to_dict`` before processing.
 
         This method converts them to the same ``{"role": ..., "parts": [...]}``
         format used by ``_transform_choices_to_otel_semantic_conventions``.
         """
         transformed = []
-        for item in output:
-            if not hasattr(item, "get"):
+        for raw_item in output:
+            item = self._to_dict(raw_item)
+            if item is None:
                 continue
             if item.get("type") == "message":
                 role = item.get("role", "assistant")
                 parts = []
-                for content in item.get("content", []):
-                    if not hasattr(content, "get"):
+                for raw_content in item.get("content", []):
+                    content = self._to_dict(raw_content)
+                    if content is None:
                         continue
                     if content.get("type") == "output_text":
                         text = content.get("text", "")

From 209bd0b9061f7b602d148f8d6da6ffddc2014c87 Mon Sep 17 00:00:00 2001
From: pnookala-godaddy <pnookala@godaddy.com>
Date: Tue, 5 May 2026 12:18:44 -0700
Subject: [PATCH 15/33] fix(proxy): sort spend updates to prevent DB deadlocks

Iterate user/key/team/team_member/org/end_user/tag spend dicts in sorted
order inside each Prisma transaction so concurrent pods acquire row locks
in the same order, avoiding PostgreSQL deadlocks under load.
---
 litellm/proxy/db/db_spend_update_writer.py    |  48 +++---
 litellm/proxy/utils.py                        |   8 +-
 .../proxy/db/test_db_spend_update_writer.py   | 143 ++++++++++++++++++
 3 files changed, 174 insertions(+), 25 deletions(-)

diff --git a/litellm/proxy/db/db_spend_update_writer.py b/litellm/proxy/db/db_spend_update_writer.py
index c06e1850d9f..418fc2d2f02 100644
--- a/litellm/proxy/db/db_spend_update_writer.py
+++ b/litellm/proxy/db/db_spend_update_writer.py
@@ -1133,10 +1133,12 @@ class DBSpendUpdateWriter:
                         timeout=timedelta(seconds=60)
                     ) as transaction:
                         async with transaction.batch_() as batcher:
-                            for (
-                                user_id,
-                                response_cost,
-                            ) in user_list_transactions.items():
+                            # Sort by ID for consistent lock ordering across pods to prevent deadlocks.
+                            # batch_() issues statements sequentially within the tx, so iteration
+                            # order = lock acquisition order.
+                            for user_id, response_cost in sorted(
+                                user_list_transactions.items()
+                            ):
                                 batcher.litellm_usertable.update_many(
                                     where={"user_id": user_id},
                                     data={"spend": {"increment": response_cost}},
@@ -1188,10 +1190,10 @@ class DBSpendUpdateWriter:
                         timeout=timedelta(seconds=60)
                     ) as transaction:
                         async with transaction.batch_() as batcher:
-                            for (
-                                token,
-                                response_cost,
-                            ) in key_list_transactions.items():
+                            # Sort by token for consistent lock ordering across pods to prevent deadlocks.
+                            for token, response_cost in sorted(
+                                key_list_transactions.items()
+                            ):
                                 batcher.litellm_verificationtoken.update_many(  # 'update_many' prevents error from being raised if no row exists
                                     where={"token": token},
                                     data={
@@ -1232,10 +1234,10 @@ class DBSpendUpdateWriter:
                         timeout=timedelta(seconds=60)
                     ) as transaction:
                         async with transaction.batch_() as batcher:
-                            for (
-                                team_id,
-                                response_cost,
-                            ) in team_list_transactions.items():
+                            # Sort by team_id for consistent lock ordering across pods to prevent deadlocks.
+                            for team_id, response_cost in sorted(
+                                team_list_transactions.items()
+                            ):
                                 verbose_proxy_logger.debug(
                                     "Updating spend for team id={} by {}".format(
                                         team_id, response_cost
@@ -1290,10 +1292,11 @@ class DBSpendUpdateWriter:
                         timeout=timedelta(seconds=60)
                     ) as transaction:
                         async with transaction.batch_() as batcher:
-                            for (
-                                key,
-                                response_cost,
-                            ) in team_member_list_transactions.items():
+                            # Sort by composite key for consistent lock ordering across pods to prevent deadlocks.
+                            # Key format "team_id::<v>::user_id::<v>" makes the string sort equivalent to sorting by (team_id, user_id).
+                            for key, response_cost in sorted(
+                                team_member_list_transactions.items()
+                            ):
                                 # key is "team_id::<value>::user_id::<value>"
                                 team_id = key.split("::")[1]
                                 user_id = key.split("::")[3]
@@ -1350,10 +1353,10 @@ class DBSpendUpdateWriter:
                         timeout=timedelta(seconds=60)
                     ) as transaction:
                         async with transaction.batch_() as batcher:
-                            for (
-                                org_id,
-                                response_cost,
-                            ) in org_list_transactions.items():
+                            # Sort by org_id for consistent lock ordering across pods to prevent deadlocks.
+                            for org_id, response_cost in sorted(
+                                org_list_transactions.items()
+                            ):
                                 batcher.litellm_organizationtable.update_many(  # 'update_many' prevents error from being raised if no row exists
                                     where={"organization_id": org_id},
                                     data={"spend": {"increment": response_cost}},
@@ -1441,7 +1444,10 @@ class DBSpendUpdateWriter:
                         timeout=timedelta(seconds=60)
                     ) as transaction:
                         async with transaction.batch_() as batcher:
-                            for entity_id, response_cost in transactions.items():
+                            # Sort by entity_id for consistent lock ordering across pods to prevent deadlocks.
+                            for entity_id, response_cost in sorted(
+                                transactions.items()
+                            ):
                                 verbose_proxy_logger.debug(
                                     f"Updating spend for {entity_name} {where_field}={entity_id} by {response_cost}"
                                 )
diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py
index d2dfa177515..800a4be37a8 100644
--- a/litellm/proxy/utils.py
+++ b/litellm/proxy/utils.py
@@ -4874,10 +4874,10 @@ class ProxyUpdateSpend:
                     timeout=timedelta(seconds=60)
                 ) as transaction:
                     async with transaction.batch_() as batcher:
-                        for (
-                            end_user_id,
-                            response_cost,
-                        ) in end_user_list_transactions.items():
+                        # Sort by end_user_id for consistent lock ordering across pods to prevent deadlocks.
+                        for end_user_id, response_cost in sorted(
+                            end_user_list_transactions.items()
+                        ):
                             if litellm.max_end_user_budget is not None:
                                 pass
                             batcher.litellm_endusertable.upsert(
diff --git a/tests/test_litellm/proxy/db/test_db_spend_update_writer.py b/tests/test_litellm/proxy/db/test_db_spend_update_writer.py
index 4d584349342..9d4d3c4a560 100644
--- a/tests/test_litellm/proxy/db/test_db_spend_update_writer.py
+++ b/tests/test_litellm/proxy/db/test_db_spend_update_writer.py
@@ -1508,3 +1508,146 @@ async def test_commit_spend_updates_uses_pipeline():
     mock_redis_update_buffer.get_all_daily_end_user_spend_update_transactions_from_redis_buffer.assert_not_called()
     mock_redis_update_buffer.get_all_daily_agent_spend_update_transactions_from_redis_buffer.assert_not_called()
     mock_redis_update_buffer.get_all_daily_tag_spend_update_transactions_from_redis_buffer.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "bucket_name,input_dict,table_attr,method_name,where_key,expected_order",
+    [
+        pytest.param(
+            "user_list_transactions",
+            {"user_c": 0.1, "user_a": 0.2, "user_b": 0.3},
+            "litellm_usertable",
+            "update_many",
+            "user_id",
+            ["user_a", "user_b", "user_c"],
+            id="user",
+        ),
+        pytest.param(
+            "key_list_transactions",
+            {"tok_c": 0.1, "tok_a": 0.2, "tok_b": 0.3},
+            "litellm_verificationtoken",
+            "update_many",
+            "token",
+            ["tok_a", "tok_b", "tok_c"],
+            id="key",
+        ),
+        pytest.param(
+            "team_list_transactions",
+            {"team_c": 0.1, "team_a": 0.2, "team_b": 0.3},
+            "litellm_teamtable",
+            "update_many",
+            "team_id",
+            ["team_a", "team_b", "team_c"],
+            id="team",
+        ),
+        pytest.param(
+            "team_member_list_transactions",
+            {
+                "team_id::team_c::user_id::user_x": 0.1,
+                "team_id::team_a::user_id::user_x": 0.2,
+                "team_id::team_b::user_id::user_x": 0.3,
+            },
+            "litellm_teammembership",
+            "update_many",
+            "team_id",
+            ["team_a", "team_b", "team_c"],
+            id="team_member",
+        ),
+        pytest.param(
+            "org_list_transactions",
+            {"org_c": 0.1, "org_a": 0.2, "org_b": 0.3},
+            "litellm_organizationtable",
+            "update_many",
+            "organization_id",
+            ["org_a", "org_b", "org_c"],
+            id="org",
+        ),
+        pytest.param(
+            "end_user_list_transactions",
+            {"eu_c": 0.1, "eu_a": 0.2, "eu_b": 0.3},
+            "litellm_endusertable",
+            "upsert",
+            "user_id",
+            ["eu_a", "eu_b", "eu_c"],
+            id="end_user",
+        ),
+        pytest.param(
+            "tag_list_transactions",
+            {"prod": 0.1, "customer-x": 0.2, "test": 0.3},
+            "litellm_tagtable",
+            "update_many",
+            "tag_name",
+            ["customer-x", "prod", "test"],
+            id="tag",
+        ),
+        pytest.param(
+            "agent_list_transactions",
+            {"agent_c": 0.1, "agent_a": 0.2, "agent_b": 0.3},
+            "litellm_agentstable",
+            "update_many",
+            "agent_id",
+            ["agent_a", "agent_b", "agent_c"],
+            id="agent",
+        ),
+    ],
+)
+@pytest.mark.asyncio
+async def test_commit_spend_updates_iterates_in_sorted_order(
+    bucket_name, input_dict, table_attr, method_name, where_key, expected_order
+):
+    """
+    Every spend-bucket code path in _commit_spend_updates_to_db must iterate
+    in sorted order so concurrent pods acquire row locks in the same order
+    and avoid PostgreSQL deadlocks. Covers the 5 direct loops (user/key/team/
+    team_member/org), the end_user path in ProxyUpdateSpend.update_end_user_spend,
+    and the shared _update_entity_spend_in_db helper (tag, agent).
+    """
+    db_writer = DBSpendUpdateWriter()
+
+    captured_where_values = []
+
+    def capture(*, where, data):
+        captured_where_values.append(where[where_key])
+
+    mock_batcher = MagicMock()
+    table_mock = MagicMock()
+    setattr(table_mock, method_name, MagicMock(side_effect=capture))
+    setattr(mock_batcher, table_attr, table_mock)
+
+    mock_transaction = AsyncMock()
+    mock_transaction.__aenter__ = AsyncMock(return_value=mock_transaction)
+    mock_transaction.__aexit__ = AsyncMock(return_value=False)
+    mock_transaction.batch_ = MagicMock(
+        return_value=AsyncMock(
+            __aenter__=AsyncMock(return_value=mock_batcher),
+            __aexit__=AsyncMock(return_value=False),
+        )
+    )
+
+    mock_prisma_client = MagicMock()
+    mock_prisma_client.db = MagicMock()
+    mock_prisma_client.db.tx = MagicMock(return_value=mock_transaction)
+
+    mock_proxy_logging = MagicMock()
+    mock_proxy_logging.call_details = {}
+
+    buckets = {
+        "user_list_transactions": {},
+        "end_user_list_transactions": {},
+        "key_list_transactions": {},
+        "team_list_transactions": {},
+        "team_member_list_transactions": {},
+        "org_list_transactions": {},
+        "tag_list_transactions": {},
+        "agent_list_transactions": {},
+    }
+    buckets[bucket_name] = input_dict
+
+    await db_writer._commit_spend_updates_to_db(
+        prisma_client=mock_prisma_client,
+        n_retry_times=3,
+        proxy_logging_obj=mock_proxy_logging,
+        db_spend_update_transactions=buckets,
+    )
+
+    assert captured_where_values == expected_order

From 2993e45ad18e7508d7f4a262608006bc787082c5 Mon Sep 17 00:00:00 2001
From: Michael Riad Zaky <michaelr@Mac.localdomain>
Date: Tue, 5 May 2026 11:37:12 -0700
Subject: [PATCH 16/33] allow non-admin roles on /compliance/* read routes

---
 litellm/proxy/_types.py                       | 10 +++++-
 .../proxy/auth/test_route_checks.py           | 33 +++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index c6653a722d6..7a049dcc5de 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -656,6 +656,13 @@ class LiteLLMRoutes(enum.Enum):
         "/health/services",
     ] + info_routes
 
+    # Stateless validators on caller-supplied log data; source logs are
+    # already accessible via spend_tracking_routes, so no scope expansion.
+    compliance_check_routes = [
+        "/compliance/eu-ai-act",
+        "/compliance/gdpr",
+    ]
+
     # Routes in `global_spend_tracking_routes` return proxy-wide spend across
     # every team, customer, and api_key. They are intentionally NOT included
     # here — non-admin roles must not see other tenants' spend. Admin roles go
@@ -675,9 +682,10 @@ class LiteLLMRoutes(enum.Enum):
         ]
         + spend_tracking_routes
         + key_management_routes
+        + compliance_check_routes
     )
 
-    internal_user_view_only_routes = spend_tracking_routes
+    internal_user_view_only_routes = spend_tracking_routes + compliance_check_routes
 
     self_managed_routes = [
         "/team/member_add",
diff --git a/tests/test_litellm/proxy/auth/test_route_checks.py b/tests/test_litellm/proxy/auth/test_route_checks.py
index cf6feabf85f..3e0b1b739ec 100644
--- a/tests/test_litellm/proxy/auth/test_route_checks.py
+++ b/tests/test_litellm/proxy/auth/test_route_checks.py
@@ -53,6 +53,39 @@ def test_non_admin_config_update_route_rejected():
     assert "Your role=internal_user" in str(exc_info.value)
 
 
+@pytest.mark.parametrize(
+    "role",
+    [
+        LitellmUserRoles.INTERNAL_USER.value,
+        LitellmUserRoles.INTERNAL_USER_VIEW_ONLY.value,
+    ],
+)
+@pytest.mark.parametrize(
+    "route",
+    ["/compliance/eu-ai-act", "/compliance/gdpr"],
+)
+def test_compliance_routes_open_to_non_admin_roles(role, route):
+    """Compliance routes are stateless validators on caller-supplied log data
+    — both non-admin internal_user roles can call them."""
+    user_obj = LiteLLM_UserTable(
+        user_id="test_user",
+        user_email="test@example.com",
+        user_role=role,
+    )
+    valid_token = UserAPIKeyAuth(user_id="test_user", user_role=role)
+    request = MagicMock(spec=Request)
+    request.query_params = {}
+
+    RouteChecks.non_proxy_admin_allowed_routes_check(
+        user_obj=user_obj,
+        _user_role=role,
+        route=route,
+        request=request,
+        valid_token=valid_token,
+        request_data={},
+    )
+
+
 def test_proxy_admin_viewer_config_update_route_rejected():
     """Test that proxy admin viewer users are rejected when trying to call /config/update"""
 

From 85d4d96c1bf1d823b1c66d5464768d568302b3f0 Mon Sep 17 00:00:00 2001
From: michelligabriele <gabriele.michelli@icloud.com>
Date: Wed, 6 May 2026 00:28:42 +0200
Subject: [PATCH 17/33] fix(proxy): preserve HTTP operations when injecting
 WebSocket stubs into OpenAPI schema

---
 litellm/proxy/proxy_server.py                 |  88 ++++++++------
 .../proxy/test_openapi_schema_validation.py   | 107 ++++++++++++++++++
 2 files changed, 158 insertions(+), 37 deletions(-)

diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index a5905765c6e..b136464fd2d 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -1057,6 +1057,52 @@ vertex_live_passthrough_vertex_base = VertexBase()
 from fastapi.routing import APIWebSocketRoute
 
 
+def _inject_websocket_stubs_into_openapi_schema(
+    openapi_schema: dict, websocket_routes: list
+) -> dict:
+    """
+    Add a synthetic GET stub for each WebSocket route so it appears in Swagger UI.
+
+    Merges into any existing path entry rather than replacing it — a WebSocket route
+    that shares its path with an HTTP route must not erase the HTTP operation. If
+    a "get" operation is already documented on the path, the WebSocket stub is
+    skipped to preserve the real GET.
+    """
+    for route in websocket_routes:
+        base_path = route.path.split("{")[0].rstrip("?")
+
+        parameters = []
+        try:
+            if hasattr(route, "dependant") and route.dependant is not None:
+                # Handle both FastAPI <0.120 and >=0.120
+                query_params = getattr(route.dependant, "query_params", [])
+                if query_params:
+                    for param in query_params:
+                        parameters.append(
+                            {
+                                "name": param.name,
+                                "in": "query",
+                                "required": param.required,
+                                "schema": {"type": "string"},
+                            }
+                        )
+        except (AttributeError, TypeError):
+            pass
+
+        path_entry = openapi_schema["paths"].setdefault(base_path, {})
+        if "get" not in path_entry:
+            path_entry["get"] = {
+                "summary": f"WebSocket: {route.name or base_path}",
+                "description": "WebSocket connection endpoint",
+                "operationId": f"websocket_{route.name or base_path.replace('/', '_')}",
+                "parameters": parameters,
+                "responses": {"101": {"description": "WebSocket Protocol Switched"}},
+                "tags": ["WebSocket"],
+            }
+
+    return openapi_schema
+
+
 def get_openapi_schema():
     if app.openapi_schema:
         return app.openapi_schema
@@ -1079,43 +1125,11 @@ def get_openapi_schema():
         route for route in app.routes if isinstance(route, APIWebSocketRoute)
     ]
 
-    # Add each WebSocket route to the schema
-    for route in websocket_routes:
-        # Get the base path without query parameters
-        base_path = route.path.split("{")[0].rstrip("?")
-
-        # Extract parameters from the route
-        parameters = []
-        try:
-            if hasattr(route, "dependant") and route.dependant is not None:
-                # Handle both FastAPI <0.120 and >=0.120
-                query_params = getattr(route.dependant, "query_params", [])
-                if query_params:
-                    for param in query_params:
-                        parameters.append(
-                            {
-                                "name": param.name,
-                                "in": "query",
-                                "required": param.required,
-                                "schema": {
-                                    "type": "string"
-                                },  # You can make this more specific if needed
-                            }
-                        )
-        except (AttributeError, TypeError):
-            # If we can't access query_params, continue without them
-            pass
-
-        openapi_schema["paths"][base_path] = {
-            "get": {
-                "summary": f"WebSocket: {route.name or base_path}",
-                "description": "WebSocket connection endpoint",
-                "operationId": f"websocket_{route.name or base_path.replace('/', '_')}",
-                "parameters": parameters,
-                "responses": {"101": {"description": "WebSocket Protocol Switched"}},
-                "tags": ["WebSocket"],
-            }
-        }
+    # Add a synthetic GET stub for each so they render in Swagger UI,
+    # without clobbering existing HTTP operations on the same path.
+    openapi_schema = _inject_websocket_stubs_into_openapi_schema(
+        openapi_schema, websocket_routes
+    )
 
     # Add LLM API request schema bodies for documentation
     from litellm.proxy.common_utils.custom_openapi_spec import CustomOpenAPISpec
diff --git a/tests/test_litellm/proxy/test_openapi_schema_validation.py b/tests/test_litellm/proxy/test_openapi_schema_validation.py
index 68d537b2593..b44edc8a3bc 100644
--- a/tests/test_litellm/proxy/test_openapi_schema_validation.py
+++ b/tests/test_litellm/proxy/test_openapi_schema_validation.py
@@ -140,3 +140,110 @@ class TestCredentialEndpointsOpenAPISchema:
         assert (
             "credential_name" in sig.parameters
         ), "get_credential_by_name must have a credential_name parameter"
+
+
+class TestWebSocketStubInjection:
+    """
+    Regression test for the v1.82.3 bug where adding a WebSocket route on a path
+    that already had an HTTP route silently dropped the HTTP operation from the
+    OpenAPI schema.
+
+    Related case: 2026-05-05-madhu-swagger-responses-missing
+    """
+
+    def _make_fake_ws_route(self, path: str, name: str = "fake_ws"):
+        """Minimal stand-in for fastapi.routing.APIWebSocketRoute for the helper's purposes."""
+        from types import SimpleNamespace
+
+        return SimpleNamespace(path=path, name=name, dependant=None)
+
+    def test_websocket_stub_does_not_clobber_existing_post(self):
+        """
+        When a WebSocket route shares its path with an existing POST operation,
+        the POST must survive — the WebSocket stub is added alongside, not on top.
+        """
+        from litellm.proxy.proxy_server import (
+            _inject_websocket_stubs_into_openapi_schema,
+        )
+
+        schema = {
+            "paths": {
+                "/v1/responses": {
+                    "post": {"summary": "responses_api", "operationId": "responses_api"}
+                }
+            }
+        }
+        ws_routes = [self._make_fake_ws_route("/v1/responses", name="responses_ws")]
+
+        result = _inject_websocket_stubs_into_openapi_schema(schema, ws_routes)
+
+        assert (
+            "post" in result["paths"]["/v1/responses"]
+        ), "POST operation must be preserved when a WebSocket route shares the path"
+        assert (
+            result["paths"]["/v1/responses"]["post"]["operationId"] == "responses_api"
+        )
+        assert (
+            "get" in result["paths"]["/v1/responses"]
+        ), "WebSocket stub should also be added under 'get'"
+        assert result["paths"]["/v1/responses"]["get"]["tags"] == ["WebSocket"]
+
+    def test_websocket_stub_added_when_path_is_new(self):
+        """
+        When a WebSocket route's path is not already in the schema, the stub
+        creates a fresh entry — preserving the original behavior for WebSocket-only
+        paths.
+        """
+        from litellm.proxy.proxy_server import (
+            _inject_websocket_stubs_into_openapi_schema,
+        )
+
+        schema = {"paths": {}}
+        ws_routes = [self._make_fake_ws_route("/ws_only", name="ws_only")]
+
+        result = _inject_websocket_stubs_into_openapi_schema(schema, ws_routes)
+
+        assert "/ws_only" in result["paths"]
+        assert "get" in result["paths"]["/ws_only"]
+        assert result["paths"]["/ws_only"]["get"]["tags"] == ["WebSocket"]
+
+    def test_websocket_stub_skipped_when_existing_get(self):
+        """
+        If a real GET is already documented on the path, the WebSocket stub is
+        skipped — a real operation always wins over the synthetic stub. This
+        closes the same trap for future GET-vs-WebSocket collisions.
+        """
+        from litellm.proxy.proxy_server import (
+            _inject_websocket_stubs_into_openapi_schema,
+        )
+
+        schema = {
+            "paths": {
+                "/health": {
+                    "get": {"summary": "health_check", "operationId": "real_get"}
+                }
+            }
+        }
+        ws_routes = [self._make_fake_ws_route("/health", name="health_ws")]
+
+        result = _inject_websocket_stubs_into_openapi_schema(schema, ws_routes)
+
+        assert (
+            result["paths"]["/health"]["get"]["operationId"] == "real_get"
+        ), "Real GET must take precedence over WebSocket stub"
+
+    def test_responses_post_routes_registered_on_router(self):
+        """
+        Sanity check: the three POST routes for the responses API are still wired
+        on the responses router. Guards against accidental removal at the source.
+        """
+        from litellm.proxy.response_api_endpoints.endpoints import router
+
+        post_paths = {
+            route.path
+            for route in router.routes
+            if hasattr(route, "methods")
+            and "POST" in (route.methods or set())
+            and route.path in {"/v1/responses", "/responses", "/openai/v1/responses"}
+        }
+        assert post_paths == {"/v1/responses", "/responses", "/openai/v1/responses"}

From 062b5b31fb0d7e9f7cce989d22bf0c0561c83ea9 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 6 May 2026 00:26:17 +0000
Subject: [PATCH 18/33] Add main module header comment

Co-authored-by: ishaan-berri <ishaan-berri@users.noreply.github.com>
---
 .evidence/main_header_repro.png               | Bin 0 -> 61972 bytes
 litellm/main.py                               |   2 ++
 tests/test_litellm/test_main_module_header.py |  13 +++++++++++++
 3 files changed, 15 insertions(+)
 create mode 100644 .evidence/main_header_repro.png
 create mode 100644 tests/test_litellm/test_main_module_header.py

diff --git a/.evidence/main_header_repro.png b/.evidence/main_header_repro.png
new file mode 100644
index 0000000000000000000000000000000000000000..d71ab04d02a56b3ad8f2e8015bf53ca13f8cd8d3
GIT binary patch
literal 61972
zcmeFYbyQUE-!6;^h_ryTv`9&p4ALbaInvT89nuOT4TE$e-3;9!Al(fTLw5}gL%iGg
zKIi$JC*J3*b^biFX1T`Ap4oSN>b|b)6Zlp^3iA=kBNP-AOc`l$WfYVL=_n|7U!vUw
zt{_i?ZBS4UGcw{Lsvnbf=3KP#*C|mC7_7dsxTD{_>vPXIFTf|DrV^`SLc?-9e?n+0
zcf77reLLUDa&F@Db82c1)$b3m?tkf_NVh@@zq;W|)a$9K4~O6i@5i#~#r8T3dZyY9
z(qYF6hSgQwxdS}$*URi;B|+fNN8sP??_8*V|I>x`#^LYBPa*&B^6#biKU|Z5j<~g_
z<=oN|VmY|Zw0I5-`_r*yh3=27w_g8U+1DH-n-*ADIp(aS>{jp(r&)zq*B!jw^Q#2W
zAB3c^bUfXDmd1{THIq~#5{lNPTNk-xUK*6`3RwVm@~k;?Pb4~>CV4V$k2VL#|GKSi
zD=N?sdutBMv$MY`YL&x8B(&%uGl&mqkeyb<X?XMZu{$z$ry??Hjq90edb@#RHj{Qc
zVKdiW=Q{AZ;A7{>$J6f6-Ltm+HJ!`cT+4!7bK;)@XUIhtXm>%P0Bhc&t?F1sUvh&#
zObA}3r6<}I96rh~qgWRfH?BGJI=rWApgkYC08U#k!!t-=RsZwMaFLOOwFTRihit-o
zTprmmN`kG66%#xqCuICf>%q!Db&gcqS={ZAuwY><VZN5V@39k;6N=B-Zl=tKxaibE
zv$5n`DN?5E+#!qmH1c7d>!(`-8dy>TA9f5x(H4)|Zr-Kk&i3r~()s)lVt}p15J*vI
zO&Tr!ax4^-PazQ#T>iybzNNnI9l@wlIWE1fM>}J)^So6GgI?slAk=LNUsJuFGTXg%
zj!S>@PCZYDS1s#ExawGCo(n%&Z6GqE(;B<Dbi4}_+yuJR))le4+6w@7Q}V;3XONGB
zv-Ics61(+~sZ$DWJGd{g=`C^DVN`xh%7NC4t)HGvGp|;MM&s9281~#ZKwfzbKIscO
zEptL!y^G_?<y7_FT_3%g8_sE}3;F2QCWN8Zz1>W?x#nds)b0qdYSj@5r+wS_Wwz#1
z{Go-Te2ntj+D1!VSA>*~9O~9OzXr@u?@LPgzF<|T1gdC&(_ork)xfZ6b*xt(ZaMRx
z<wxOuF3kv6C;5OzrC7Yj)+5gViSp{}_l^yJVka@?v4ae&w5JqjnQ;vr<|wTzaYRcU
zTt0GTvrcxTY*w9YrD9v<kAB_ut>|m=_Hy%?Dp;+o5B_5~BLhymh2c6=Jg>`Hb>AxP
zO(PvFm&;)H!B#Inm3Z6tS=X^wAMm%o_m93?d-g^~t*x*;M*^G*CAP^GFgN;1KM{7#
z@YD5zsleQ;&!e}XSVJNNeQFs8OKO9VR;hEc+JSO|-Swo>N$(`CWJ&BYF$a8WX1n%x
zMkik<xTN-GYVw0PR60{^DDMYFDrzz8C(bk>8F=35433%Zv9_JgG0$Di&o?Wexw<0R
zCQC7P8#*AAH;&a9g0NvoI8h4&Iu(QI87<^#)jp4f%ImI_2f(BYIlX5<89rXg(Rk#U
z=0^M<FW52Gy=05VYK+?<I5YDZKi@fad6E(xBCmkCU|J<z_RkrQdzPdXl^@8{nc06k
zjyo`%WHZ4RMN7Ti+nlRMjX_+zvfC1;J$w|jJB!MHDbHcIp{u48^ThR}eOHBeaKBvf
zwM>mWXmQW=($kL5e(Tbt_y!|toXa611rL;}sdq>vxHcO`fe*f9xlw8Rwi{ikH<2Qy
zA1VBIHH6IN9ij-Dnj76yCi_0D=`^ZxJMCVED0qD=f5rsta0)89;^W&yoWq;Bf+5df
zDH|-V{T&(LJ04vMfmlFD;W(TcY}k4s8t`FXX>%|Gl-aDG>MgoaJE>2EPE~8OtUC(=
z;>l+}5v{F5obrK2bSkRm!9h<_DKwd24Ct$-CV0b~NwPbJqQlV2TYP^S2H0~3wju$T
zNNuG_wUWbb<F%G~MYq@W#=yKp;2A6WVDn4*_k-i!X$7~UEpnjLvxQ@m#rujdij5(g
zhOA(l!#2`=3V*Jew|^(dm3ba5$bMz7sSU{rh9S?50oyrEYPgg*$Q$yMJ8!T!jW=Qt
z!ew4>3SB>PwWy=_;YNrs{H(>cni&`57wGDmmmeKkTGZ1Lf5ah(D1Bdh?ny``u9U@n
zqAWjIQ<u-d%dZ>$Y}<*MN?d0UVvH5lwY*IYg{de_@@(%+yI*#&P275VNV-^?Q}v=T
zkOwGDa%RP-82G}9kU^_{fGz9z4;DUWM4Niaf3X<)kQRqHRZmGdF8O?8IBU+_4!3n5
z@EUrEt}SWxM*D6vZ3)eviG8Y*Mtm-VgqQg=5Vhn4!A(>2cvePw*aXf!Ho1<q>^KSP
zHpR9ghgy?V1#P@V1Cl2<4ws-ZN|WL}h56~KC0Co(w4xW2yKuNcK$Mv4u>X&P-ZMpO
zv#jBck;-Oi5uQH(<IGO){Y5YsThn<Z*vWgw9m$lR8x-|PXiJ8vzWL>)p$}kA%NBih
z9<A%RqUQ}A$QG<WgY&S?6zr#BUcR_KOvg6SxeTa?{u~<lUSo3PbK6&@fnJ=#G;48-
z#hn?=&Y`-_a7g`n0TUC1cO8+BPSpyP(ueV}iRp?c4UQ<4bPQ!PQDsU$M;W$5qsmXH
z+u`LCm~%Zt6WgLh%JHL75zsxrm71iusdE@QC5D7IIXEi_k*y24`+sdD?Y;lk2v~wE
zviX^HJUp9j`%64|AFQfFaE#SLi}m`fvxc+F8pJa_$SysNm)W)Rq7%YuKcw35;);%>
z%;75>9G>ctVdcOZ;L%!^^pKQ-Qdd_c5LIUK%xg6kPo?1S%VSomAC_x8I&xAH1Zw!5
z6mtxPIEAKdHjAHG#hORitJU5rD-92o?(vUZ_tHVa&u$x@aK}9?D9-or+#hMD^iNIN
zMNpqdMbCWy+N^zJp-4N<YK8ZA+!aqo>UjMd(j$^5p9;d*A%lR4;-AhlKmeNn-MB-g
zFET-mGu|zrmfj@Z!TH%{)}(JMV$QOCMb6guKqd{{GH#lNN3BU?K7B^z11T!l!Wk1}
zNn>dZFH`%A@%K{pUzsH|spXW;_&#8Q&tl^=-98t>6vNm~5kuFYX*ir)7TkZQ7$rRf
zn1Z`^amcHxfeyns!`ndn!yrghVAS7Hev6Ns7$>u#oNXv|as!^dbj2K&<gwW~yW-C~
zz;f8@LBOI68nj6c0o6CA*L>2_jI%wv8V4)~-onLyNl&$M(kSO-HMovyeL;Wis;c&-
z3qDoAR2!=fb)#@>I5xzB)s?+u;9k2@*g7L;o}1!eIbAAlh+3a5TLR2$IuI&$#!_45
zWe{5L&Xv8@69je{NYN9hX>$L@LH~D%W>tJ!KOc_FcTSO4v%wH-OkMcqOhEF!CM0jD
z@)DKpW4Vm-jUg{}JP~9s@9gZWHh`f2V>^jYD4#QZUq@s*Uf-2cnD6oYmL+%F2Of@F
z{(HxHA9n{ADiuVLR=8h(e;4jDpkQ&)z3O=!__tbqy$0OS8UNrqGuBmO5y=pH)>upV
ztWoFh_g@DOJw5v;J)xN0A8{M`RqFqGy{2jVKdP+FLd?T(X{5-7F2HZ4&1}u$VqM^p
zQ#4$ZM{8`4u`n}kSl(4+HW`JH3qJ7o!zAOXLEL*!OjSbF=p0qUeq-n>*4Ee8uaRv7
z@mgBiA|xYOo34j)alj&Tqo0Ye<QBa49118)YuSB%6TUj%C}nH*P7$h$Iq;eKYw`0N
zf3*a%t>6+F&}Xj2E=3rw-;)qclvM0IMF&2oT>;C1GkSV@d;5Mw4=xf5YlLDyvk`;%
zx#$u0YmZbh&O2R?*`f4g`(<}_r8Pw%cvLt3<0dzDXATGP$7(3=Wkh}o+S)lVK$zor
zdH1GOD4-0xb0Q8$+owg%)^J%gbYN~Wgp_A}IZ)Hc``<Z4-;25JPOS_n(#rYO_pILw
zeNJlhjl7-B=bTb~(;=5lG)V)(EeekMJdcIKEaRCVRvl_B;d(L30L^Or6JV7BZ}kZ%
zUGAVH5CG?%&s>L2c1|-Tu5!C4+mknr3@cR&t2e^fxS}Qsw<cQ^HkT)7%SRtYcx}io
zkDjG=(m>42%-$sPG)fJokR&9y*49@0+K>x7SLByP;Ed#}6%>5tg_85{%s19IHMP`L
zT8@p46ESNiMJASCb`ogB$A{ojfV^7!3d7)ZVPrg+-@bj)RDY{_Oer|fIXT%ilv`87
zM}0Nlat|3C6m&mue0-eYO~Oc9o0yao1B0L-2glNJH~yC|Uv^wXQpJLw-<4}g)Bk+u
z&P<h6eyJC7050IPcWCa~yS9C2l2%vp5@iFw>y2UocJEyQr(GVab2Ke?cX|2#kdWi=
zpFYVE4Pe~11T~T8-O=COQj?XHjm&=YA)^4fg2-SY<@Go}_zZgW)hCmf9gT`UJDbyV
zaC5djFE@ANAl2K<+(JH;-J$0POc~yYANF#``gye1!nc+qB9;_hQ)iD^&c*j;0(iZ}
z?<hMo4f;|`<2RT-8{=+tevmwIBH$_7nXVtqPo21_vC50CJjoq4MDxcdz%8{Iv|eP7
zY$AP0DAFeai>KU&=m_!dA{63C5@;A)uEsVameOr<JXspX2j-d+6A~_<6dD<|+q7PE
zoD+Ds^*P+<_^o>Dth97Zy0sn}yVVLwpv0JjI>+I=)TbBVD?jJ`dBZus&;oC5eSLF&
z`{Spst{13h8K-;mbV>KFKZ)txZ*{CGy(*FQWk>BmV;m7I$0?Qa;<+B`n)-MJ2^?T$
zO-Rrr-rRH%+fM>HMf9#d!V4G;3!xEC%n0-%I%dE^)C-_+f%5eFTRJ93o5`1jV>Bsv
zZwkI8@&fCmqN+MuXJ{(O#AMN!_I3Ci9lw93>e_r<w#AP|GE5l^W`Oj?BYm^8v+Ml)
z>ijyQ@<w?IZ#AxRS5{UguFHm}+rPNwWfcjTb-g9kn%Ot)fAZL)7hG&_=adm6-{049
z4qe3=xM^%IhX<eYbGhOs5GHa2DL!-~5xTs)wYm9Wx=Ad2s<qX=qi|ZXqodyC=EaC^
z9Ung?F;7z4B95r`+^qMz8nf}B)rdzCUO$G0hNciR*5u^mq5(lcJ?V74>C`mhk5ay7
z)){zK{)iJc<YZU(k(S7Hm^IPsyDZ_KxO({b_~6QMycCw28ecnoR&J`48a<uFm#K5#
zt$*<&L&eGLn=lt;Z?PlShVP#&Rhm*vjE%3?<nf}vcTG*TlrB$m=4en@8>p8_SB@>D
zOe_En*Y0FzpWmpfBG)@KbYQaJ#N%!%bLDq>a)dwoWvm{isD%-%0at+K=i@1imIzoS
zDWWOUdEx$`ydXxVeaTvd)q8<eR5Em{Dof({TxDhL%N7P7-dzf*<DzMfdzZrZV}A=}
zC@zz`ANTs;&dG8$CAi3Lf7q}j)y9)?e0;32p<xns&B#NqsirnQX@hdoi9@LecUD)I
z2@KTYwRxi`S6*JNSLPwXHaJgCMyC79Tj4`uR9ubQYS1Qp;OQ&Jjap7q1v0@hyWWY@
zswyk$B#uQU(Ev|We;xPJ3I66iUfb~U;NHkiDE7`=WJE+Eu)B66M$MmnJv=Vw&>9rb
zl+@Loot<T5WOS=d<lWp7Qc}FmD1@FwM@{Yfu=}s+-ADANB88}alp5yfx$MSB64Rw;
zopG^abgf5D#l<zV=>|aE)s>X=^{1^7WyZd!*!<4t;R`m5$Gg%9#BQ_x_23x|jr<#V
z?;B%Z_cMz8{QRt}EIf2z|DW=^g@lDE7>S>!=rl)1MV((_o?EXmD_I7n{Cf+yi=-ao
zwJsNdt4)zvvKAKuQS^AhE2`;pON24gjv(Lh&L*xGTS$qZ-4KyTUq+q;**>HyC9xZ!
zU`8r%;P(ATw~EL0)#=R*<0r4CYjmp5lkdj;&ZGOXW1eH~nJ;;W20)?P%ex=mzmH2!
zrfZlV7)Zgvqa>1Qd~$RphufT%tfTF%QGM#A8r76?lb+RUwY$@Bc{y9>Di;39<a-+1
z-Q~rOn>Gv2rw;EON``Q5`>5Bt2D2$|O5UddzASBfkcZ#NS<Z2CeEiDIRb4e|G9a^M
zS2~RtXX;ojL8s)ET>yOi&Np`M>)mfBn2()zuTB)Yc3WFp3kwSkrLb~xvT#M~oE)ei
zR&x#PjO?X_g*%80Db%xl28g4BGp-f#T*=B@raNQmsc2UlsuCR?9l{Qw`ST|pdS7q7
z4Un4h33_##6&CDk`KPC6s;wDW810<xvhZw~n0lFBD9_X9WYU7w)lG~t_4vH^j`JdS
zT&TRT<aHtRo$n+A%{GNXaXs%G9ook-Cs7g*E2*mfShd$<Xb|vT3-L)$Hx^|2dTPJD
z)*rsGFfuaoV-j}n-d!M?goK395zt--43AI8_pVw`SFkfN6#$XFwYI#JeVF>eptQ11
zY15y;{gmmmC+-$$b$jR9yL#u{t>o|-z(g3ky9HgWXnsvHd)~ldDcl)%gWG>Od1%6c
zlYbulgV=hrH!z^#$(+=NhF6sxos(zNqYQa@g*P0`UUcQKtcPb@c0L{ylu~G=<<$(3
z$CL;OpsevVl(N8tcDkP&K0ror;5Db+gP}t1qsGQWWoFW<oGm}$;>v1qn&L~v$&|gK
z4&XoJJQdT?5kl<@W7BJzD!EyYidqReJggWS8_iJw)p$2c(i()-aozLzU(TLzBgM43
zy80D&v2t>Ia~rIt-XtT7SLk}N1Yi_;x3|3bX=`tLdwajc^hUkY!xR}D>wBXivD$M&
z%002YwW*BZL1D9g`r(L>dA8Ej#zXt6-i48Uc(|6I|37Yx;T@q@LjKUF=Efh2va=<1
zN@dW@$Md75-DRXdGQJz=?WKX_21MNR3_qsvYfAA_H!=A-q^E(e+ZeIKpd;hderXXX
ze{<ab;~n}=@LPBd3y7yvv$fzBtfXu}o!U7%I+>$e#&0KGk9M5U24u;tTK-?&m4;4r
z2MlvNK6G?)fCh!w?o4%0O|5J!iZMIHNYj-U{$2aXC{<luYg725^+vKaD=V<6#n#q?
z%gcZV&C}9FM@Mr%OSzOzPt!w>fz#5dfx+7t++4UBSfuOtKB|Fw_t~YqI=sxR0K6^G
z>)_Mi`luB3TCSY%vjE@KK(VW0ER@i^P1ssj_W&WIP%0W`h6jiWa=Ynm@j&mVB6BSG
z{C4*3LD93@uQUTmHw6t1RznMEor=kO`@F9+XMYT)-J#WjtjW}b;0+zRlid4x_w;DD
z*<`nlRY75EYs*LR2!hiBSJHUFhP<UK9NRbl;(*WD<;F|>n6lxfKT(f{LaBLdTxzWN
zxdjXQVXP|W@Q&!~F*~jMm=?wzVXF0{(xqsaBU5em*C(^uVP|z{>p1xM$<fgg;~_S;
zHxggIobAmUr$)y`_cg`**fht)is)Q!^gy%@%<GDXq&X1fs4#@p*VN*Q0;^>?tD@mC
zVzxn|7f0t+A$yK5s$vGAMsudh!<AXueeR{00bc$=6$-4#$msDsPh+*Y>bE`p-FCK)
z6=hWlvTrgcrkplj7sW2jyEa&e2Kb~K>{fG(i~?9u)~(s)#b!iA#6d|3@XqkZE}AJp
z)N7R6%%d6AV#M%s-BOn*X)34x)U4E>3DT3~xf6g-l@T-Y#);&mnXS3`X13l$r;xj*
zs&?Nx;vqJ<fX$6);J!53F^!~xLREBSXkA_1!UUqq*|{}QrI~tSd=$U1G;e*L>Es0e
zRHsz`>5-`weTVFOJ;-IpZil|<Bo!@RoMu&76|k?XYb(lZ)2VzL!Ozx)A<H_{W+VwX
zqH_U`tv_TwI64U-Kh6PB_`DR$DnO-s$5N&b$moh_fPqPdBKD{9MmwRDta^2P<~^$J
zNUVf}1O&p)ipP{P?R;lv=Yh+TnW-@y8(ZoT{9aYdy|4;@WAupmcnNA6VR_*`X+;J|
zO-(Jiup0y<&8|pxeD5x928?Hb7YoJANZy-U%G1Cw1Dy(}MuDL!DJcPktNBk}IG!ji
zGT3cPM1`W!P3i0#At4D~dJe4FWA%k4DJcN~0Z<wP<`o>vx<3P>jQ;-pyY1-2E=A)j
zC#RFBs3<ZrLCu+|-2D8B^ER4()^}?qUd!1FLnVxQik5y7@7Xvx+uGYJJ>Au-cMC<5
zILfeJC!qxva;bRc7vvuv9m)0fjA>S%9vmm}nFsxFp`yRUrQxBMl#wxSS)zOR&=0U`
z8YyTVB2jCLs8!4#T2fM?`eE*;&G+xRjjy(6l{~K@o?xq|JQt(9_=a?V&qr{W9lU4T
zZvt{QAz_Szcbp=c>(%oZH#ubntlwuYJdx3%sPEf%$oOlGnbh<1^5z~rGDs~Kf1yEL
zNqfTpx%|=jtDX-bS-w5Exh^X!JFlsM(aTdqUO|InRUr{eytdz}q0sz%3!uuXJtD#p
zHOQbll7VG~n2RTv68`r8xY$_aE6~7vQ(GAU6ALpl5H{rBypcpA>+5QRb(n5j_?~gq
z{L9Yx`1(kCu;+Wa&s?M4J}G>RjZt7%?ZIwrYMhmm<FdQvak>N_BWV$<f}v_}kJnen
zy66FuY)wRCJzuev<~3a>;eB1_xvd_`fHkz^V~o{bi?;JXw;6;)*1BU|i8PWOwI5tv
zU46}v9E=l^3OBh)ZwKsv9->`u|D_H){@ged`*r61B{Rl;)tm!&7eS}J2FpR+ExOdf
zX19y|v^FU;yb>#^ymU%-R-J~IAG_W{byENv$fFjQgkVtUOQUrU4no~e3k`D=P@!aW
z0AvH!Yj$?(Dp{;_QPmUHhZB(cv3qxz7!=+&C;B|(OmI4Q7!n$)QEE}Su(~~oe%1=Q
z))e`dJ-RyE-<Og&J>H0pNw^ePR4aPCMfdwiBR7JC94xgvfS~JZ^PZdOUm)TB*y&Bl
z>`a1!Ol<q3l;7KhZ)IhV+faMGwdp=ytjQ~HB;)XqauBBBc5t!NJP8L}rtfR2yzrG1
zvWmQU_w*EjI7Q$VYS+6F==&S9uw$Wdc}9B?g&u|8Lm|;PYD~x|E3+TIas?8|%KAE3
zP0iTYI9b5X<9bk7#+l6n<PDq@2U9?K&tVq}1%Sz}%EgksDiOZe)nbj+di(a^xO*8m
zJKl$19y4SBB@!LRx<4GF*ZZ~!r~>HdE*3st19h`e^RLjgPF>=1atJ3HOl4zbwf<hU
z6!p~;Wl6j%H;YRpnN_Fep!3Fab8}Ohm6wjr6?kkZJA1_3m-7v&5FaR|_qmq>Fl~a>
z)%~Nxst@zWuZq{AXA-?M&VUj0^z<B8RHRN8DtKJi4UmsdDo(ky`|1BWhCXEy`6&?|
zwLMv!%;#K@o0|*N73b<hW$nTDDQoDQmT->DS`n<cT$n641h^t-=(Xg`$^%Q_vP=sZ
zw^STiIoXKFNT#0NRFLZ%v@{BLs;w-tV_eyuqC{RO*=2cdNeS?KE6xWaUoZf-q>XTp
zBOVRl8e}#IyRy2}Kb)!N%vP*-r8)4_)ipL=t@pmUFuZNb?LuSU%D@V_C+dr|SoT;(
z`6St)G+FF=>k3d+CSBz&scOPS*LKq*NTsjx<QUSpNI%{Bn^+1VA$rdf<K<V_Pf<uH
zCB0D0KCK}$2mo~HlR$TO_sQYT8~{_SBM^T8E&aH)PktBxp5n^OeKHq?uE(wU@@?uG
z{7t{GD8duV7_#>5;*2X$d<t&!9jK#oR~<|h<qV1XHG-eN4@Qg7Jz^6*g5scj%X^=2
z4|s-V3a|@<$wK%Pl4tVRzy*+44e!5^#Q|%`%wHq<{rdXn8^1mq-OuL#a}njW<o~<;
zdnx{BYa(`+Owjoe7A7g5nXL-yT?6xXf^{`@0NUqzx;MITUFWioOGYv=ngRB8z`<!|
z3VX`Gwb9+|BPt4De+>;t*;oFT)JeSF`nG0IPi$J!=`cfdpBP?sKJ@pCk5A-nZ4#&3
zrOLANW2U3aiZmTiNIsR{t)3{pHJ*V9X4Sd;8tA!|j7vgWldo@u@EhJ%*4ICyXQ@d_
zCGIoQ=M?Lh_Fv5Z_#v)P{F%o0oc~i?f}#{TcZZ&i{Pk@7XeC_0ZR2gufDSE3<!=*t
z>no~)`V3=fIpyLQVYT)AwKm64m;qr+dw()c+57p~8dF8rS1DZfxooX^)i&2oNOe(Z
z0F=CU%4C>1M?jheunJ62VnNo8wb1nR^q>1pu93$ph~>aY1}O+U(&Fi_;T{mT>S^Cu
zz@Ou(1EPdt>MQFhGJkP<l<9@t<&5lXXQmAkPjqWkcv)FhY4!e4oYF5)_xt*%jN%W^
zLOrl4h4oF;JE8MZSft8t-@ayHdj8@PO1{3lZE0kts;y0i>$MLAvsUj*6)-sUrMWCN
zHa0nVa?;LDS69F&gW?lH!ZNsor)H&v6ZgSdDUJVJz02ez@4IT}(1f~6pD)1<_73W|
zHPlR;k+N%Jl`|!aG*-L2+}zxp93#LPja7$_?dtl&zan~&GXT7;(m#r+EC4eyGRh}#
zRE8Gs0pLNE)$GAy8|vl3^OQzp;idU5v^PdmLkmhG<Y&vLgo}$j-O0B2^j{)qY8u@p
zY)fDcLl#`o(_7a791e#|UX>irQCKr&Y9~gW>+(=4DmJ-LN1U)H<oHIwg^Cez(zDuY
z(d@KzJPn++vVsY5vYj(w_t~}LahB#AJL@n>!M8Q7tt0j;8|;UNhuC{kyK{{Nl2|9>
zRH>bY%y-j-W^<{>u&l0srtU#zO;qml@V}Il2GCxN$7oYk#wxqjPo*Ba{kN#2VZ3l+
zv6+$8E3Z~@Qz9aH`J#~H<N7ogg;as=Rr?3%B(q^aS*Y()!BOSo=hrc2KI(qFlb4nk
zADiedcs_wJlzQNcj+}3@>s2RBJf#6jYZ$+yqvL??6>>J76M1%{t4H$7jy^p!E2Avx
z>h3N=8fTOTW1J|<X}J%Dr}0!(!3Pr<&!roI`jH6CYcW06XBBe$4r@{RfD;k$HDhdi
z9G%Kx?dDrvUS4rpT5%e?@m2-qwl_Uw<NpMV+u=PUeL2*2G`hOl<mF|uW&$5fX<tX2
zztVmGy%MNB%gf5Vj_3nr-y2!&EKDJG;zya+`2wb*nUz^Qg|24+^gnOaZn^mpP>cV>
z1wn(imsV8W8?$3#($W_Dzi(S{=!^BK(?iZLFVL;k7Um{%ioUcL+T;MKe_UF<9_s;o
z#Jq%mHi4f#_*+_9>2md)fPer5hkzhjLM}!^LNXvh*brP%QgP)pxo=@%G1gl}NQlp%
zC?lhQRZpr(lj2uNljr^VeK`w_ghYFhpmSAuS-LI>32|uZ%i)F(GpXuDPZT<)W>!~L
z1o-$s?w1e~y^D*B>1mDR<T`0u`(HbNat9!@-^3pfQ2l7~Z7UXX-@ZyrgMSwR;8;Zp
zVNi*SqO5FLOx5WRnaJyhSciyB7n%bBDsc^s>FH?zaB-bW;NILccXPX(b3cBos%+4V
zAqn7j1>oYio86EWG5-`nhqWK2G^Ev5A8ah;8hig+=xi|OXx&Q@&2DFEb5f^%dnOoa
za|>*06D6^^fyLz!8|iHQ*;_R=78Vv`;>_TJ?aNAGp&H68oA)I~(~kgxM9AF@0>_|%
z+}Fhh5Xm4|DtsO;yxW)xaJkY8+*N8+06LOK7gU!}7aMy9e7U_tydXdS@)C0a@iF9r
zQ&O4@1S*DBSAYJj@9Z3N;3g>OE-LMzO?DE|L_U4Y_1gn?mM(kiD$g>~k57(?SaeJ*
zP1naK*C)J9eYOh4cqG0F&!$s?zU_@2Ea!9Y3AsH!Ju;@``67>Hg+)jbLi4ckYewhB
z#s*OD?oXd+$;br4;GgzQ2JjfYd2|r|4=~2Z#zcL56_fc=;-m9&a@L1?%hS^vBwu1$
zONk0TE7{CFzCfN|0vjzW`vw5w4Ba#nk{hohR+-#@T(z)puyo;&X7spG2mbxFni{u|
zP-Du(IW3LQTuUj9=WmxoQR1F%<Oi~rdQ>b-vvlWV`#x)IVq|io=XT6U1fD4o_{E*-
zva*JB>eUbS0H_PpsFISGUyjxR-)C%jN+BG?!oukKgj5X8_54{rP?3RHb>*}Y-FVs9
zT)JB?l)mChNJwb2o;kG^9GMP0fBr(VsvOUpt=fA2F*+723yZwRwZO|~uN4#qy1L@7
z*CvZ~8u9JxD=N6?_+8h-K0v~)2L{HpF81M45|YO!n+$AhibV*-iRbCDjKzxrVGMj3
zRSu-)2=B|O%A-j^s%i`j48Tjn$oZ2}V(53#Qad|wMR#^~(W%;`Jb<h%=~+}(UcHX^
z2-9tPucz#0P{lz-d*Jq3+Sb-wMn+ba!--QtL=1zg5DPuHt>^;398D)VxmJ5GMxGS-
z*`S~x)+9kvQhXNWn-Co(FnAC^(tBgs0P29Bj;=Pn;S~$_2>={o@4;cXZ+vII4q>4!
zZBO)n!6|b(>d5@@1336~LMg~+n^SQ{`lluMhz)HfM@Fb2PdKhWmXv&Z3xLmRYHG@e
zUsWGUIQ`XdP+oj|Sx`^(Hn(@xw}KowmIK#@<eBPztrFYGltuvG+@H_-AuhGPwj%xV
z;npA&K-)xnjb%l>Q%(+!$v_5~(Up}62_#Nmc&IYf3e>50>8KX7-t)7uL2=TlWwFp<
zH_fj909-_c=rwNR8L>G9iSDXK5W`M|jt+V$Y)XUFTJab0#w^jXu~L$d;HdI*TmZ&<
z!NyiyzHiHWtiVeYJ2IjS<^`734nQ|-A|il8fp};R==b6-jx#Nm6ciMkd?85~DG{J$
z#;RUZ?4#b;-ZV8fAw<{Fk2=_jK6ny%P7_fYh)zX&*>Vq*sz~{3^<HA48H|ih!tx6}
zBBN;E9UZnihz2y>cv~<2n3~BW!3lYIvUDZP{%fs1WpdRs6m>COd9Tr(tB2oq;hHMk
zs_E+Tm>mo)=O~<=kv{8AMqI4Gv8TrvK7dl$7|!w(E-y~?%AIwH7#N(KoE8VSedHM4
z{RX+V#}qf>g|A2P=3mj%3otPS=M%zju7e+8?9VkaDFdttU~)abz_yox;$6!K-KLNF
zrZ%u|--c>~M*)mmXLc5is>=BkVK+!ZsF+MU-;-Gk^TsT0yF{b3W{Ii@ein)=Q}zq3
zGW@}CyBQSH*toDPB^prY_t3M7goH$!73@<U`fFM!;y=L-2Oq~FI1eP+f7%#l=HP;E
z<!*<My?dA#8PTyZFt9NM-Oh)ABA_{u8@U$xI;I|H^pl9MoSYo*bs1=HdNh5>00iaz
zxH05<L?r7Wb-c490HC}oz3LMa09Y}bq}@_K7Ano~CTUC(JXsE%1ddmb)Xnb^e81qh
z7X@35inN9_9Fo$@t{$_w>^J0sPM7D1wpBSI2Kjgk8@Pyy3MU8@W{kz``y?_sxp6^(
zY`3s*Wp&lTLZ?Dh#sByng>}D(xlEwNwt!drGZS2U`?8|K4?x0xpr}w<S#J6IhD(Q?
zMkpC)X=%;*Y6JK34Ny%$%wIoSavGaWB14suVzS%@Tt~5fd+4(!n=*)>pC7<a0p{+w
z`;C0RvT_6|4#V%Y!ravD7ZGY7$^f%%-9c>?6%#!^K8b~C8-Fm&07}=qyy^CCbHvE1
zC-Ni%@9ER0)<5g!0BbKUP61Fq01XF#DZu$!#tB2}arB(j)V#dB%r)XQw<jo4Qt%n%
zzn-%`#Uyz()mslxVEJFZtj<!d;fn$RkU#<FqYzN?Ra>>oa&uQ|iHJ}evwoE&Y>qKI
zG$p1AJ+I*dQn-@g73F-hp1L|ACDGY<rVJ!}-3}4)NSXTTA=dFJLP<^SgQY&Z%gtR;
zX)8yrWp!qDVBw@pO#Fg_Es>{H+!MhXkg2$*z?tDea4azT{DJ}~nNW7eHT@6DuZM^B
zK%|?Vad}r|koDzD77%9w1G~+<y}`ULrIxF=Pf_pN30PQJaZwoo7>)V_&x;o?lI!{8
zk!xC_(xJ$>mrIC`09v@SBRG^fY(6TfsCT=$%#i-@w}9idVjbAQ=wC3Sgs*LWZ&O?U
zci6~F_WR<mfX%&E?1G$NnfInlmM+I&{{pX{$#Yl-csOOY3y+)eUT<u2kZAb(mE2)Y
zlR?~uq-Hb3l|(Q))nu`Dnl%+8ZfPkylX?+h1CSdQb*H?&Vj^yDuCH^u0B~qTSq0!+
z@}uvNBbee#W2U}!ry4`JbQ?YntRrS;>)CWF!f_4{M8>K)O^i)VS64kRN%?x6qjVKB
z#DzUdt~%9xVr}MWzs#fS*RmMmKE>uWH}o#K{~s_d4{B%Jf5D{CsXRc!9Mswe_w{%#
z$~S`m$wU=Upv{9oz}qL<5)7l>DaoVjxbrzXgJX@7><QOWu+r|#%%1Rh&NGdV?*LVz
z`nx*!^|0WAL?A;K#IkL_S=gIT#=#?WlNw9<t#a9rIkUh5r8YaC<eMs{0{oaqrU8J5
z9%jj5QB0*?owCICvOItO@p1(b6H4l1<5@>R#l&O@WZA{D)<bwR8;~1iWI!L^-%j+C
zPVbApiDlJ32QZK0V@DvRM?^FLzYADU_nuGae}c(ac(*}=0-ix2vsi@O4hSXyxD<~R
z?nN_?iix6SU;szO3VR;L;fM;IijK+gZ}>(90O%40|FJ1RcmipwYj+_FgGg0PP3DC|
z2aq{y0Dv!eeUONVX!0GK3GO41*VQ7De;AumH7d4wuy>})b@Zs__R2zrnnwA*#cJp~
z?uaCXX=-THn%y*fDgXoUE>NTa2Ck6I*L1U<N`kWv&}2Z70cyJ5mK&<pYvz>+WTQK)
z_@hC2B&9R+iJyS$!Qi~7`gO%=r?DJ>|Bd8m{~M}9hwN0o`?|N)>$MquN9e7^Z0vF;
z^oYpoJ7#-Nj~l#2c(U+{o%%{Q^2ftpVTPk{TFCr?I5h*qWIYrN5X6Av8HU|MNq}Ok
z4-gU%g(4`mkVSzi**}EbgZO`o`NI7OZ~3|f003dQAu-|7x(5OyVTrqZ`Ox)zLFAI`
z5{db)!jZVrV{gY?>Bt5v`dRjxUdI|GRR*CFgb;US-LH2w?2J-nT?-IX40pBs8pZc@
zF`gWL5Yq!n;S@o4`d1-)mK49P|N0Bc{}MtGe|G=B(MbTD2^@FV$bj<cy54DhFN<lC
z$7+70HW>e;7&sdMx)^+Vc|f7PRVfUwbEx+9^^HpZqy9!gA)a^&cCh6mbHc<V0#_H!
zxYX3v<BM89)K&a=(&IfFEAZhbS_D6z!0F)*Iho^8`_XzR&Oc~Y*V9b}2QoqXsT^ny
z%q10FFATHJ&X<OP7vM1fdG8?ndPV_&_83)i(DA$l4b=e-h7x%u!%h2VB~ZfELhZOw
zp`E>bT~lSQhD!Qr(Uq9~ZB&p355z0JjcoX*J3y{NqiSqy01iY+d~USD!p*p%{|tS4
zw5Iyms%<VmRu3iWX>4>X@QfIr^rZ@$CV6>J7ewoYWavLAoRM_KY@!%Y#7=!2UdjT%
zTA-4@@BmeUZm*F5YT)GHtb0AGNn^MyRPPKV8E(;6f5-SN@=0a_5@6=(6;h}_cCRDC
zC_uDH3#}Ip_fRqS<}*x<#6JSyt1{+q;{(2Aq-Chx-?DxLh?We}DOoiS+I*2`U*P%q
zg^!yE#L;T)gudZY{}s)l5Yx{U@B_uL$4;02CD$toC{F7#B8%i7U0zp1N8<y=za#lH
z_CEj#0dM-2XZZIUDB&pD{r^0Q<L)TgKXama`G5JcXj<MqGY&68dQ;TX3yzmNn)dm}
zrx6@ZW5HKGpS|IDoRkEv7gKEhNv_Ear!6Xh_aF9m!WwmQ1g75hcIr08d#*R-qW^$P
zET3Dxw!x%p7m4*vG}`|?+ynmb9xnd_m;9fE^TGT$vCl%UdrGEtb}FNyz1$DWWKQ=C
zzPY;_-SVelhc!uCM4*tgtiP2sH!N(^OHcg*CFYwNd6VxD{P(xopz4~R)E^x>)K8_#
zengh~%#4+OTIsJxzBL?_2^C@>O?rK$!xdK3fUUo&A*Un2^WisuhVrZ})1JGtp&omE
z&QqFYaDS_$qcOO`o0NJ+a^{`c3#RMn@Y%7?C;{6$+fnew*<?&d!?L3U0m9#p4HuF3
zun7xbzlToMIEY$ozs)f)5z)zzgExP3wZI4+WPlvAb0@7$H6?l_@)SiyVgx}O-~2pd
zPD>ah8fXy}`%qe*Q5~;DN)Wx$nl2}EyYully`e4vC!LmocQUW-omOuZiNyngS<7zo
zf((kure_99yqy}!yH8eDd~Rg)NN^KXG+95&^`Tg3?amvEfc>*@OWjkN4D{q^3V*Ie
ztG()RWosy_Oc!0_y&+9cy{P17SF;hKd#){~VICXnuBp@=%iDUx$ebOqnfn}Ozx`@x
zq#`uPUea!J`bU)fu$?xAVmLIWY=k2=%$K?USWRstNVYg9)5iPwRda)n8}Df^6^|y#
z*kLiqy8g08sW--dp!t>;lavdyKN}Fk#e+~O9hQTA8|mj8a+ukgTPq{=x7E)^%1t5S
z=p>rd#+lG?c_|Cc5M0^()ce<wB51_=#$o1vblBm3CUzJj+<OXem(rXVB1fllrp4WD
z>@V~d`Cz|Og3Qv%;n|_`#4Nv`t?ukT(d3R5)?phtd4=MQ6{8c{Ya^S+UM+B&`ECb3
zQ`8d#4`=%Ph-DT>mTzTbO4#6+#8$n-=8AGMD|1N}Xjy5=_{5IGjU*jZ3JsU@)6e#+
z+WOHm1#&`&#4YY^g6C?N1D~~I-Qp&{Q<GpuWO7Uy9+eSrC?q8?{$Nb^!8j|rI63Em
z6pm=r>S{6Ok)2hB1f6w3T2*eMp*u?`I`2NZJ>M8C2U^QsX;qYk@Fc>-qGF<^EQN+Q
z{=~dqGsHFI90qgr`t2DTyzDO(^2ZUC7Is)pZk+3QFdwa2yFp_#`V|nmq0x;imdW)h
z2g|y}KOKu*nEeL2o=LC@480|GnR)QrB8R!Jx%{hwMu;Xp<jg<9mg!ekQGIG-s@A`Z
zFM94_&%o`Vr!A^#V(qF{=}B7TIX}lBICX_b&Tvk82)HeGbo2mSwpD1TA|o@qk_x$j
zxu&L?1X}!io7E2{PhwK84OcS27Z2)+RAXu#liu5KXE&|}f^F`*?^~K&ofHL--exA|
z=k1;B&8s!{KPL@t#+whKe2q!!?u;ys+)WZZgEo4oAazKxw~EG}5Woqaj9=`HHe9jY
zYxCOM;~H-<nT(80G+1KAMC_&Kh&67*=SNCICq^5v%f-?o9t9<xIGrIKDNT&`EOL=A
znV>i$vLf>{eH*||uY7a2!3YW&S4Djn_oDauHjHIXL5B{nPRKO*uPqvjLCY(XoSCR!
z(#^@rUH5&T2cnuqP*8hxG#(?3C&WrXdDI}}ZQ1pTyvW!3uPGH6e^xX#C%gGUUY_Q*
z#98_v!%d`~E}}TsNbI<r_kjc?JS1X7A1roPWkgurwzr^wa=ih5vXT{%l+@NdN&mE3
z-HCT3xO*VcnQ6(`OGE>3pw3ousNP#}JG8=FOI?lo^m2}&_F{E>+`OF*?hkstq<+fH
zi#Lx%#LBGWsRY$TvmIdotf({^V8NO5c$_GAu&A`$`3HBbc=z|jl-BvssOnzyK*Fzr
z>YB0P^1ZA}>VDbAxS~Ec-OpFl=Lh@7!D?yqCmfvAkUp$Hw}i8_%(5+Ow~4J>1_+ML
zsABY6rGBP@e6O#!2w;E`+-$YqJ`Rq81u2?wxTSfvtjvCKyhbsYo-e2_v<+nKj8{iz
zuMFAXfJ4M2Sl}@d8A3wH^Saq3pHF*5=;@|Wv%#`+pO^m4<W~iNIOcg#;Uj5<f}^6e
z-M(y>irvhDqP)T%7cRz@?TYNxqpCEJS+`h?b#kmiZf;G+=SCi!*&S}n6Zx%dh7N}h
zdJ(Ra`5!&-D<|;KUw@yI9_)V$?7Mt(KkhK>$v2L59EIe4LOUjOD!OPjNO*dWtf;h%
zT69^%tCQlqgcq@$?lET~;UED)D2_q?O<u?=koWwYzo2{lJjL{_mx*<&zfbsBU&WHL
zlCM$5fS<`PA&ANJ5VY*p+cdIoNtt>q%)nq2b3;(s;WcHN5fc4Z6>}gnN5CWStU`bK
z&pgA|UiN?0)K*@<EUk(`y*$lr)cvfo{OHN>-g549@R>);Z8`F+DmdcNx1i2cTh6}8
zS)+sud0UIM)jI1L5gJ%w5>EQ{z9*%Hq!!W}^mVy}g@$USZ+qo?R0Sy8FRbpT3YnGj
zvGX<PxTPCxBk?FA^pd1bp)x^crQT_xOXNIOe2iT1>6Wz7iDXwD4L30lu53xF852`9
z7_8#(w+xLKKOQBUwa`u8W|-C@0;?-vhXwWZUA${qMO>(mTY2s7zK}ks`WA;XGC2Fu
z&{2CA76&-gIfRd_Ui|jDCQ*cROMwi6)5)Xx$Uf=V`&N?01m*7Vv@5Uj$bPo5Yr@l=
zt!2W<<XG08)Rxg;xnL%yqKdI;8|rX%?JbksNf|J5vzf?|kF+A~@QH$YS5d<u&q>eB
zm>va4P_SgsFJ;cc!!s+TCXJS1V)9UcG~pME9d9hgX<<uDOk=boeOF>u)`_kz)gI`e
zQZ>b5rioG&E}a<p7_IkA;cp?eHL87+qMaj4AzWWk7^jt&mdRI<JgpoX*1B&J6$SW$
z6VH&)6fCDP%!KK|g>%A|L*3LFCoiCycyrmQDt|KQMUm`OsYXEXGxxbWFrn=k&o}NE
zi*M+sG(xLN->RqriDh<pCK|_HkXwcN&e&UZwQDC^aZ8CW!X9oMx*w<t69#imTfOi<
z3+BZ`!gX}_k{y5j91yGv?OdoKkW9}P8S!r0y<!di6`Y*bMfuch`_`G0GKyOAN=i4)
zxXOd~$!7=pURSE!YyH+T^(G{`uPlw2yC%e{?vAGvo-`}-DLW_LtVq=z^rz#o_dFqZ
zI}CpLMQ_Gc_p?kVf9HcQoSiVo?b-09-__xFQyAcYxr5Qwc|xHlHqaf##ua?~mp3Q8
zVY^>OuW(KeIu5)tJ}?8N4w||`gDVur{@8frEz^+_&j+dL3W9ms7o6a8<AeGTVdTk^
zhLB#QE&C>A;QhBVKooGoPPrMIGY6^;mQn=s)<R^k%)UooX#Hk&V882Nl4e)@WH;QY
zY&$&%A7t|F{VFhsF++7UDl*ZAzL18#8;9zFa+pf~#ceI?qK-ad#)q0srR_(z-djs%
z>|}4Yz#K@4IsN4?Zw&eICqUz^p7-)<x$*mlQoL@g;J0V5uXvMrKV+-#GrK7IY2*zd
zJtSO?`o<CCcPjjpwdT&<*<=b+mk{#OdaJ6dbIsBGeyQKxMY-G})Ai=Y5a#fiL9el&
znXw>ujn3owJAxCwmvo^x%I(Y0CTCNpvE}uB;TSNunGIGGn<7L*yY)u2%ofX=juz&9
zz9aUaI$X;Y#BThfGF+BI5wHjI^~l&oV*Xxjf!Y9jr;aa~QBZ<eyQ-KS-ZWL!BR_2{
z&=oZ!V44w~?qJn2Zl0TMtwo>v`$4jPI+(SWJlq8pg%xF6Kr%}}Dw@m%=6}Ub4G-kq
z|6;llHGWd4ZTBCSV{jdI269(>+frmB6$02q{5`{8HeqPRoU-Z}&^=&ji~D;iP|R${
zDlroT9=->#>^4BQ7}j}v^Q;4`{V97~2`uQ*_Z{(Be=<TP@t?X@z8?TYa88k<U`nPM
zxS*36(7jD!9WU1z5JJ{x_h)&J7cBmE%%Ozi*8J8>{QATHjOqW4v;Q}DLzv$<@Hy{1
zAtT|j9eTeQ{qI|V@(e7E{*Be2e5YqhP>HrPQ@R@SRY>E7p{HjhD0Lkd^Y<XrmCd$L
zHni(;Gt<+R4OaoiV6E@GSY|0tUPflq?d<`;Sp%IcR{%w{yKBYZ#jj9SU$VbYVmUa!
ztHq;-T|+;eM3;s8B8^`~S$S)`-bGli8IZV>i7Kn8u-$sH13JOMbzUd4-_JrxO*Rqg
zZ&3#NLQ+8~-0C-gfD1NLjVJ0O)|Nn>yOuTZ!UA`y+E69Bv>E;hkeZ?CI@{WAEG)b?
z9QA^y!0DP`F*9LHZGVSu#dT&L1}J^aBN@1zo}irMFR0JfP~bQoN!r`n10X4&G>Bo=
z0vW92E=xfH<sO%l<KJP#u7UbRZ2qCuHI7rA0QToU;q?LNCIb6d59o;j&f%!o#C0Cs
z)LVijb#<2z85OsW9|3x7#mH1jQZfnTnqE>8j$?m*j?P)G=)xNJ2RF=H1<=SRPoBK(
z{ohIKv3VL#g4&w84^s`s|3%vkj)A2quifF8C74yXhO&Jbk*P$5N2Nf_xO5EpM#}4B
zJ&V)OKuK_M(Bj*4eVJEKAZME(cEu4SUXyY7vEl!(1!;^Pfb&&y<oAcmbNsSRbglPx
z7qmK|<VE>~PgZ2$;0F?D^`x>z#C&E4006q)A5Tts7GgYgQfVl++5LMRpEbn@^;2Q-
z^Vd2xTRA%0rRiFjTVj)NjCD+$A~iU_G$+ag#n)aeq_ue<k-+c(mAsl7SY;c)y;qmE
zBv}#@;sHdemn!MnUE_LQL`=-E)280Z(GiUbfPjNzn1h2t%wAjRBqjMhCLLI`MWZUV
z-V<iluCQpg2TB;3KzZb;@NF3tFE8)Qg`X#ulK|388t(1zR*yJP++B2gqNv{4!P&`0
zQBJ;pp!=&8?$hC@uZ=&+)xv-RCFCi;td34H4u|O;HXu6PA|V0ZD%lD%B{!y`0qN;W
z6Xb$38X8LRPyanfojD<$4;%SrE~T;cX9-@zY84&cy?Zxt&Ulj)&k3+C3M_;Ft`mch
z+Z5>HNYc?xdFAEtem^BD%82E|ZeS!m5|eCYd30ZL!6_!*wpP2P5pSYMM@8^6p!$XB
zril4rZjaT<Nw~UB%?$z4O+adwHLvzx^?>BM<h(f#8k+ZU1Y{NfEe~kg-JP%1m6eya
zc^B&Afl#im@(Y6GExf((GRh3h+Z=4RvfZB-Q&X!1*i05~r`e6K)_Z$i_fP>k9#Ie&
zxhEx|+vvehPoKbc%wX3c8_r|bBTYMopDlmuyc4_p8*t{KH<^UZT;MfYyzb-RNZ-sY
z(yXM0(9+Qt>(&}vR&xR}W4FD&c>K;VtJ$*3#-iQk`qK}l#?e4u3_v&@S8xfsBk6j<
z$ACVqrDYKS*C0B21o)nUW&c>$J)_0XWthvWbJgh$9^*mAFg*rafD{54Q>|(M_~omw
zk)`zpNR3T+KcB;1Ymiz2L3EU})r`Pp@M0p*6?NS5Gsu70Kf&zspEo^VqMc0iCsMVv
z06b10Ob_+peL(U-OiZj|11R66B*hCgOFedS*#OYn#>Auv5aBE{+>-F#FaaH84|fXk
zhN6_pgg&<|K7anai;1h{KD9itIlzQN!aJb`a&od1?HxFx6rg|?jEsTM;K`AR?D^gQ
zih{iutt5!pD&X3fQ8IDk`0a2*mV00a>3zb?Y!j277caoY@Z3^eup*fHA~C+2oYPs`
z&JF=IlF-n!Zog?;M>t!<d2Cu*0dAwCv%T3p77w31x%aXY>(cEKXh8(T?LOS-FkSA2
zURTjpxfXj}T?#7kEVTj>bCAcm?dh?esp2j7Rq$7Mf850h?<h?7roN`;-IymgK>~+t
zCIg`Nyal9BKo9|F=;l;j@6G`o{7$IlidJ};dFRh5M*s(PQj>OdtsSzDA87_tZ2nu9
zMP?3b?Z_nWH(go4o8C`{u{1LL$##u{XBJ_X(p&ondHXl~?rV+!#qjf_*$Q4;&<sZb
zn5v)MJ~j_7pk#Jy$9k))#=Z}+g}k;Ly_@ggp?_*TEVFOnaKaRJ@<!DMd|EGr#A#u$
zt-Luk@$BY0&DT2$=w+~oTGChPAR!sTe}sV{CMJqS{_0y^)_6vae{N!M-W_AwLcte{
zN9a^ninl6E=l1rG@1dn0XgpM0WhS#_B6Q%g8Z+yRnUDNkJATr2XigCG$fBdmFH*CF
z4N5E0c-+L^WaRCG@xa>Jzx-Vc_4eR+N9f~5iG*Bie~RG#UUE3;=g-_JWJ=1)coc+$
z6ok&l2Wd{EJYKw(r~Ra#eO&%c{I9dJVx*-plUq=Lk%A7S0)}a2z!rg&ae+xT)##4R
z?|Ok$QbNVvfrfcaox5=5!pPeh5Gmh*@-ZN$Dn{HslIN5>TGCn}%r_$=y3z^Y(knZP
z#ZWDTP9jQSK#vo?sN>1;eM_sGMuZe5reJ!aqT(MUH!tG4fS-etQ(IemrW$q;&B#S7
zuBhjI(W5rO^NXGX78i)hglszV)q29{dyV;J9DvyMs@5U<&DD#S&%T+m4FX+gAh)Hc
zvY<y)KmIEL{iEBjNp8-CQZU^yl^2lqjvvn%8Cl*n0QbMu(eVUgnU5BgG$b#6deebu
z!e-V8=usK##@7oYZnS7G^T*!f-AP<*xWE9Ejf89j7t@qcmp_#}3{D}@1>Pjw9q`sx
zWep7t6_xVp*vS=G4z6efys7A`avw?fi_5T{=R7<KI2_)?227TK=0AEsCn?+Wh=oer
z_8wM8Q$k9NBpR`R2L#|NEw(4T?max+TGd!@BC!>htNLTBuN@|QU~5nLEsjH`9qzNO
zvuVBpeoVBhk_qfJ*Q8bgI=DQUh7Zm;EMRY~#<BUWudm~a7XOQueY)%xqe>d+2%RZM
zR{Nr!o*+&sUKz#tG<ZCqBE#BT+nMd3*5F$O!rezvcvD$<*~sW9kkUZz2pfz3E`71w
zTBsZm+hYojF@P$TVpIIZJ3vFw_BV&+N?3Yd<SPOxFfsxU_5toD{33|qlt`4HAB!q8
zzb;=tadI-uAm(ep9Dc}~5O;UiueTsxTKY?Ut2b{#qcDr_AbPuWcf)$JH+}zuOh1F7
zT=d=XIH0YsF&z|e-f}$XQWBL09QDK!?Ejcl*If^jFP(1YkBfZcw`>_DW7cWBsxB=J
z1R6pC(>b{OBNz`M5z2-s3gfGc0*qPIO0@{D^(=ZVOXK?*ZR?@`kG;1Ht8(qz2Qd&7
zK@gGdk_PD(q*GczK%_$ukY<4*(%sVC-HjmK(j|-T?pmz5P<K4<?EM_?e`Y=ohaVJI
z-1mLeFU|<S7vdE7K?w+H*G)ul9_|b@36<M!<mL6uCMAJ();-JSm4mSYZFaLh0!__Y
zJU0!d)6+e#ot2(A)=Z_$zSh=OFF0RTax&@Vh=L5*=NNQKUMg0rPmQAsTfBN;JidHX
zo_gA{c^9-t@%Z$!{9<E6LaadlL(J(M;Nd=w-7<y07w*9`mT4x8=;eP(OGk&@o5*Q9
z$@#<C39!EbjNtQaD39x*H_46IhMKh~Tfa!gjoI1guy`0itb=XQc02cmI9pVA#Oq(n
z>cg@>0F@35vwYYDV9`d0GgD>d#T=~OJ!<>_1omH%=>W1me1>3v;JuwSnFqo7LQn=;
zT4&Pl{tDiWg5_T?1HG${x&I#{s5_e3ya28Sbj(0^=dm`o<yG_S0P{N3T~s=Twt~uj
zud95E*UfDGNs@t{8{3E@Gl$%Lu0=`-r>!Sef94vcGE7^4(-vs4$sjeQbU}N`@g8M;
zeejc1FtT#$edBlJzJmL;e}gI~Nu&|~6I9vV{PKZy@A2jY@<Qhdvp)NVNuU|0`|TfE
zyOv`!5Lv=8H~_$c-lc3D-)HoFkfXHA!9){XPraEyM!{omWg5P!uM}@<3~dscY|puE
zPkKw#IQfS6V(D9|4`L+i6G~KT_&EN1#1|J0x4?~O_UmNDKNAwtonNG(?vF#Qv%MJj
zzVOKl?d>H=EA<u&s-7YF*Xp1$4`j;bY_l<Sn+8r6mXI*B*(i}c8w3^z6(l0$8qs_M
zple*t9Y$ZC{Y}8Y%r|MBgqoVu)E~a#p>_>KUVo`Ui<|W=^5yMgaiw@9y@eK%iRTTJ
z9AUR53khRivGTEhU@J0T&DdIxt*~HaO}(I-uR}zE-MOC@2^iz?oNmb_C0(Cwj41Iv
z?-TC?+#PvxOFsz%s37>o@{;N|)m2;dC+s`$nJm803FZ<)Vf!hF(3b@wR)B?*kLAnG
zP7U^-fz;g(@V^>|`WJ|qSm`IB86+Vm-eSW<kkGVKJ^qxHRcpUZuUV}qDVg0?8@V-k
zhKd6)HeT$xs#JAOYoqlSz7e?qZiDB*pH!BXCVBG?!k5e`F%Yu7ifi2SPQ3L&1Y~Jw
zPE+<*quDl5^4-6Z#=+%#zP?v_?PsUwc({02*w_HD&Fk>mO+g`K@fM{A`cuQrDj-i#
zR8%|M-PorkA>~qUeO59_BmXCp9~Ctqdnn^%bwcU65-StuiQR7gLVKX9it0V;8TbmR
za7WJ?R0hD;8?Rhlh?oFE{J9&^;u!nKa}dh3gI4;^wib3@V(KV3Uge|N(!IRA0Lxj<
z&Q4#yWi5;v1P9sn{LUxpM?;guQ4HlJ6-4Y#_vhZFkdYm4O)yA2L$+F<d^^62QE_|>
zwlrMaH6Xtb#TZw}0x|nHEV7Sx{)<$!yQE%0iRhQ?=D!F@8IgY=%UQSG8y@1=3pG0W
zJ#jx>eIVu&UflG*0FIX)Q!x~Lc^Mh9XPj;+4jS30v6XpR^-_RQHW;1_7<h?%u4M)b
zo)3rx2E5t@B-(`fTZZ2+Z*l{W4IsM_UL6GC)uM~w*l~tyu)Z6ZJ@b3qAIr)su#Fo_
z;^R@1A}<I%&+)#dGNlyWjub^-n<n+Ys{0xe#tR}ZNvrRbLk*8-Ojov{fHrq29+YQw
z&y057-gfVzb5In;cxG#9A{O0xaW_$U4D|s@t@YUspk&on)y&k}c)_%dC5{}ZLvc9L
zolMO<bd@dvb^lvHM#6;h)7buxY`4&2wY(37a_?{?R<^?LKTpOzQ^yn3o$vUr2ex10
z>7dD4XSDzV<D8H^UJO{V*pZ6Ro2H{jzZ5(;Vml@l2NrdvTLhg;)_mEZPRK)@Q4PL0
zjZwvGx&Haj4kTqRS@K!RH%-v2{uS39@IY6qmV2tqveBm9u8F#1#mY)6ZoNv<>rdn~
z0A6a^Z<-q!h~{&$Jq4GS;y6_yn6IJkoLiXb#@psbU(RQ7sRpz|(i)uA$a@cW4E>LZ
zF94yU;1VKPWDTM!#sZ7s5)kL$z>5i*CmK)e=TN~azZOx@3j0e$0rC6L&{PS;iv*yk
zmi*OA1N;N*cP@|MbPNn`KaOevl=7$qfVM%uUNJQ6+qS3g@V)YlU{sFU*GhNU#w};e
z{RS5C<{SuEtix++cu4j8rit0u*+<yfhS}LNWa2A;2mrfc#k64x6M1ZEL;#>bf@62(
z9hV2X8s`b|V@8egH`OBU`UHn;Y;1Oy6`JDWUg!Y3R$|;)0;o$N?nV?L1rkc40G-SM
zn2FxXw>ee<c}DEDXAc}c-Wbbp;qUG0I`568p#2z9T>MF|z0^pKGmIN8vc*Jv@8_|c
zLd^Fl50Hqj!B?ZB9HBAGub=lU#1rYUb2Mk?V|dE$ZM>NDisd?@SHxm>_=-U-+}1yJ
z4P5_6C5W7myc;9q9Z;t<p-VD}#m&xfER%*K<el86_M6EtZ7Kl{9l>-b?cgL(3)0oq
zRbN2Turcg&0Q~QAKDX@?P{<FAcl}YWIUEPj<kogpj{B#3AM2d~sIR=NoLVks6Nokh
z$v5KXdGRqu(Vc1y0ht$L#q*$xlG%m!BoN87112k^t{(ON{nFA>52eY82~6Sng?Sej
z2q-L2Qc_s}sQ`Y4-o6>v&V8(UK4<%P?;Q3nt9Pl^P1m)xXTU6egpZk@le50TnRIM9
zXV{Z)(27l7Y59Wy2c6_)Hjo(D+yv;rI*Z<z!$UTHei*=TKN+ogKiWEC3kVfN(?I}w
z{IbOSGtikx;OB4N`3zLNTpr?M9-OqIfD;M?^7Qmm4B8duyR)S2Xv7bD=>Js?0TV+r
z*^cm`a0Vzepud4O=>mkWt(@f3ZTI4btM*MLXt6dJ6z*5AA2s^VOH0YTs<&=Ev^2U;
z#B&Hp6x4x)6IBLg&YDw`G@2Hy-=ji$zjqnFIQm!NiFu?>uGIhnelZ|-^OVe`zW@p<
za4xVrE}S-zS>+<~WLhB^zJGF(ujkqMKpghXLL`|uzSgmR%blG>Cj~+1l}GSbGx*Nn
zW`BYrnW37c2dT7pCXf~A?(9t9a_lmO7X!f@r?6-dWB@A!Ni^mf@y;8x*Z`ZKdr=Qd
zm^Y;AdupK(=yxfJhM(UdX#2Svae!GTvf0o4Xb*pKqV*`s)(oJw);89dG-`TA`}%SV
z`>%1TL&ItThoY|uO0F^XZHs>@iZERi(U@BsPcm7|C-P6c7mcyxzsW|e!=WO=3NZ7z
zhqbQ{j+8D7X1D~PnzK%hC;3m9bjsgM0LCa_KvIL6$tVLzIQtk29zvrc%4Go&7UTfR
z%F4*90zpCK9^(^JVQz_Qv$NwN8s7l?x8CJ@ek=;9{>E|uAUgnrd=N1|PnDY>X<BTl
zbin05Ygyc_@BhMYKhvR*YHtpu;%gT|o>NtgR8vl?la-T{EC4ZhheYGMtLZf*YO_VR
zt;rDpZU?AdrO+_@?Qt<=kh#dz14MSM{@i6&2PmeIF-BeR%#EC}8a;Z1#V`elK?E3E
zn|GV1`%8X+G;#fzPnbZNjvunV2oOU)Px4<F5tcMnp+rW!AU=-eoFZdG3V6pS;QB~Y
zLvjBJhvzknQW+roTwc{hR@epTGt_)p?e1_WD|!FVA{P%S7LvyPRpjD-Os5PRB*K^j
z;j4=izz~2y&O5uimCV4ZP2`7!#&jLatMqzsZ9NeHXxFYTscX14HFf)3M|Zc{J33@i
z051=nM8tnXv~#$cTWlrwHh|gOSI0|{f4U{l=vZZV_J(*5GOnOyX^&UPDJr1@KM4g_
zRaqJZCFPeI+{~n8L_F1ifU|sYsTLq+WhCELAOX)8e-;<UluU@;(!RWrsoan9aCo|K
zIe3OaLbkUjTt&IyRilDleL+IYl^ofupv5boCSs7B=!-6VE#D9oH8o*hh3}LZ>nCku
zlARknb#Th1$y>`QDG4Tn)A_kdL<B&^-;R9|RlK@^Kits>7`ji%>Kf{K?KW3uS0%1>
zIT~HJa&|TURq%q{TEgK-u_!J)x?^Pz;F=N5`2Iugq7f{xksPe@*MEsbj0FZj=!Vt3
z%$c{{4Je1bV9UJ~$h|`31VO`WHa|;7>RVG+<*SBo=*eN<yA*|+;Yc3f%76yZ6YhcA
zV0!=y?k7ke_L&*L_&Z&t!X(tvvdMn);)|GW!m2+J!5m3v*Hr*>8&r<LU;<q<T>Mx9
zewQp=UQ^*W6{*oxuL{8Q^!mnaz1mOibw%OvqOt0+?HyH_e;U9-qsYGokdq{hNAg+~
z!%Is`E1zk2Aly?$PtSED<l&wl$<;(yG2Nis1_t`dqIC3~+bqRr=QJY+?zbTgYBs~-
z+Ct4rf}Wn9kh(e`Z1M<pGS5#Gbh6)y!t3mei1-=QA^?DNdwy9A8KBTJ8&!xBhxq_D
zz0_n-O--%v%BuAmrcA&VU6cN$XjW6`id;O78>Z&yIFZ!!JSdUp2h<WlFZp(6v1<ct
zEKh5!wNnyYV^JtN*=eruw_)SY=j$&NYmHx0dY3t}G6|Pbb}obfAl9xROg?{h%puF!
z&ys5LsnohL15ni{j~ccV`l+f>Q<=rSI+DoQD8`o}H$N<%Rxtj7_TeH^x=_Th%I$L-
zuPl$$03V;euCA1t%0JaJ^4*3ErQ+-!>9}4w19<$LeB>QZPoR^yb3jp!!qLJ%gD>(T
zAi&Br?5c<+fG2!&j!KTdw2;i|4uKV!`R>YF1<BN8GdIo1%_@dHOa6dD3}2GH2iBo)
zMFyXIE7_$krs8H|d*-(@?GH%V%9^>O+KC|vVyBl(F!7=ON*~K`_)FoAvr;3|#v?uf
zi(wpiU_1}x@^o%L-4Do|l~?WnS{^Pjke})NyAsFX)U^^vVTil|){lI9P}O%8q}|_3
z9cPr&0)?K-^(DXQ=~r{N0jq3IR~P&NOcaeu-39wnL+Is>*4_WfW02>*kHc0~R`z~~
zX=5RQpMjQf`M?3BmDefU>nZ=k_rl(Ou~R@W$W)EJTQw>B`Mn@DS!9J5%6YKI-CE45
zH+vb!&1WwCzKTJ_F{S6DLS*mH-=@LuRVHprE$?JObK>Tn0Kj=rR&k$7n3|lpyYdWn
zsiGz?U(}XSFjW|w!OPCP+<)CI|Js0jxPs=ywt@(Xvqmj<F{#VHj~s0-*lsMNHpwpI
ze~C_2h2YJRizvQ%6O=&IS5N>H0A847?HGc7i{fNzxHq>s$6T~zOmEQyvKKyte+W>V
zXj6#a;Y@`TQx7D;>v}_#o$*@x`n2Cs2LgpG!20ASb6qZ!PlarRc=NQs1*;>wlv-9T
z4L(Xv($^UUh%_Q~4P93oMhDav0LyP^SXEV3VX1QvW??MhozQT#ACa5))*PI0AXu&C
z;%3mUsk3Z!eK=hU*qk43+<Ly_p>JR?;>sz&C?_gv07lsBWG5;jqP4vh!fx`AbkXq@
zA1TE@7yHt58$}DVvQ7<tOseK<FkDzsu0REq{*8Vyg6F1A$mUQ4lqf)%2nD6PTCj)O
zgU|I5okL|!4lTgvmgULh+nPO)@AnDIK(>tiFPa#bcKOeAydJHSO8(R!k$>Fw^RR<n
zk8_XTSM8tU41^HwqoOGq#`xTUeV<&!L8|{Jl1065mQE!ap#Tu0QY^PMYrJs_$R_34
z=*Zfdz77+FT&uIC`TnI*l6#<aesJ@eScV`jXEEU$0oa<A?(QO!<zN4(rM^97m~JH~
zUmrpyCe6C&lubA<2NV?03k7$U{LS<F;qtjWi37FX(26?`VtaLaD0=nA!`J89G7{DR
zIA2Ai6eW`X;~m(_+dcB|M~xqE)k9nW{C-N~WlwzL2lR*d3|}tf+50MqB(rU%A2%X{
zNC>x<3<mzKOMu?8mKzE?pD5GV9U&kW4@h8f4xCM&o%{NefHC#_Zk;RS_{8Rf;PlXZ
zkwxcze?Qo|UOlK9&9%1#0wLNnkk6$Nn~3J$8ga7oQmmH?8`oV<TK!gBi28f$FF;Cq
zm-GR#2n0Z~?d(*wwHbku%@gAm?9|E1${%jK@=a7=IkOX$HfzssjESScxZj>v>IA~q
z7x(l$(9yhr&Q*aGGzKVijZ{sznw$54t`j1YPNQ5E_VJoi$3F{+SYB-$zvXqE+S*!J
z*jgZeS#5Vj+gyOPx)B@-q=pg_X3Ap^Cj8u#%x*vMHk?N6mddikHs`Qh7ESWW@jMTt
zibP7~GSK(`NOhxIXQoSrb;N7W*kB@X@Eg~vR*i%1Zg4UXCgFE-R2230N5<xJ4MGo1
zOe8+pRBxAyM<e2vLe4HIXmH(H57zx=wv(GJhx$83W9yp;Sgw24=?1@YRn`YmpC;Ma
zg_znST_3Q17mAk;9!=zyCb#aaKg?cim5#aq>|kxh{)k`nY)sO{tyoS_wgsf&t!Wrs
z9E*s@At^0Qge&ZhnnEh!4k{5xtP7YNhQB9=3GJ8Om1i8rc1<Ne_X>t9BOFN|*VET$
zLAke?pmmb>>M@%QpSO{*^*IXlkRYxTR9<U(8p(5Lg)D16AdggO;UXD0RB6+axZE(p
zyzWvIXkT5-pB;c|FZ(Ds9GP@#7C}?0(-LZ3J?-x9o+(dcIZ;J=s(K5)svKKVvR{Ou
z)6&*bm%Z|EXfQMsXrKX^Fz_Nw;jF3Mdl`{HPykeUvELm@0frS=<*KTqfHXG-zYOCd
zjpv4qm1fEVFg!?rKB9+4M3jR7ch^}LFhHZCqJTmhF<+4z2(;NNYFxJ_ee}cu4jv>f
zpku|LSts$1Pp9VHToCL6RPn1{Sx8CkPmbii(R*WRo^W}*<-ay$F@x-q7^SAJezu+H
zb~WA@<fP25N5?!$`Wb*&wCdM^a2ilBV4r#Ody4qSast^WHR$)2P%u4+pMP@?PdChY
z5Sv<V0*(a0zPQ?j#jSchpzZ30t}MNss#|k>)hitcxOdxYVeLSnXU)V!uuwhz^xQW7
z!Zb(emfn^BwZ>S$J3I2S6~vEO-pIldfID+%r**Q;6Ww~j2|=&x+?(5UB-4u4@uGqO
z<aNEBeFZsrGP00LoAzTHBh#xix!=2jtbk#tA*;F6(K|h*ezpkuY}%9w#O{P=pRNun
zPXA3R1y7)pE)S?r{IxIq%8){vxk$W+)YA8kO0xk@$4sE&7KOpMHwK{97dbS!tP2@1
zgc$7z<hp8HER>|5q>{x_AmC;_$9>Ygg3x>W>%)tKX3$1FTwP;X%ViREQcm~)ARMjT
zYN;t?YWc<ujUC1sS!7?vjJ@y?*xY2V>hlatnglgWmcjfG3pkdSl4+^TxD)n~C;TIs
z3)+ATLMSDm*mRfL|DxD%o=U43QBw<dBnw^z8yi1GRJko83_j|Ee-oQm*{(w!V28Y2
zf1<$wioHOpaeZv|NKzKUY0#_|@K{Dkh*eU=4_Q$r@i}hm*xy7~IJpvm)|cxHgaR|n
zUl{AV@s)V42w9robc`FNci~x7@tJr>)){v4nK*L5gP;5c65YQjH>uPJ61UMf5kBC(
zv-}H#R097~j^$M5e?h7EPnDK&MMXs($K}mo6DXT4$?r~t?Kd{@q0*gM^q)AS*$gy~
zCP2jmC5)B6xW61N);&$oUW=-$JNArQflAmTEG%~0KRgJ)Cm<Eg|Eb0SR84+;^b01S
z%qyhSPQoCkRf~!*&^$V$4H%u|<owJevxA=x_yF|&8E6zXr_u29@d3>S5FwM3lglOY
zDZG5yApoEhDe!SCfrbV#Pcg7RV9cF>uD#BJlNZd52w;8Vu6n_Z9B%Biuk5*7%y1p9
z2nht)U*mUJ4<<u`eyZ|5yL?*n-yu59|4|3+v-ztI3ScyO(^Uq!0kRh%-@HnEerrA_
zNj_n-MHo!U%&auHKx>i)aRhFuAwDkt&dgcv>m?BFyn6K`%Rq^>6i7C3dz8BE?9gNW
zYk87S=-HXmc_rw-D0VNjxnTk9(|WCazzZ>932f?2(r=zNT%a4A8+-8p1v_7(I1ase
zW$)&#0@*XCn23m@SWZdhH{^PHKsV8-KkhN3dtBTrB&2pg@bkuH{xt|6lsh-skP_v=
zMs?NTKq|1UE((AH2DPo-k*Gv`i{o?8hnH|b(%aX^NJG=PF`6eSFF!Oiv@?_Hl@c0C
zg4A{!ph~!FtN0u*PruIagVzAnOTbt?#^>s2&x8hi-Dqyg%FT9mbS%`lP%@V(1N_xO
zD8jnC9}Q*$na8;OyYX_PonwYrz~>Az$EEpK7)v<%LkIrXpm77#F`V6?vXt8^Q;Fbr
zTY@30_&7kWEh972@6m4}+B5R731=HnLuORx5~O{al9lD%z0@G*V0+brizq7EZKtYy
z)55^OQB<^RY7rpJzzu?K1j<T(ynwA@@GZTYAkqMPajq)8GmPhB_tLVyktMVyy)3O|
zqP1L%`TWkETDvPJ>P0(UU0ra501VyG&>&v2e>mVJdS2^TMp8An5`r=wHMNnxJ}8#J
zuOQ0$B07n#AYLBE1LCq^4AL^LR-`b2f`qUHX)W~o@Abxp^`$=M6Z$-0TDY`G(3zP5
zv6yvge2-ud!7BW_D5ZNZE@pJh7l7k@RqdME=4yNN-Yky>aP9q(qg?KO>5}-H6eThx
z@;{R8bBeJ6{T&%&@ml8z{0#7QZjKPZTrLXLYYY6s!hne2?ukv40g6ZPKWC*M-ckAA
zU8g8~VYB~)npd-Ka5z8~_b%y@!IHayK#=$quP(+f^~H$pN;h~)bF;Jk&gi&8Q+tpH
zIw0wFM*SvqJ+sz7HVwS-=?-|17Uu?#Y2Y8y+6w9uy93Dp2ALO<2O3;_^z?l6n?UYz
zgTwsNVstZ>^QJmg$DbGtKSE<=)sZ^#Y-XZDKqpGddXoNhFx5hYM|VDrqoyVSQU~g@
zO-t5hX+T7ahJgV*W-NB$UpM}tjiOY|23`0c6#aH<frcMw*PW~`T_fJo(iUgOzfZP_
zfmlLLF3`YzAQ+t=0$ZX}0~K!|J7#QZYG-AwQTN^v>IxI_4f_R$02r=N26Ac8gXXff
z?pDoHR#K|PdZf&I14yD05gQpnlW%<a4G(3*1Ji;0a^{CzJnznAX_Qmv$^k&?IIr$v
zxZnO0MBtDMB36a|XS!jtPG8Hl>p{o=<Y<4JE{;lI`-?=fq0!$(_pS-lkBX|G)Oxt;
zUH>yS{Ia|q&kOn$cE`s+rXr8^j}ZwAo5<z<XSKHGyP&@xNgqe-%0v$+hhT<-6$Ri9
zmOtu3AnyM~JT7O!9U1R$T60WBatu<q6Mny`zy(ZAf3j=wBY!)dJR_gYGQ(%Hy+3dW
zWUJD}<%1-3Ad&}ZQ$YI$?_}w8Z{ZSXCE&Ai{2EDwNHCMoUQ5c!71$FOf&w}yqGo;p
zz_C|c_7z!G#{TeeF~46xS%ha4Pn|8%UZ(<RDgg5+bg%R!WXSg{S+`#Vg}DCVM}q2M
zf=2SkF-)JAee3rFLPy#D8}IP%EZE;<E}*G_5&gIJ{{QCJ#(Q83tK1&PCBQrW=KfhW
z;`dD@aerkK_v3`L^?)W$&>OuwsJJ}F9RpO7zyE)L;B`!@!NJ-Jul4XM7zrkAX2I3A
z0B&gi*6i#+$KBsAi@E#j07gL7A8LRB4ebY2PPYBqP-IdthGt{%H+n-?wQECw-fbE8
zhZRRJQU<pMEocSuBV9QV5jX1o=yw4|H6Rr$F_=OV?znV>R;sE**tzF)b+s|D{r)Dx
zznhBH|9=c@_&<(weqYr8E132tb$jyq<}VA>wncwMK_3F$%k0rv3}1_DZ5{Z)W$LjQ
zw;=2v{621Pg}_!k1h~%0viDB54NM&zjiHkpl`U=X%UP3!_TOuLAmv(lO{U%!ygdl(
z6||zw*V;OQFG1O!no{9QHJ-B^2Y^BU`uX~-W{BVuz3g35{FDU_$M*-!ELCAKG$TLC
zUtIq}L=XTue!o<M4|q6GK<N4Q$xPnbX9`7TuxD_Wg+~Aa8-cz_Mqy5<s<JgdCFCM?
z<!lLS6Z1)DXRqx#^XO<vzNdx|;)#a!<a$;+K*77;#?ZU-P}nK)!K<ZFgSdRkAbB~;
zI@np05>X=Y#S%I`11jyre-I(<vB$hl4wy$XBR4K}{Q`aWX)F6~G00A3Ju!L|l^`oK
z@rbY;c9MeiuN=vx@W|4_=P_hOlFx`qyZ><9C_`4PL(I-7QIseDl;rlbD<_BSX$g`>
z^r*zUES-Mb_|2XX&D@S|O*0c0XsfG`8q)FIMeexLPv?2>H_TJh0mCM9Ov*qCX@l<h
z1#RaD{V<+=rlTC;ePvDDa*Oh$+)w3^H6r)2=$Y)_M)xZt;XfZy1tam6efY7h&1I=h
zKVBywv=HpB=_V&<kTF34UC79?^3JATF|sWc@Z<RNI@xR#>ta&fH1!a<`+Dtxy-kum
z?u?;W{L%Y_<z=Ov3dP_P4pyfxI?UXwGl2Y|$3Al7aYmOg>m&cWRO6bCvACbpjo>(E
zt17M^E$AW)7zwGzH3Lj69p^{zg`U2}N@vQOlB>re3XMt6$YP%9%ZX_Ra^$?W5zIf_
z-_JrTkx73999jhK=EDlyoTUM8N&Y|pP~fC!pIDEM{n#0TL`PKTCU1Ys;}a?YB#j{p
z(c2kmnkLzaxZ_j(%_6c2#Z@JW!LI@50etmm8>08zr`k>&K)C|5$UnH3@%QwK5v0-X
zW$73M%ne#H{#f*fhw^vMPE-lQeNDC1RgU~Fg8+e#Hpj6Ou@w+=C-+VfFK&~+os3jb
z38;5Hk+g7iw6)c+>O4t)0JwgT-T;qp%qnK}tJ;TWEpGeWbTe2H=H9Ny8A%dkh=>11
z;)CCQ_mAv6vMujo<ReNjCb56a9X7YYnwaO3as`Ri3dT;4ZSlR+f<A+5`$R9}=6JfM
z9s95RI3YCuyMH6-6$EJJ-fN`)N$m?0!<8LTuI8I5t$X0k4me>R=t@VU&7DLBjo9=?
zkE0$6YtUU~PU2b$b-naBfB2t|4=5Zs#Ng%7(4v(wGsJOgJJeS@ZP<%a4(|i{&_@~*
zhzu&BZFwfw_~z=?Ib`)ySmDgQhpbdtVJQUSrv|20J|0~ykKv5~#*?4(kY36DY7zZA
zaMl=px^MPFvuw}o_jdnm9{3-SUS2%X1uO7`UmCrReo<B1G1h76?K;zg#CXDSqv!n=
z?1n7H59=77%wx{K+k6P)r>Gj?i?Po=a}k!<s*NlO`5TulN*Zw4NIlX}w5-W64n>nB
zzX}Mq{q>j?t2vRpf<Hda06PcIg`CMIw<K)CW&bHg%oVeeCB)JDB-qZdEnh`taS2RQ
zo;8zP8rm)!E_%%W%0)X)R_qV_MG=e0YE4TBs_pKs4=bq1NfBnk`~<kt9>Kw7G8wY?
zlGiGxKYyON1Ae<#m@9tjX#SOygC^x+S>U4kJmA6e2iynypn&Q-ZV!hqxC$p7kGL*)
z($Aq#C1xtF^QR_R5ob?gD^krT?`8UQ^%xMZ*EY{rB8qBfc>07jCXK!%;*sx#^lX|}
z78`L2b!kDS?T)O-JqVl<xBxR%_&?cSBol!B#ZL65IqNt~^=9Z0;5B2>gz-qy{t<IN
z7NS+Nc@bs)3Zi)s8L2jtLEB+<Udav=Bj{*x?bsLBr-t(eO9s1gqRtS_wgtb~QcDF#
zvj|}Y37${Jk0=BsHo{*5f>%S`ytdP^e{dG--OkPDOPEjhmg{%@<DMq-8W$-m^x|7{
zpYHmlZ4Q=55$$LxbdHXn7FvGxiwQbpgCqZrWhlIV;TV4}a0H1D%6|b9ja~jvqnJNF
z2KVFtCg%D7Uk#qXe>^J1#AV<f=g<XGGg5-UX-?{gHE4-60rl^R*xoiLWT|5hUVB*X
z;V=ehv7u$ov4VdMauh#a(;|1S1YVUqhxkk|1X087Mg9xLNZX($Swe~WbC*iT<8=D<
z#FM-&Hkw!)eoo?fV*f+#;jw$0QwoZ!L8DZ|$b?w!KT9=in&1+cOYD1Huw;?H14}fE
zd`SjBePAA1%4Be)Q&iY+JA;tlNmet{M87j6tZ*+<_rl_oeg-+FB4Ol6CeE{;pmeEi
zQ(9dKO~4`)2T#avwTBH!FLepwjVT8I&*(cz;GSY{JUO-H>!G8oPE-$ca^A6ZDT}_?
zOtPh<0;3$Wxfcqr1}btZ<LbzOotRxrg%+?Pj8b(C*_*$SsKyY|p&8i|^}sHO8OY4W
z^bCv`mCNSg)j6&<v?gCX#uPTx=}M75`!dFg4{p={_iZk-3yZfF|D15Wk?#wa2TI?+
zP*zAUm<9LR>3C396H2Fuw)F~zO!}bTTt#t&*=ke4C}xz$Qw7UlZ7(Eog#hW%Qiecv
z$<B1>M?`fRS;FoWxyw%&UaUVq)BCxGnoSSag`Bp6j|NfclILp}cm~{-3GrI1-A{?7
zIU9kCWCE1uyWV`4orP<*{La0Zr}q0qz|Hkt-*9v9TPUR`oZr>nW0vW1hPBeMe_D)z
z_?P>eMx@${_jm%`75&Djw`?pVo2HOHhP02VJi<msVzz64E8H>h8TO-{sq_G^cV$oe
z2e&hPQA{AQoyv7cuAT=i+WhrUd4#8&kYShKRAz!U?~_ZIY<E_C`<R(5fs=ChqZd*2
z$f<5o=uhALpv3gr9=85vkom|pDklYBGozC(rz${mSfibpfpPx0pgNt{2GIm)Y4c^~
zbAo52eYw}96RSLI>m;XPYhBUqbx6U1sIS!j2v}&Y`+t<B8>rnMdU@=F?|F>`EQvPI
zSLy_QsoM)t>NUrf>B&lQQD^5ft*fk4Ik^H_F#R8TMbMN_z!w$_&?euZCfXc@IP|_?
zT}|EUt!|vvgG@o3iN$^@r1P0RiOYmG2fnA<!s@a^z+^H#SI6uvEM>Y3SlQ_@ZRdQy
zhj-_#mKgl?OnRlSSgd<qc$zm|F}A&mn(B+4!61o4m6mbT@k6#Y)z?ERt3lX5$I(jS
zM4ax8qD8*RbQAyfd2)_#$>B;!BqMBx=p|Kl54ZLHCshK@ok1_B2`QzqCVTe;l@%0e
zq`LwkDDUB>)kBS(@>?AH7r@r8<O|{pGd;G;OdIzop5+Q6CD%b_WBlWGYtsPVnq%z7
z%lw>ld1M7;g`+Q}tlZ}rB>b@2%`aR|?+;@|K%GzGZ;q?!(;7A{HPWVU{gFvcyYkQb
zCij+`j_z!xG_iOO-|NMdrQ{UG1%AR}dG!NrDYuRk|8C3b5jJr`XtpHatpQACQw`qO
z>aL-4VA|0iSoXD8BDO7r^fI3JL(R4qWf{zHHMvm}CAs3f$p!B|HPN#;X=RE6UW$rL
zwmp-zfm+dt=d?8YF}n?T9ApZ3)2QRGCsd3BvAbr8<zK!(@ZpAUz{2n;AO2LDaS;F!
zNU^;?H>v(~-+=#$g8c(})~#W)Q~4FSp3Oa$1BMG3`kJ$jPP(*~87hy<gC{L@(!}+4
zgf`GNg`Eax0$~_e9o!xExDR$5WJX=L)j7d`m(+8sHemA6i<LwI-a|s8nRI!LS0anw
z6K5KwUyKae?&*vt?^GSvi#OCkG`P~O%^2{5<~S=MQRjyRigfJ2TT>utMD3;kDOi32
zD5tCoOP_Ll_c`8fxh!8U&+^XAtuYKI%JV+>Qjn9Lc)8nFFQ}#({&><k=qS2QtcV*{
z8!jyvNaBGrQ5$f%WDU_BKgPv6+{g=GC6OiXZt4zF=Q>d`O>bkMqw;u<$0nN}@V&O3
z)E@p)K|9)V%1F7e(9KYZ?M9nZM$ktH9UBAqOSV2BXT0pJs249UUJbtBU|c*oBW9h!
z8|ONTt?kaac>P>+CC>v#2zZLjfEziHH!rG5$nKxk0uMsH=B&QHpRc$zS`gOMaVM5w
z{P6hP8+y;boqU1uQMhtX&0(io)H}VYL*OV`&e8UmvB5oe<_W~mT-74~jA!#r&*%8h
z6Fb9`IKYJWg}MS&oTs748zoV;A0K+>WPqGM=+im;j1thp9_{odj}_?Q+th-Y{ZQDP
zU)+$g#hVR)$%@|}<kB<sIuJ=BpHUwJ_0Ra&#I)wpHTJrkl+ANbNw5Wi1qZfH=tOC-
zriT7ZYp$4-Eq_?88$B?qt*u*qt}D0xZAer7aoQqed5Qh1^ScmME8<857Vw)U)|sFy
zOd8L~=a2YWXR`zRBByGXv6j<RA7S%Vm%x97y=YoK+$o7dciOfc7qw8g0$#z`mGV}L
zi|qF&6)npF7gwvZ{%9l4y=T!k)ZOTYTLy<QHfrGY<F{dpm_{~W+n5Gf3^4hfuC$6+
zqBOCZ16wP~C<@;Lo&=mL&dR(~SgqRd51w9LXDMd*vdpFGYd#`edj+k|{G2Dw@NJc=
zS`Tn`38{7s<suPjO*3=={ueno&^E_{uFZwvjLG0R=(WX)W7{jGCO-QlP9gQF_69zE
z?Y-W;p9d}pRraf1mJQ*WS>51NPNaLIe(&|r91%rrs0+)CPO>)Y1r6(HI;4u<A35)i
zJ@&bsZD5|BG;MmG9i!%yTb_M(`k`xo5Nvr8pI%l!Sm%0|laQWjZHBsj?=7IdN^Qtr
z46-x!xT<MiDg+DguK84lVaM7}bjw}BSyla@Mt70GiK`KPP>{D<Kfsu9k1;1I>HN)W
z=)E^F?@7e8`olHkd{7%Iw&^;T<&`=?FM?fbVLhj7deNaNCU2}5lydpQ;J3dViWJ3N
za3u7vWUpNb-jKyA?nw+O)BNapn*a5Bhj#B@`Mj+;xKi7j3J!+`ms3)Py&qu%^L764
zmDk2X$Y(27z~I}248ur-Oy<Wk8S~mVuy&MmmW!WcnU3gXP^$|ItPj`728TxBo`VD`
zq!gItu5GEwX&1M}%-0=y8W>C&y>G0pU7r-KAL%=@r%k)DGn)C!Js115`E0;7IrNby
zjwvuq>5a=mqzF&~etB<S1U)2$8_LJ2zINohw?j6!eYUttQYu&fo`IL^RBrX)M+UF+
z<A(d(2Z^ZBwB=3YiuEm<cg!y<bJ=EpEsfWbv_k}qL2Q7847J_)F;shkc4a*IUGH@A
zpuNF{uII`NLbWx0K2|+5m<}KM@QI#v?%Fta|DLT&7)^%^mCIGg+7Fz@92GU6WAs-y
zkP`QRQ|fHI%~S2^!Y7Qg2aeYk$Y&O%Bti<>HDF{*Vlrmc@1Lv2t2fYLh*q08ZSj;3
z8k1KgefwHNTAP$@<g}?NBqN^5%bGD4`Isg<N7`j9l$KnU5_`n}XQFylo#)>6D?Q_(
z2y{h?_vr|L&)2pFmX7H!yI;(P@DCZjFPHnhW$C;N`|KVyV&MddN7l|pK5nQc-d%S6
z`l+$vzP8o0UYAA_TYG!nqo3#0gMN$D&a@`-ho2kp(OJ-p$f^r|PVIr$*Os{8k}G^{
zm%F_{pyxa`7*tKxYlV*1KA7$%YSomWkWnj+qX-Y|e@E@{(%0HKa6bj4pS+bHhYv73
zC_QylhuF6T-3qm91AS?8Xz_S52%XPe;Ia8D5*YLP&AA1%uwW&1)x2SiA6<}OKlsf#
zd!@wb2sPzxUNbMSRhGmUMkPb<5e<DkEfBdpSPiU8QEYUqWecE>P-f>rjWeChCT$$d
z1kWvC=pH?mAzW`JJ*Yv2y3>#@`{|(a)1xGV!Y@<r83?gdlw}E=-zOFc7ioV@hN^K8
zeT&e@UW=YOKC{ClrP!L_=cqOO;>N0A#OwQe4<0^}@yh2O>Vv%A;1JvQ?Gm#qaEc7{
z&DTJ2omblzU_BUl{^?i?vH~m6v&c<KOEJ-3V>1_<DhRzK#MR?8-kp=77*n|ecX$JW
z_me$o(O;$OXBvVUEM>M-1ahOf#=_nq@hIhA6B<-jK&V={9k-;Sc31VWe)?iMALsTg
z<0X=c(`W8%#4nwO@%))Yu44JzT-nbZbp=QlMRz50w?CQlc}_Xp$DW~BSh^J=oW8g0
z`l0yKMV9Q1MD2q!E6zYW0%rB#S@o}pU>;W35RdmkNFrvpzTt08-zjp8LLYSOIMh}e
zyQl5cKfTOvgHK9vwal{K=kA}NCAhkJ5m6m>;=!-rfi933h2vTcDa7a*>xE;>@(+bc
z(4B%|1YXHa((7t+Oz!fZF9i}IK+y!d622c-;o37wvc8l|6E7vWj9$E<uE-yd5&EAl
z$ZOXw$gUNLq!dSMKdw-Y?`kjCIUakq>Zy*eFsW>6CjT*i+q8f#B(O6#oAGDeya^Hr
z2izLVPV5c1#m<?ib3fB<I!kliqgic$NEt^pcEVd=jCrnheeiwgk1H!!W-ha3?2=`2
zP3)ZOz@4<~ezeERcq9^0`QWBmo*O0>33cJ?@A<@2{->8;8K7x`K{@9;n4l3>x1M9R
z(I!r$b8?j!1&*_&&u1WysI>2uMdoKx%wkKpL*UPMY$If7ZEGM3P7(0t;nOff;5qC^
z=UMMeps1pt8k%T(aYFp`^YW)vXoR=#yt^M=<LQcm1Xg9;DP(y|>tG*B2|8C*SSbd|
zZu~=L9;&aIuG+q5j$LIv(PjVCmeA7m(v4D0&6+8n=!kFCVXd7&+txr=&a~$&UTDf_
zSmO9{v~#s|iq03MD*f|a`+glQUb#~g4%EmqPE6a1)Zg283N!W5J|4XCq%g{*qX3-t
zAX~6?fplyWd$2mf`@30DTy#9+Xgd3I3Km@@q_1zw`h76YkpiX-r}65XjE2U~$BFQz
z1vsr6uj3@)?!k0}Z2OZh+SOIme7S~h^hSeR)zuG8TT_sfa#>ZW{if`lA3p<f0i@m&
zNxA_pmj?J2@VEw#P-WU$dhBYH-%G#Vw~64lFlL!Z^z!NSng$OtblhD{>u9!6Ru<=X
zYxCJB$qm56RGgk<p#$#nYwdBg7LLogt8`}V>4HI~>q$Sq2mt}_=HFX6|Boq|Y`{M{
zI$sFvRRKlh#=ysXitj@4@ln6?=y4>@htD>RAWxsHMtv<~qQAp&p{VNRx`1DV9r>;Z
z!DV?o$V3q@1m~9VzOGIiTk{uDMUYU(L1?6>T4D^GOzg32sCU5I^PKNTI`pxL<bzI)
z@xy@k>_}eZ`++??&iDEPOPLJic&|)XbCjq8`AstkY8Q?{CJMve#LUAGC>^~TGnrKu
z?f@59%9w_-lKS=ys1&F+61y4^r`4tGgO?WQVLuc;XBrpO-GQ7R#@~^PhtTBqDM|!^
zM1NCIm|fB%An!|5@o^JbU-7e-1Zd`ghzhklY|#=(=3$G_OY%pmD|<5~z5~{JuXg}9
z6Fl7DJBVur`Dr=ZPtTF0IRzP>cNg<oWVU`5tUni*8w~SYY@N%>GWo*m7;C#`^A_ge
z_Qn!rMq!L~r2Jjh6Gr2y5luPm5H&5D>{H4>a%!l-sy&DehZe|Vc_M4rNty>Be!x|n
z%A=<toU(U-;_(Nr{NS_wrfm#QGOrGIWF$Ws0u+RR)U%+P@?zqlG&VApJ0yF$jX$}W
zJ3WJoF_)O&xN@lg2}{#l2dcK~^mtRe(}c#<*HIgN-mx1O?d6y>iC#t(0(|um<kW=)
zM(gX1U;E7br^Z{Gb+#s}&lNhIAh1#&y`bStd!K<X5$J<ke%!!ZzN*2h3uNn|G@8%V
zPjFInUlTcQu4JHo5<3Wb;nG{=PyZm&lMuzDb?)^FziJNRZDZQrT?em807^nYAW<KT
zSso~V&usUu-(hcdw2&2vo}1uuihz(+Qyh91wL73cm$Bz+<+#8RMD{h2Xdd5ybo5bV
zdMvcvpA%TPud-Mf@Nx<^snr^0ZFsALnuTS`P18K$+64~M#m(j`kb+M*1_1CfI5z6t
ztjQDml@!M8h#Pwb%iZWu<LB#o#!eW;5+_u(j^K@hL)18pyuwp0z8c2~)xFNk9HwWp
zX=q?m+a!O4sYk<hf3n8^s;N%e5-WfMe3c}I+8dCA7vv?)ux}0LE_~>`!=a^Vvie9r
zqpk|FzE=LpMcek9dooSxL6)PIrz;&bQ{qEs-phd;5Fof$isjYn&kw|FpiPv{w&sVq
zSN6o$c@^;3>UFa@iegn-`Dtw6WVDJ-&#<dG*f^09(lZ>sL?2dETx2(u1?#Ea$fCB$
z<>hiWlJ&l?Qc%lMgQJ~eZ#3NU+nkI5y5^<8!lfdHtGyQVyZ&hU16c%-hg-(~t?)qV
z@hv2_Xy-;{+U%hV@m#)`MOBJ{x$WWx<A_RxKT=+ud&<zRdIdzx3@6$~`reEHvOix#
zK}yxL;8+m-<idre)fz`9&q2J_`M|PGds-CnnFukusb1J8E}@dn#0G!%VS$<0=NK*G
ztYnfo{-_yQgXdF?GkkpYBhA%`H3^-dK15qNx*t=X&&32gZ=(Tuo2ljCe2k9)F0Q=x
z;ntJBq?V_`ZKb7=3cNvuV=-KZSx;!H+^nAm)DJw^^cPa37{q$(9F$Y|i)nQ(^|}-#
zCdkoW6cd=|3iFRPJJ?0euHhp*D*=n(yHqMF>0;*yOtgB<BN&Xw+0MgIvI6ff3|`<M
z1pr=aGuZ{SZL6^dDk|Y%2Q7QQ=63S+DT}=ji#hb|aE4Rk7JM(_t*DRj%Ing;1Q4Qn
zZtG}3)$=dZy5l|j(;`9od^HkZ`k8y@cg3RoKPnbk?EAh_hj%IPb-yv+nP{8d_S0dc
zs~k<!UXL!fC#+=_Ji<CEmIT@LZerhE>mioPqv-uGPob$I!AMRLoS3JRjsY0cpUXhB
z!DG19&v>W@uYG_i4umzrkiDKGn@o*NnYBfJKn*iX!@XR%>t`Xrvf>67K<e(fCn0@+
z9X;DkZQG^TEHlFMK(q90P1RuWe6|u>g&}s=!%F0nE{rS)Tk&+TEbn0H4)16e1ijpR
zg<Y(>WxaV2EWn`tmHH~%LCB?|7K&G0_=@sP)K3*4@(Y5`d|M8CA};4T;JdJ_b^d}$
z(`23JRBoVj-9>keq-hzpvcqn_pAlK^pAYtY3Ie&7kVFw$cP>0q3BZ~%modXQqNn08
zc%-z_1bvcg@=%zsabiH~xwxpTw5V+NRySp(T~AI($r1-91eelw|Dn-~l%U|f&AgNX
zSSyoTuIU=4@FNvv2%vKXHqa>U`hyu^@{0-#Tn&#!vmkHIgA-ax{DDFGfF2*O^yMKc
z0tpS+gE}DiYAOnb>*Gpff>?9!7Ke{|U%{}!B`j0$V_lw2ro;xt)d@>&f<mNVkZ@1!
z;diq!mXo&xQ|3#Ht(W!2wg#VPsmnq2LOQGj>_Y~hcXU3-6&z?SjcR}(+S1~J@n}se
zUDecX<_h4tD^9XF9urza+dw=B*K5<fg`eqaW3O&YY;L>}7lHm9Sy$$rwVnL_PPpt=
z<0GF(x}R9?Oc=EpE{(<%eq(HVHLe~FlgkgV;yt+$fn_kf>>{j~I0JdSYt+__q=L2d
zc5?Ep=d8EMz8TaU)-NvJe(N&cUc@TXGnDFKVAs-1<mNrfuPr+vAU$<*S!>6*&RHr$
z8ebLEMnl99VLWt{JQ714*1P+9pfCmUQLAp>2@%S{ra|TQn->K$%-|Y$4llZLE@n^h
z#k1JK4W8Dm-{}b$bp&%pHO?-r%yz$_daKs$%_mSThb(VDHHY>N_U>%KHavo(D&f|I
zwF7--GN*GR%5QiJzk_hNDG^QP{8q(ts1=wsX|19nM6fkj?QInXEo}Jb>nRF#UhJOA
zyi0mdiq=r;e6dlws`#ywkYR}iz8(s;j-x205E>aOvhAB5fWpQ-FrrT_;t4vTVsaN5
z2$GnOQgEs6v>M}-TVt_G*Ms{6G3^8h)atFSHy-BmjLA({$NDt*o6BkY8$Bjl?)=OF
z_86NL(jk@d!!Y8Rs*{y2-$7yLonoS}F}9=>V~I4nL1m2J&|`W(l0F|FZ+k-w%!LVc
z_e@I!gu9`mVX9sCpwJoq{=O-AE|k2?pMLY)f0V7v_?bY#6$)r)#MrXv%{L&~Y3rT3
z%zPS(McmP-Ia7&@GUN*aj4n<Z<CSIVkkeA__H82Fmry|krX_Glf-=qpNK#a$_jxe0
zHoi>5^c>%uLYG8|@7X94C(N9)9OSF7%z$<wbY-O>02Hhw{ZNAV8WPZj^Rej%D1u*m
zpo$UegES4S)QLjk>w$)A39E=sfTJ{sar^PKb;^IKPSt0H3`FgT?q-kaVppe&g6(p9
zQ%eMyWn;5b;J{<R222X;ZeLK?tgnLjf&fByAabb!oc$R*kMYFY4lXEnSl{w_Dll;q
zaOV<z8k%pOfE$V=^`-hORm_)>FF6kEwd^)l8?^2~>r*Uz-dtIV)1C##KP1$ja!!l8
z%sevywf4b8afpQ5H!7o8?QglXT?LlW;Rnm=Ahl4iIFIK?0hhI`RhM;pBw`wrv`==l
zml~zB3Kl`8$XD+)`@QuCSt}Ej2~wx)!JQxzhLnWXmX~6C>HM|r3=C4vkHvo0_A1Mm
z50;**$kyX^YP<)`Uj;>KCaXJ?=YRq!9Bsd?rKN7=JXY5nHw+RLYPI7==ZCcabDsf{
z11l{eX^w`vEq|Oi?rEoK5iPsjCRP}cj13?t;XY0rx7lCEZpsusVKC{?!aBY54Q<|R
z5f5VAlJoOR8ttTe62t2VE>2u4;)G>ER!G%1Jr@cp6GgodYOo6l%qHo#m>YYw-$Vlg
zJ{OQ1f>WwhOHf(I{a2yPG*5Ymy`UhcM>Y^UuhWT88X1I|x?i5TV{qU=f;BuJdjz`?
zc_9}_W%YJJUbKHyI-(~8MetxZw~XYhL5*RF)$S*kFT?7>vFp}p*|jioSa|n}Uss<(
zRO2zUHBVF^v3~E0%69dVXAn;7TD-gCy<{x&^<IW18qAN^msd2wFdNxOa(RNNBFD?f
zpQ8yA(ww~IOYFzome>=bo~(XgJ~hJ2&C}5_BRe!OPrAV|__RXtg#|lIxz{glWYVRk
z%k$r=Y4=0svBSzf={GulYA<`N(EsKQed=jeW4c;o)V;`DTB)Uoa5D<C?|>H|<`Y-f
zf*TH$whwSqnJ=^)_uAn|VTUc#l5cEuMTD;@+2f1y&}))e3G#eg^tIpV%`mhUu(lMt
zX^NZN<>~#6jP52h+(4j^@Es!X2rhB210zNNqta35Rc+6Mc_%VG)~|yco)8^#zmSj0
zI$-##fM-=)@7bWPE0^=qO8Rhy0Poz8gWszSkqARTcJxJD6r=FFqkiNf*<BrTvT(jR
zl8vCTivCq_3XEtoo#rA+qtc{48F{IqKwCx_gf8r15!ZBQ;d%ph_jnO;2It9!Ny3im
zr9n_>^h2*>$jt5K34y9sC&UKsbn95T|9cAoLWl_OsL&IyVd`X190BJJs5#qdr*``Z
zQi*C|vO04+iZ)p{|2P1@HjH;#)3AHD8$Ym8D{FsD?}BSB)}!Su?=Dm_@d{5*!!OH-
z<!+S1D;I$?IEfU)0e2ky)w9X@Sf2|2P##Ag_9w-Fp;?iGnYmn`9*~PlqNry64D0T`
z<ulfioZFsSFGMb)+daek>6>x-`$Bmjw-6+P-)C}r81OafXdgD^NfU=;a2uD|Z0M{w
zNk?7D-$Ikp$A0+TVEn#tM;P6O@u0Grm02NuUpI4!&G*vxkEV5-1~TYK(^jF4;w)52
zKOLPMKRXGs75M~XRF(m)XsuyImmVonkFu?G*zRTpkDvzkssBnO7Sc{!*xtOWsMU?c
zew$6f;(q&Bv&=jugnN3psOE9E?dJ!|S3#+R<m>@uo{v)z8(i<>IZjT78U4#t%aLrc
zn7Fh|(6|_PxbKI;XZ{27PHL0E!bIWLvC7K#7AgcE<{~R6Lc0)+(en4R?-o7aA7p+o
z_O-eRnGrtUAbPI-IRTSTK_aQ)Rs{*`m)$e*4Exl?4-5bIs^cUcbOU${iLr4@P)M{P
z;{u*|9j7D4coOjtj%14e{Ttr6$>zYGdpxl&=H7z1cS_xRera(7cG;%q&rPSbKEtXs
zbkuYw0#SkQr5<3@-RveCc6{?j{*o0XHFYR{!`W|dlRkS0P%Um>*9^dhBmjjQ0z(6L
zYdT@?k{q!yCd0}>V<mNMvM+@1xIkYJlunNQpJGivT{yjOFYKL8VIfJ9?QD~kWoEz1
z%g8b>b?Yiijvsy4Y?(t#T3i%M1+$$9WQOQ@MqwWmwZr9+O;$L9Yg8P*kr7-j_<-Dg
zx}7PXNl5ot5FGczSKiNw^*b+mdek1EPTC*EpVS6c=evjcW`v{<72&?EbwaV8RZ)v@
z?Z~F5Q#H-ESQ6-Hb^9oBqli8g0=3%WZ+u~zo}o9|&|evgOuCaGar!auXe7A`$uB$z
z(dRTeL<V_nl~cWaS`|!;(~P}lZD_4NxZC=ZmsqIrW4cjzf(U!uAf9Q{s{#!)LL1E-
za<K1G$IUKnHF6QiH99tez+48IUyax69Bmxz;-)oiAdnp~8&gmaRS{iq+xlUo{78-X
z&Tj4DOj@eDVw$hwZF~ug8_t%+ZPDXzc7C)x)O<6%I5MueNhm5LqFj_Zn3jq>D8eH>
z1rhY0K=0c8x~&+wV$YXgu-w-JkE~{Ow)Yitj-5#myqak>pon;;o(mg5UE$%qpsg4R
z3y&OO-ANwl)X>llp(O3phxL5V6M7;vn3vc&FLQii*mKi{4T6X1z8Ip5;4bonV?^ZB
zTvKlKu3)<Z?3tp*s9s-Tm&TSsgmNwFS;C0`#=QgA@`jA&A{q|7u%jV0OsFur>f_b^
zlG}nM$lg2O)!%zrB7A7W7#Sf59elcMq1W@H4V^Kndr9UT$PT9El#soWh_W`upQ1Hg
zZK!oiP*UlPjZO>+4SSewx%LV&UGHdn1XGn#y&8#Vt5cynZW5jP$XXUq8#qPS5gUEl
z66AE7C+v2(d*1M+d?%r~Rt7OdT9%uwHB>8@&cS0u6nZgb(6-FNyQAnv^kuZ1g2_)Z
zxCstaat~Bkqc98^$sO)q+V{++4_8`Wo!lW~<ZOml1@tQ~-(c=p@KO`fMuESL<EByA
z3u+KJpRwERX&B<%Gpz2PSrTx@CZ*W#ySpy=`sTxTMkZJn!jjsmPKQbm>CC&%MCig?
zDiPmrWaiapj!Ha+?@9#~OFPL=z0g*S-X}|1yM_L0Jr?QKWBA3!d)4_Vys_=aZk;lY
z7y}cX)J*&=baS#>?8BAc#E=p=wz&t&`k99WzU5@f2RTYXUKhUv_i4uWk&9zdF@U;m
zz#ds<;C~L`(UHl0X9}Tx31WnU+iWcvG3(z>W+~UnQFL5_`Yd5+nh&C<CnhROOPL}*
zrx{(<aTbPo9_AjgV|mIJe?Kiqv}E67xUFFHk?b@?^ci?d3a`s81h&Aef@KLOr*^lM
zo^b3NqSd(ccRNGtHW!Vqup^z^oK9Xn*~pwBQ@B8k^U-yE7^*0C4EtPybwjeV!}cgX
z;e1(0u3X%O1*A%@1~8zsMJ>Hw!li<RsGiNlxLsZA{P^Iuj#YJ~y-U<%EY-7qO^wf3
zy0#%#?a=AV++$ltmrs|M0?X5H3Zs*3TB~tEs-h#%=9O?tb9OcsmdxquB`kj#4yUQk
zNufV^zPUvR9jQ|NY>9CH;FR&Sd8o0n)Nj8_`rbT|c6EalL8jCIb{{LnY~LX5F(U9F
zO{g{rNd_P3m>7C#-`A6~VNj_v_^>pLOn)&VG-1Y~g}u@piKHs)!%%<!4kKL`6BCU$
z<lSCd#$I_MdF<sS8Y#uLE`Ou_Na;8099qjOK9<A9{zPcIvPyU{iuDlL^PR1DVtkhn
zsTaW!PH(@Br%_k>HtMSuNm~oHc*ai?lv$E~JK}r>GeegPJ}OMynU}dJTkgJT0|rv&
zZm_uL4K^NOtDKB;W<dvb><00bLHGVBwFfYCB4u?|jks7VOL+67IHf1d6e9asSIL~M
zVPi#8)&)gqSUm}Ou7eDxLEI>W2*e_IAJg*+$k*TcUmVSpqw4)%?0scam0i~^Dk_K|
z4U*Cg(nv~3hk$fRHyi0jVGBx2cXvuRNOyN`>F#C|XZbwO`+n~k<9uhFGsgLO82q{i
z?6~i>=Dg-L=ejPL6MM17wCK)G)A*hKqA9K*DNn4?`O@*CH3{09$*3-_`tolNB6NKl
zVo2(0T`^&#WlxIvC-eL-@@5(dPDO-2raSH(SmWj+e<mZ+0Q_(c9f@%7nyuKWZC-Q`
z71@mE=8G9A45o9A;y*8_8q-x(TV6rTh%9Aj3X>0cB-rR4!mgNR=?Hh9gIYX9Xa4gd
z7MAJUMYiU;FX^*u67#WycsQN09W=e5K9<3*R=#{Pg!)T@lZJ~V+b27g4;!bEw#Sbz
zE(l6IikD<Gm$zyg6BuLHeJn7w`$FH_T9bu}e4#)=c$*Y&5W6zJ9DVG7@EI44FL0WH
z>GI}!_8v3k@<;)kRr`ey0uJbLa&(mcYaAaT{&VhP#a~@Iz%>rHzwZBM9uUFcVcWm`
zm8kzWmtV<Fa_Kzs74>+EX0iVkya)oqEctU_zd(T-t(ty!zKEEBFi!F3@;C0hb#QF)
zZK0TW!`be}=)B^es|Xc}|D~edjwqv{lT&L5KK|Zjk1{c@L!p4@>TnCN4IVe8Gv6v*
z>2!B<-P+m)B4+|#r-#EWkG_8W+RzTpaslOsor#=KKR<C*6BDz|6>zE-2OIk}3{mei
z0sXZIHL}yeRbzp5bxDe|Rr8v2xj2-bo_@@<e|Mt3Iw0Rd-s!yY*XIbD5H-~g@9l}*
zd8`+j49Bh=+1S{Wv*jQ;c~`tQ6Cu`G%^p|ek(eKqx)=6#{m}>)J6c8lGP>QXN`Xbm
z;JqP|KRbPjMoI?lPrh0>eF-}w{XMW|yT5oOWOs=k)23gB+|+^e=WD-0`Y~T&pl@Dz
z5h}Ekz-JW(@elDMm-}gTl)hK*#BGSs{V)R2AWVX_yY;7V6F8`UHef6%BC@=}G)F{4
zoF_CfKJgTd#9%h7FVx=Tq^Ye$vwpDDAM32v(;v;SGsF;M@{7;~O3l``85db3(&K)g
zii*=gy$c5}uI#(<iLnG8b2|yqw&0yfRfWkS_Y2^aT&m6}BKd-5<Eu<`u~wt>A?8OB
z85zs2eLYuif|ri*oTkM<xuHp*c|!hXum7Mch*-jtMCd4?-uXsZ$OGLxY{1LN9EI2i
z-zbe~Rq=V*t4LAMczNr2XoZIG+i*4$(k-ONw$mWlGUuG?o3XNUc<AeW_ai*KFuPdL
zwf6%A_9Z#__7(yohj#b&0)MpZOv?KPeNoL>2_~k!<VH8CzV3gXCcj7%G7?$f`aKY`
zsoJ`pTlB1?I6Xbywz5h@CvCQeS5<_P4lprBmuN0bbxe%*((}^iYnDCG;=Vtn<QPx&
zgr`(lIquKM2n(lygYCaCUp;>o*GI*o*8ofem5kcw%F5U><db5GwBMKw{|1cVc+ISc
zhSbc!fagheFpD0)+WYs1$LDFqm%r<gssHsf=fN%t8uoBrD1~#&$n=d+_#HI`%ScLU
zH!fZ5ZjGgITfc(-q@*l{FL)8)ir>zBlRJFZjNC$D6#Mvi=(WV2cA-XfT1q|q1<W%6
zom4^YX!oGf;4B`f+$ZvT1>M+>^#T>z^ZhF~sg6kVF`&+PeOo<-g@uL4_#pWSPFZ#6
z0dQf)Wr@9CcjSRAe`%8l3YMEJ(#5&HR21cIX~6$$UlTl4vq$)xI_tdoih;)YHrhLQ
zD_%2x{3)}4x#>kQF#6oRT^Z{B*8PH1NtfR{IVp;&9e<OX%mwOWDlDT_UzSeJx&(U=
z7`sU;@~!IJyEER<(9k8t-p&q*%<lNuCk8>(Q(M~)mDJqIARXM=1s+kPA0;>l2?NED
zpbTW6zYY|oelfML7zRuGYt^6C?IQ^Zi;ldm_D6nRLx_7_Q{UKFTH5nVSah95`(|g5
z*!c#6^2t7UTFjRmTM@Sgs&%X2L<fgy5TTJlx#xeye8xDxAo%Gqu{}Emq+2XydwTng
zYUIhD%<M`;R}GVW6ULntA?bL9;=%=5gx|3L3^j}MB+`p~i>z?i)7Ua6MULUq-!)^7
z(Q;>2`1I*0BP>jUj10IYU%Bp7k*@a_9j!&1U_GCxM%I7V&HW&Fw~!GW&@{xtT9jj0
zkB%Nc?KG+^)kvi?O8MdogaN!}%HAyRCA0#4EPr;h?y$#!(c|(OiW<ULk6>=tnSVcq
z&7~P4gkRr^lNa-vhZ^0k4CdBT?CtFfhJa}8CJ^R7c)GxMaS<1qmj_PSCGk3+6Z}3o
zUORDr@BoTVOuPV2sx8zwo$1KR3JW*oX~a|#a^)6SUY=g$-jylE|JS-wx-Wm@@dQm9
zoJ7>t-Ywpn8xzcSVy#v$wWtJ^>L6?=hQ3;Be9yHi{JQen!7pJTcB}OoVq?^<^+4vc
z6xqRId9`wmJU9>=8X6iA6H&gmc-wV_!Z};1)ogOMBJsktCl{~R>wfR_nmla=@x<V-
z$7@FP$D=RE$iyf!D{E$kFR|GpDxS@5^Y_h-he$V5bAqRi&ceLF{JcOuODo)N&;Y~z
z=~MTo{@eBkj}gZ&O=QZEoBmpI9#}y{oNklzt_>Q0J{WMUBwJlS+iBigltMyoaCg4^
zrf6cKgGR*LFLO>ynR#ugib&={CggURT2RDvz-!MO<GwOG0gg*^b702Hy?&1QC+en-
zP{#9tW+`!v_I~!+&SI0RPN&IKEI7$oY0+^k`t$`Q%^!U&Ane@iO59{PH~H&x{Rf|*
zprADwTmd)yaQGE_!T``V6LdKIHMlny3-MvOmO~;TYhxS+CqLEe%)Y>acWP^Eff54{
zm^YPAn!g$A^joj^MD<Hlxm%4{=X&SY{pjduFVG)T3g<4;0}4@r;$kA@$Sr{we?H)6
z5*y8brC`?o&;yqJ82itOF@$zRzkj9gxBqW0bIiT&0+PTFeMNJ<17n!+wyOL>i5zcE
zVa~ojAhm;MC01ATL|+~0zfyhg^ekEziTsxqGUnpjcs_K5qp3&%p^8s2C9wI%jf?e=
zhnqYXyEynnqxA}U*G5Gbj7T(KAao#WLJuf2n!oct+_5p`HeC#T^5h97W|3gIby!m4
zqXQYmU$;+z2L61Vr@wXeKB~?OnA2#Gk&zMq^#!cTaB6LbyF|PB3VtUfaD8D~s*bAp
zy((ldwshtE{@~+B+wPgb7>j-tB_#q*lifw3d*?Mj82Fcq-MNF=p`z~;Rs`wAW)G$y
z`uerjU4uJbKzI?A-}ds`(62A3n%dIR7RTe}IYUX!#I^_BM-je$&&`LIi*iY{c&-<M
zk-;J*uJ>+Scb*%%->(Z!c>er3K}F4HrnD^}WI+C!Clf=5`vc9Bj_F+ubVUTFE22jT
zsn+2Z#i;jH?i-MLXG{@rgT?B|Bxp=Ux|biHP%Jhr+47JtsEV>OLc70JC*Nwv)8|G9
zb{K#Y-8|>EcDA<K<rW=dGz#&2<V*O!_t=3L`C>{mknK}d&CWKthZ_o=MBS9xtNEi5
z0|?=|eTtDGesot+R#jS7#R{+Q(|dY1WrX1aR7m$>7t%n?&zpcSfl;?kTUhuAh%G#y
z`uXt)6GE!DZ4aOTh*Ti)vg$QZjT=Us-H^X)u0P`ZHD?NhEE^tB<4t*iSX7|K@p~5c
zftCnXL|7O;r-_yJZasHNTLNFSs_gTC(h&{xNsTc4NHPS3*OYg7JZ4p6jE3c~1~iDd
zA<?gSpq?TCuXU-tNZ`<)*YWm_hPH!LmcU1wM#sQ%(!5p;9Cw#QpP(L{>6Y8Q(-&?z
z{E>l;gA-Rm$xd;yd}V)PavPSMtm<x~sJJxI7qdQ;#O~3Z3jX7^^uU=phR<!62dKVN
z2cmZdr_eGnc>*V6Rto<Yr{|ib4o5L8dfBoG%q%QJMn~XWwLAQB-SevK<Dz!T9SPxN
zQC@CtESq)R!xhc90?$xx_r(?DbUgQO9y8+Z^yftwN(3LC9cwol%=llB#+C>lMh~}Z
z!)v#;x02xSgLSk_M=W0ht8+#Ucd&(rjl>)|{R1tV9SOOMG-_L?+l|IIS)m=z+;1+u
zy>}UCX+JiF?>n7~`lB8g=%?l9$0sK{%?%y&W(78k1Z2=C9C;~#a5s~l)t3td?9c{>
zhMaeoDjeZxi}^0iL^g{RM_$7M+vNcPy{9kP-Ou)m((~gZk~~>n|6cvR5`}{^VaQ{9
zi9}{}-hYribXk0l0AcpGzX-Vpk`=2)#*q0Y`{ilHjbwq!N=L873SlV?*Q0P_jTw!d
zslvg_(>&HJ)xLdD<yG#TpPhv4Ro~dCrpT;)`d@=#B?{qg-;Wjn|5N%9=>}MYUjPm?
zhZzK!L!^g?7CZ;)P@mr4tlZR=i}d)Qf8t40*xKT&g6zx`#FT!g3+y0goa|vY4GetN
zoN{D+7U_Pz2Z1%UO^;A8Fwk$#Nu6c!!`&w|f}mA-heeN@_OIcvvx|+}D@w-GnXw#_
zTlgQ9A3QvE?Vf<FK=buv9;b@ylo%G>3g^wG)!o9ZqBf%#Y-#A}CK#E4LVx2hQ85WP
z&ATYDun6ch0>xX9@c#%M0l%MWF5vMirJQ}XJtiS4O2NR+&T)DK-os_Bt$}Q!t9`s8
zv&QAVsZkrvAN?4}6g4ZPBnn(~*(~g}ijbb@G?WA~kgZOSw2cqKX(?B)D+_?&mDBFX
zO3N)=_MzFi+iD;r<{i?=6nE^&%8kuJ9S$}wiIAN-&^cQ#oEf9`j<{ZW1VfZ1z>MJ8
za^`lk*(U)fv$;$3gzPq1EP6pSAaJmb|IL*4J@_TJpnw1q<?4g84HzCXReM*FPGy->
zud?Zox2#-NfLhoij_P7P&Zb+N^~>+Dn_9?0Rv;cy^KFupOt#RwG$6OAkjOF9G6KBd
znFN^jgb#0ld@oQvQntTxlIG};RFIb5Ze1$?lDB=hEX#66rRt`GI^BbVcb^6ssUHlJ
zF5uhv=;Kn$$Mf5r;!8>O<S4Y>%~!`bBj6k|euE&$*>0wB>?3AixB_4hU{<nzcz%?0
zzW3Z12M5ShvOo?7=DhS-z25poM^A<<G@pO^G%`9G{^JKL+ct;g;QY*q7q+Su$d!EF
z3jj%>2RrR$W@Z9+3-E>wZhLjSSl)am@X{3;AlzRuHckXek@LMd<uU(IBIC&pZLob8
zZ@!}7GOMa8vT||7ae4av^f5};y4deiE1Ddeiuv(lYiYH?wnu5bZ-3!rE=M6nwL}L9
ze@Y;YjEv~ixNLz6k~vX`rp)E*myYz}i*-Am>RTIvgjf(m4^6hWc7Tt^eC^86AtB1w
zZ2UM59AS$z-goahnwX0P5|e~LfHpDaw4suXjERXVodH0Tur5`SqOhb3y&;{7lG1Cj
z%zCz(o!4QLmWrte)Ihd}VR}w`(bpTem?GWzl{?}=1X%?I3=|Y&O``s+hF!raJW@3;
zS20Cu<_WO)9QXT;G_aJFMY>ONhFp}Bg*>H^SXo)E#V7}qLVbX5*KFm6GmWXK#+x@x
zOhrK1MN3nIUEx(bNybQFVIeq1#msg01Z$}ZQL((-`86kdz3n~`WRr}Z97xWUIZ3N<
zasrqJB%sMNA2~R(d&hFxw6?>%;ZX!DulmoO<D>gmu{&~=bA(=y9G@RejE{#$M{{wo
z#q&GH+YjlEYf~p-%CU|X6c&2mAE#<L^Km*lE{e%8SOTM@RQE5a&r+K*2qWZP_xr?D
zUsOO$0d}ILr>}E&v6-utk<Nc0)XK_#H;VYGPV@x~=_Qw=ev%;|3W(E**KK!43_%qp
z>d|N_n}A7*XR2=w49ZCT`s`{~*8=e@)ryD&T~bS8Hg*q8K?V7OfFss9?zTb-=5lTy
z$L)?wW^@s<2QqE0_xRz}iK#-Kkgu=LG*D(^K2SnaU?~~w>_k2~67sm%`<U`T29F7-
z^z82}TbLWGP+%HU8FO=A3?y)c;InNed@__L;_HRiQj-aKb-ztXm?|M8c=>p~k<TGj
zLDnHsBZk=rkJxzRh7{yH##rtc>foHI&qWE|1j{=Dmg_-@iB=oQjlf0>zqmPQ;Ld!-
z&6+p~*rQ2GN)~F?N9$-__f0a*Yr@(!AA*1dD(_Ka24HrBwY-x13IaO@p7h7Z=j&8E
z2b`bL?cnQEFpteS<QH<RZ07Vn;}4BH`wsweE52ILt^TCETkl+;#%SomJBM_A{X`%!
zkwuqBPg8R?ojh}k6|v9^)ZS<zAth~Xrb9P_Q+@WW(<67)H~sx}E^g;JxIi1w(biU0
zN-CMvF+jmPv<Iv6z7_)U@*;uQKPSWtZf{2f%N~?U6T`z{Q4#jG4nzV@{A6Nsa!Che
zP;}H_Cn7W&1_pb8t+;JqTO0eyaX*BS%%|id^bsQ0izFVPlD+}pWap|p2h1vxa&<f3
zFT&g}w#HHsJqW{d&387jadB~RaBXHAIsozlcy6k2F14Vb&jYp90$I**_Y(Qa)z$eH
za*{13E}olLu(LVdUshWSCW6_>eUP>g2G}k48%7K}_ZMq#uO}GBv76w0U$d!B1m2NB
z8MPb4q@?I*U)y$$(>-cz%$ARL+5G*bjE##k29hJD7v!;k@;ovuEVcMH4Oq$B^CUjK
z@Fl=T7#ImYpvE_8X({cBPT@v<xyf$09XaiM0IKeJe*QcS5q^|(<hKs~BuyA>R@*))
zf7UN2Sid!{C!M#c?x0kq>*;a#T6l+4>TLV5#!6oP{Fo{bWDq=D+~}B?u8yX9m;FRg
zqvi~DihLhfT>ODv2AB=#<t2!ShiWBg#5`~R{A=M4B`pclgJjtL(*=Mmy1To1KJA*#
zc9k@L@o#q1P|^m%rYIua<vIF5F6#%zj|uM?vxg6y_YogIiH?kH@9J1MKLJ>7cx=qH
z$wkRv`TlPDU~i?~x=UV0rhrN4J~AbSrtBl3Ie2&g>pu`~0UjD>VBy*EfQ*@DvgUP1
zgnK;=44HsB4`;_%-_BmbR9+rx%~aAbE=5E(`A4P?T?VBfa8nW<YpMFu7UbSk7+V5e
zq+mXcSS%eVhk)N_oW1pZ#ZHqFtwuIx<|?2F%)oAcF-T0+(Sa5skc+s6gR=|FWHSGV
zHUVM&)6)u|j-4oAulcQ(&-?rUaDTvkAf?%30xXUy;`-cTQE_p<o@Kz?0hUmkSxrPl
z#HS-XGLn&jh2jsl#KoL!k|*)t&ADxUZtirIvAw3IrlR5qK$N--E{my%t=p^wa`N)~
zCmV^uLXfSA`q09}M4<X7<a_};-&0dnHK}=$R*g8q%EemgY+GY@1uThPLdYE({c68H
zzS^k71G25-*l7MI%+&E<^~oWTK{=i8e87jiuXCTW77|+g;0NcElUa8UNYBeNHns*V
zPNU<A0?^SiwmR<`9|u|Z#OD3-9Nh>Wg&sgbK&;5g-uYe=9TO82TdjJH%L}`|UL(Y3
z5W+wRZQaxI68`c9+%50|;}ije<A$%_+>Ji{ckm=j{<HWn(mltdckA&NH=vg;%>Ef!
zMFSp3g3QcqexV#(tiZWySs*fbY2_NMugT)VTuE8U-*Vr-hmb?fEO*8wdrZnjNrm$5
z!MdgT;A4>@^U}*4BYJw;8|4iRjXyg1)GzWnud{#%dj%TP4SVkt^ZAu7g%rLaxH-@z
z{5f0l{CC1<WWcd}_<#*(Uf+!yD`~qA9y{m^7WC9{<9Xx%Rj{gRE58Ktix5#i<gaYn
zVz~s^U4Jx^_lk<8_O_RwTGI6{c9Zx&HT+DD{gsiQUFEp}be_}CELGM1c-|pxxjz@C
z2W2B#nVsDf<Z3FmIPdK2sqKG5Z7m$uzcGuyu8)m14#bmB=3SU?O$Snvx^F+<TQ@&g
z6tv>Xu(SYGI<Sn>VEiNY1q?G~k<x6CAj90GqYt+g(Se}T%M?Ks(tzN=V8`91cK!$Y
zlVQ+N<B7b6hWYV+MrP)7_)A!}mrF@T2A}iYLr^|G5NyJWTVSFsjDDLUkrw%D`e>zZ
zde`z^TU1y|R`O%{%sOuL3!j5IK3=dlPi^f20)jRTY?5PvB%T3v<RcEU_Sw$P-r0C`
z0~`HMK;3uI0W2iXKVWWz`}Hd*zxQ=TQvn44Z~Tt96nffdG(ZLw_%7^ma0+d#PS4I-
zR9HG+miVHgeqP_~bjEsKjt<`^KCm|s0UUOelc?Ks>MlL62j8}b+qgyi<a7@0pCf#(
z%FcsTwDRHnE@+<mjGExJKiODcR%UmW<??8oyp@V`NV1HLeMdoV0jTm5UyQR@rK6N^
z{bA_9jHpskSl+Mv7~LdaF(3&w9?a!*j^?<CGryb5U3BVfPb}#2J0MFYKlBs22-teb
z0Q&u!^G9Fi{P-3We{D~LNJdqO<ya?k+?37RmmTS8X_3&L@!D;s=ErNYkm+m;Wn^WY
z%^kp}cgv#sqB%C5K<)RlYP*9rGN3r^y7Kv#2hLp~L|*&5Fe|4mz$nTmzmc()`36Xz
zav<_4yr|pu<O)E)f;<g85lL#f7s_%r`=-dq-?ulKc<bt*VM8hQ1Q=56lN6}bI=C>c
z?MrI(ccKRSeKFbq?A|sXNXdR<VPR2_yFJ`!YJ{Q#POzy@2|9-<CZVQQoss|t8}sYE
zCjygy8`wx()jz|+!^`$2Z$Uj7A`dhxnAdR|o(@dr=sz_R0SbAOB^sV9vnsGJzWFdM
zVS@VR6M~#gc|{BDk1BesY#0s)Br+ncm3l%Vl0w{}AP)M!xN7dM6-PLg;HFM66T>BN
z*kFXMKqwxf@25%p!V2mvdVr7`jI}pGw7woK{6#NC%-G7HH9V|)u($X}c4m#baA^qN
zbI&Jez_{?rxNrSiHRM@fKn>AgDw!xQqoxwYOMm5eNapP^C;y^6BS7{k8PU{K8netS
z%*DR4-`ZwCe4u!NU}<4~lpQ<iW`iUnVz3rp2~t!7x3zYy$=-`{lLNS?f+#n~r(OI9
zSV%r@lGB+z%CqJcb*J_yH7i5zAp!~+bI9hB${4t~`WPbP;}g)D!E<8XKfH#M>SX>}
zUoJx^B3S?uax;l&Sb)3&T(V{!*-&CEMF7-$LeG$0u`%s#Hh-j4+rae)=lSj%e<VOe
z4Hm~ir1D246-N3V5?~ZANG8~%b|8o*;C8uCBQKZML_|&5&OUEo4bXBVFP}h@4(J+X
z=f%b4#}gd5p_V_Pe$`J9zFAioxw;B^5BE95N-$M??-DFknbe_--&C(Hc6mf3lVWnk
z-T|D>KACMf)zH8K<cyO6i2w}d^7Ac>j1Z&Vsz2R~-OQ!YPg^R{b=tA1Hrpz5W*wQC
zx#xNZK*(P?ApDOn-6sb-Ue_D-qy@A#`S02IR{?>Z7p$C>DG6PG^}nvG6GTN}$a7l2
zZ9_nuL2P4;P0&J|zj9NQGBq>=YmqUHME51)t9;QHdUD=A4-kgMzn$0le(`-$Tk8&7
zEAc`1rr8#QjPhop4;VpuN;^C3>YJ!`8S)j-GXUOMMp`Bc8wXxfBb&@t<V3Jdrr>#f
z4#1q*dn*<_K^iC{Fu|B^{~#|vSfzFG66UFZ<az}otW9_#M~386_s+HZ=aRU15;ist
zkc5VxJLdf`X>Et>?h*s1l@+hy#)z&^R6^D==ai;a)C}bLrnRo{F!fruqVRB~Ukmk>
zSR8dp=p)=wl{?%a;7)euMt}kZ><3_LFb*+A7YUCDx5%7t*o*n~JIox$b*Ul<Dl7N%
z{h`ZK^Nvv}4nv}|q7+vs3N91!b2N=A0~Jw<%)>oa0-cc-VPPOlSuk15&dM1T5uvQ2
zvIo4a%5Vz!uf08|lS4xGS@@hUwst@krlO!QG`0r9z4@uB?^l)?g$Xdpj3(k8*Ku(H
z?FIUf+5kqI0yi({<u;y`@^;}ji5H?sWXd_-md4f;OiT-19md_m`XF1dBnudp@t8}U
zNp5eQUOH(Er3getN9zL4{mYjxz=QVZ5(T(51d*RxtI3dyn>3L;Z(`BeKz=a9Qr;#e
zEnn}afF3rj9_l<gi5?CD66qcu9=-=pjg5@PlL=p9ko|ER>z_7NNREt-78e)uU^jk7
zMoGWC6P9A@z5qTelMp04CPuH;gz4-F>c7$hKoB7TK|g=~)UI`7svLWXj~_(BSLGkU
z9`zZL(_W2FciQz8)MdEQ(T_Yl02zMp_{oQq4oU=SGp?4`D2q)^`^m}Ao;~vu7eB!R
zCu|x#m@C*>sULjXA8u0%<i&f8fKHR%7{9XChgUFFv~l|q4-fux5<Uv_GdVB1uDpqE
z0<Z1+zv%;F92y36^&KiJ7vNnf;|~Ak=%>{Afe0+qALpE<o3(=RNP+|U5{2Ij^`MUh
z(u>{iVg1E+(3creR7CB~ct5Uz^hZXV)0u<?^}ur%up>FiBOPisHa6{Z)m%FDB)m?E
z=t?RoKmtD)bT*GL)ivg1<G2>?&x@X39AJq6J=vw-n>9vP0U)IH_q!<|X{OE(rKCW=
zp6`!c7+P3pTMe)Ti+y$y5rcg=eSQi$7TvpVCTN;m?sh?y*{@b+)sep)>ht0`=t9k(
zpUhRR;E8lkf5Q4OF>Y1w*t~V0a#9YEiICUn`)?T1l0T8iqEw>#DM~^hp(C3CO`!i=
zQc#dk@1IaFadz4exT?WuaPa&6O0Dz7!-p0PmBL|uVo0AhN7@#~A}&nL&9{n)`S6(&
zB4b^qV6eV9_o1fShVK$+#71}O!O_a0naT2@kQhh6cYg7G%6D$d>vatgL5gXs^%m-0
zXp3<6<c1+)H=%wf0lX#)HSe~fq$DX`%=WF6iHYC+p4RhfW)~T=hi&3Pkx>z#@dR@m
z3=Rodw&Rf>6i{Q-5kYc2=h%g7*aP=aJG-VkDD$Z<Q0CvC{?W#6;sva`xN{VeKh`vl
zRTxp{(1QNV+0FrcUO=GW;4ER%+f$7eCjb4AL7aLYR?qFaT|sIxL`TQ$bxm1#4Ok?k
z8st_+6tGEjD%W9ZxzyCuh_DyrP$Vzh_SXm_#BP^<Q|W{69w4-T2Luu@8D0m{-6$w1
zfq{XK9_<%vS5=%REZS(-yIn1J05C`}R-#>ZI`!oqY(&t;0rK4t&F11kh^IEQGvF^F
zum)zsa?7DCMSv+CMjkd3PJ!?Tm_v3pw!uW++N+#k&`|g}u7>0TH|`sP==!UD_>c*#
zCC2>Djy`>A(CDS7x121xKiwL;^WIki?7f!PwUmg6!NBzys+*;!4Ep&cD;edc?#Cp1
z!Ug$nn+d(3$uyY!CMh=dJrG(3ePd>7lc9YbOVwhtHzjArBx&FC=*ZgdqxEzOmO`aM
zM`{9!^Yeiz*HxPDQxNz706jT50R%d%)Y|gnuc=Qd|7|M@zc?jLZf8ndyn)HE{N&`A
zWWHHw!#@u7I;7EkDnywk1URdxs(#4K_L@G~*+<zRu%&Yk%<sD96^LgJL|0N*uW`8x
z1)kJ&3=DmPgNvn}bMQ!P5u^hGyC!6pO~P<V>nqo>IAt1etLPaRz#BY#w9g#Nmm}<p
z{SdH75m8aZydLd+cr2JZwV?oB@Bj<(pn+@>H@QX+s59MD47n0_fW*KfNCqU)*DRd2
z+oWtN_BZdO<fY>|?K_F@=RhMF%wz~Qc;AC3`1Pw`_WJQ&<RvZzR$d+{FxdiJ35kG*
zx*^MN!q2}GKE{6i%;y|J{6<^-{d;X~A_o@Rj_{7Cs9++)qA&Ug>3pY$6MwH9WEqXd
zb^E@rtsRvx(6*T@)IOqQ{D8glG*^FYovG37BJOwqdfz069v=cKfHh0*)>e_JBAdej
zw0`&JA1ZP=<piGf<#X<6FU&uIKhG5i6HY-um2&VyBNYUGnxK48ERnSd)@*$fgpX}l
zZu$j+z;g;(%>}CGfdX%>F)=Ycb+p~jw~29Hem@B{F`8@SBU|m(^Zssjo4c7!w(W*J
z3<RQ+h1}1t9bH^CG=>&EwXe^BPkNysw1xWtK{$}{l?1-3TmZtHdA)%kx2NJK2%xk+
zLlAg^@D@1ip_wf_ae*`Hl!jk>EZxkkqh<%YV`GlO8dJWhh6LEKkrzp{IC8OW3H^p`
z7y!!#Vm`ZA*M}UGiYvA}5!6AJ`?Q(@thAjbLq6{xz6}NFLHheS=ugX02(bWz)<>Zt
zBA~yA&h&x9>h>xJ7`4vN&x1UZ+ue;L6Vu>%QYVazM1YCFf#?RR1yzX;L!iU{_m7#u
ze@^!NUo|bo`iR%nf0{{sv_(3D9F498OAZ?qTGu^!;(v)oG#<oSp;VL`9Y+Z4u|L{M
z`iBrFc#W9_{PnKGot5+YA-Jurqt9T3b3W@uW`I`%^y%I`tOX#5ay*vrW(;QifBo&N
z^UQd@&u+K>(VruTN$vS(KB?jFcX_uRlT^>^fZjSm`tP?`vOxR19uxP&6?nV3mU~Gm
zC|K^R|NW&kSx0mS(sD|KK8+eZm5>0X>1jp9)0T^&<TpCHy7B`mii&Z9h9)J8jVd2h
z?90kQs!aq%ZCSdAx>ihhGzp(gLrzRga<ML;BtVb-1u_47pnU$i^{>9rN4@{KFO(yA
zuz2FGHfN(JbTIAJcVKcB1;YPqoo5$_JD_U{I$n$N$|sJO1;lezURTFoW5o4f9|uEE
z>K%7f->bXabnAnTSzNh^Lc)#Qw*QM(dVlIy=QwiB$iC-$rb9`lb4BjJ3}>Xxo0A-c
zA)47nd(m|>fgHv^YV=-L_pWn~5BLRuQ5t0}t&I&i!pO)dJQj`UsH94-f$boL6vUvv
zN66lO6XWUEAI}?uxL+{P(J6Wp5WJL2=4GOK^9IZwkcnw(x^0xW^AZv&+dKZn@6V46
z+pg4Aip<nOq3uIjRd0BBmAv!w3SJQLw^zu-kZ$y^d$weUzE`hvJP>r*e2p9U4(V?;
zf7G!+O|d*OGSX@9N=HT}5IvoWrrKrZxa$S!vrl7kqPq<7URWT?G~YETh>H56lhe>t
zJ6!et9PSe7(Tvbn@@ta_QBqX}r-&1p-vcBBq|r6r8PA@+1k*#~R-YdI^^nKOTlGV}
z2F3ty>&K6uB)@SyR_>$$G&>+OdV8nGwg1f{^HoD+;Flxwtp->56CeyQ6&0puq$9%W
zst?{imFSvUS^_;W3MwiM(5*O*%v)@FBp?8X!<srMTg@Yy$e`-#ntNa(XI3aw8F%3R
z2fBgv*jaTWd^@mx%<|XdfRF$(DyJFjE{91g$^9Ip7x00|pwItJr^3%~qEk{1wm3fy
z&b#_-G=Bf?`ECqi09?3%m2p}q>22x7#qzQN3nT?3Wek2j)ORrKt&{G|=YVCND$x-*
zfop&sc&+XJJjl9Ld(-BVS%I7OPyXI#2<dKI{@K~lz_3nM_7r@WtW3(7(iu`^Ww6w5
zPkXTFzce;dkQr^9TLVTNBxFzm5%b!9Mh8fTHWC3074%N;f~VEl(E$igkevWMn~_;F
z-BS9r4e2Y@@4=+hU%!AC;$=<EoR=2}qi$~3<BVYD0I+(%;}7tY44`G;b~PG^H}tjM
zQPC3R&${J%>JQpw#LZTH-QBc|j13M;H+_?;-#z-m&@u0}jio*v6~wS0kqssL{V}K&
z7XyomTW|dDt?P&m2DpLFJ2Y%VAq9Ai@M4*nTY`B&N@~i(>~=8;43UaTM=0i7H~?O2
ztHrS65>_2$nFxJoD<&af8$2;00*pIF#N^zKkBszOp3(`igvPvL=9(<^kC0r!D6V=x
za+)waIr^u^`ZM)2x4`*A{q`e7CQ=w1IMFsmS~{}}h&2H8<6q1E{ekW@=Mz+G#43Ez
z!j<H1(R7^X5-#HUme56VHyk{Y$d`qqab=#<*KN%yVZjxi)M_6q*k{c$0(a^#vroi-
zO&KCod`iDgj{eUQ6Si7jURGFG6f7r;xxA7`_ty{;0i8@hAPzQ;S(S>Z&uK*{v@hwk
zlY{39k_SbmEsqKmozC1m9)W;~oqcS)Usgpf*jZSjz<v75Px`t~m9p`f>08`CqN2dq
zS3WQjbU%{Dv$u~A;>fr@?yi3R_c)6tisCJPLPP{egFryP*6vJ`B10bJ5itLe(G{|{
zv?@#Ga&-)3!bV1oJE^nn?Ch!*>V_`&-GK<{27$+Q<o@P#TYur=!M!6jpn(8Osaxrk
z^gS;xF)<NT+tvFEF-7WYBh5l>NOa>nT=3I9nMP^R8jx4%nV1?4CM+I3dIZ`O`fU=^
zGkhEd0twZ(nD|6&dvh<-W!{tOt2nG!#BoT0?Xe61KH!c6W0<B!Mu1ri$s4zzpCo+b
z4rgmWATR$Om94-fZ`i)8Ua0rF^-QVH$*Iqwfh>cNoBQI6^8p$uYj1yH-xpDTS9{X0
z&~Yz#C$M{8zvH<N_4QWt4tdGS$ju!C@zL_)hS$~A)w<Wzx_?k0dI=;Hp^^PTK@}Ao
zeD3}yF(pdM;%LOOo;pOpkiO7@MO@?W;EzNG>YaP*3;CusQKVY10e-dkf`L_Hp<8Y;
zXy4L&GwJI765TTV4OEsEXQ4)u8p<L3=X>?8$@o5bu{Ac8rJ#og%7Z>s&zoFOm3v6<
zHAjPcx3)I`XMYW>VeRIIAX6cFv5bR1=_X?&sEz+#O2hQu4kxcyGcz^VP3MoAZ{N`5
zfO@tKe&J1gsi(eaXki2HFEC@evC$qH7%2MVDA~<pzrDJi!ZoQo6l@8Md>Yh2K@0QS
zmIa~pzaO}I4%S@lJOHze09^zPP`9f7H|SLIkE>uc6|YF%X6FQ(IXDjk6Z6ttY$e?g
z@IJ2qUA4rBa!WXiA_fL3V=J|i9!cDv(G>9Ww&0hND&8Op%UfDia3XYjoom|k?GC}#
z-`fts47vSA1%nCpzs6<l`2UEFyruXUn-TX9wDM>B2U<}J{PQZ~Pq~XY*uf-eQyfQ@
zWwj09>_8v{j3k=(Sy`>`KSS4MQU5VqEdqu7d-}^v8vox&iuH^BzYJf{vHt(%zi#mV
z$vsgTAV%Ow?s^hhY-p7`^dlzy;pCI?n9*PI-u-#34|X0>u!wVgdfxAg*d(SFDq<=$
zuxM-!Tk(}&rCwu`V%c^w81FK>Y|-b&yX=4k<L$?rb5x+GI-0+OQ;g?~MA5p$jMnPq
zq<KGY6g&`LZfx%?`a&M*G<}<3v(U7aZIRj=ZnU6j$9Jw;XgdY`+U30ch7Ic1s5cdc
zjXA%}D46!p_hE{#Wt0sD369M#jdNVA5t+N1i%4D<oZ7<@A^WxnVlowNL~d1XD|aLe
zqs%Jb5;nO;Cao*yzUJWx3BqXu&ZcsZxkg$anT2s_$srVd&2`4z4U$7hqBlpyc=qmT
z4%)5indKtq=g*pUT6@#wE8T4rO?NF+yAPej#X3(!S@Kgl6q{<<6bk}XcZ;UAWNfBl
zvkG(O?QIm=7X6Mb>>h7DCQZ(4dUJbiZ@}D!c>g^uKIduj*L~z9TYaC9D4_F~UXlK)
z@$h!#f+e(xv6m53>A?+QT3odT9w|GqWm0;7dh<NmgybtSs-;uU7kx|70r3G>q$h0(
z&}ISBme*hQYKlW(Z=`!A#dQOo%@KCyEhBNee4a#7v-ju-H=2<v9SZ6%T-d8pzu=m$
zuU;Y{GtxhOcpYh8GU{D<Q>0<=k%SVfs5Blb>2Nl^3!Re(2O97XLaqJrKcxTG*jzOb
zL#lm!W-!~wVS}TFZJEm=d3wVyH;k<%W@(D?M&(V0ptxV-^OAw4WTNo?gpBl(^oe(Y
zI`2)!rzAzBeUz^b@EnZ=){yZ!8O&(kd*>786%ghT);q2TV;{=>3ae;v;4=(%>LiG6
zV=VD-rlKIvz|fF=F5Mt_A-=ao@gn&BL8g3p>W27>f+f{))8Ih@5<>pW)hs<??+)%S
zih3EkC~kVmpK3X(9j5R7qVb{xgig~3<#x+q3P^F=+*ue`56v83_a8;gAh1uI(}y|<
zSna?4jFu17z2APruEb`TiSoH|d38zfc2{8Lp3>?bE1FW~onD7)bi~^0zGVBPf*1Dq
z_0HMhXIfjcX%g^@G*XvxqHI1|Gg?YSO6WdnpTdCJxGKlbG42yq!{k)A=Z=0|May?4
z<r32J`AJfI^*sv%PvhYGr*GEXwZFx@!_LH`6p#!#2|bxvqM)MCFf7iF%bu_;2%is6
z5L)d2*1x+t+vDu7FjPDEBZj;$uy+e9)-|D1JG3XLpAy=@bJJ=QpyLS+mRJYm`n}1%
zmRkzeIESsyct_BjU3oXYi1eb%5(IQKuWWTSzCqfkZdTz>M%LFyBl{A&K5UE9s~?P#
zHh2i@2^q}jvAyVJ>rzg4OEz}-x!UB0S#*8d9N-P(H<zEGxKWQ=f&~Th8x7sJ?e_{^
zehu#uk5COuh8xIF-_a!L@X_rsz%)IyRNqzIQxCNUwGy7#ta>x%HcA#0Q2V*=ZqBzj
zH5A#X>Ac~ry&1phmQh^FX)U;?7S{`HsBh0QqH-VH%gZggJeuj^E7*_rU`~4x>I${9
zuxrFS<#O6#EMeA*RXiO8LV!Zaswy9jCNoTOCm~-g;Us%~&w5D?kc&#AW-m&$Ld*7>
zdroe+H^y|cPEf<iBeTs|ryH8cm+QTnCdBlRo|hjEM16;bv1i=vH>SpPyhma77t;$y
zyA_D+TRLGV$cx!Zg+0+t@RaM*?z0IX)-MhB!6dbMk*3Ke<HLD7SW(tmrc5EPrf0F6
z$GR=P?OjWpubU7|eR)SaDp-zuE+OnBE<H9*A@_!z&Zy~~n3)z^gdE2vl5U&xg{jdy
zQ=J6+#`8kRqik=fE4!<D1|L!)Iu4y@qVlkdp9uzC;YL}|OhkzLdqY$(E|&7R6{43h
zOV7f3;Pz~NX#Hc^lP2L&tcE$f1}&3OY!$v--rM1}pD}3-bsoAFUWwlGfubz*ee`*?
zr;WUx7$eR|Pz|j$Effxamlk-%c8$tBxb^jx4|(eyC(DM(8Aa~4xPk<NnlnAV*PxF$
ze<C$>UfFIViZ|KgiAtR7yU8OTP#73e7zk~`ZR39+8nxTo-`x+c<IK`I?9PmIchGKm
zDN&SZ<n+OG(&8*<VNi6;b9a14rAYL!!}VP)u-JpI@jI@%Mrd9^-__hlQh-t1QYa4l
z+k#0eHT$2G8lw032Get4*UG}8Eha(1RZ)Yr$Qv%E=7M~lLD%?-DHFltdpW=nUc~A3
zEmg|ZGO@eUc-1)CEOz@vpcs~E+6-$?#^*YPZRQ+u8Kh5IE7T>-G&%I(cWS3gw>su(
zN^-`n;JaX`G_N#8XwWK^jp^v1V{M>?`vg4UfZL3LIB|9^q@0RT1c`Oqa<z6OW3Z2!
z5F;%!Xmv9qgQMO|>AT8Y0goq4G$W#O;4ya|9axcu@*%3@A1I-ceKIemccWbNQvJ6l
zs3Wr_mBl=!hN|N)aYcN~hD{YA`M?U^t=}Q2mZa_Qi>qo|k?eKC`xGXBjeKV%A?_po
zn6@>$njd%+?gIx|6Ym)KxDupOXN6T@^7m^aF`N(a&o_qUi<5E_qIc$>!4S`uw2<V6
zO}Sd`XuAg`F{A}X(K8bXKZpg}^!SLyp3^t_D#K^T);L#Ho_|O$7Gu>w26l~``q7;v
zo#PwKkLt~0%@SYUI-m8O(FN0XQuBBO#{bqpm#*%wrmJGN<~|?C-)@P3hJn~Cu)*UU
za<9E|R1v(0CwWW!u&rb3NT3}{pW`fEoe}ryVy>pJtniC(%gz{tekO`E#d~*m@y+Ij
zH#{P}pFA2-MqaMCX~XzXZumXxlp*i=uGz;NmUewKH%(kkXjr7gfvd6-N!GO7ez9@!
zJ5>8&%5TktLLURwPA6hV8<hOF&KrcqT^(HwU#!GhvKAS~JVj?#M71X(bV(c*#O!f{
zM(IP^#&hysI1An+hB1_o!R$lICy*FUgxAOEzC|WR>a(;BA*bBpF7(2~atbrXXNt;=
zDhnDmxm%o%wuzb?X$P2s>j)Oo%U)sQWouL3^Xt~1Yqy-x*6hX>?wr`1>Wo(J;3vdL
z=n3A!%9oz{n`>DB!4|NNAS5t<FBi{i$Lqd|-m-kB?7b&eM`bS!iK~QyF6>b~1(X>5
z)aP~gQyhe(2Hsn5-jRX8*hkwNi5G)HlGgFjet<b%gH_{!<-_KN`*h2Uokr`=c`@I0
zxf>NqgfK*Qspse{=&7GjJ%M<>*Ht%pGvDhNCnGBJJ^6h+xf}+ohLGo<^R??5Vah+)
zPgv_KSI^<Y7i<A+s%?yMdfb-dQ=60Fb3HG@qt2oltI>wbC)l01<&k7xLB(`K?2>n^
z-t;fG02@{kEwoZ_4XI=U!`9m>{$F7$Kyv3tQ(_!88;m@Cd@B6PCS6$KaCTHL%lU{^
zc|?s)@_tC=OC49;xHkD=%MWswcZBC$4UPRmbUacTYOcR<S%@u(Prm3_+&t6KV;u#o
zt$)NZ?N>J?-vegY;4QBr_Z~M=1n28FE)x=mHhPCPaZ<{s+6QC>jPU*Sdef&V8{YkD
zlPX+C9K}XzstTfG1?+U>@n~P9w6b7`Fj0OCapjz!l<M?P=m*OaLE2)cV0VqNbFkZ^
zB%}L*87_+?<r)iO$@@7aJ_g>vc=)zhO<eU1^kgNYMBLlsNA%IUaxjD2C3Py#&?l$l
zm7A3CtAmqWSG$NNbdkt26@vH{apiHPRn<=@f;fNvB-VuVC)cYT9WF94DXkw6pVg;5
z3U@BNM)x1-H1cA1STQyziu|-3k60~Dv*WN6Bk?2E;~5ee+8=1*eP5ro#e*?}c)4Q_
zF%maciB`e&qJOSVs;>LNW_n{M)=kA#g{q#7=I&$zI;66u;+l6=A`fM6o(Z~I)?C;0
zYvlDy@zPm|9pBY3L%v*Bv?Xm-0=ZuZ>h%gr>7N;i6P?v8tv39j@JFGF8kQ$XAX^~w
zP)(wP(085psv4?sFXOI`HyNbNrR3NLo>)_@YxdVC9P|eEm8X}Jv%D*%)X3jc`HHFE
zr3*a9KXZNoYZ8YFCr?3{bk7T@>+DYakp4JbU}&tdwlMMFvH9a&pE9*By+-ewrerzJ
z@V^%0k&Y0|Vp$8RzdW@t$K!tE_q0~&F29qorZ9j5t_LUh>qmQ6-@wJSj<u8(A=n(g
z7}D0I0w<0s9?gOR8>tmD*;VBRH>ttV(Nz~qk6vs{+UHG_H1q3z>S@x)GcV}?$Nr!%
z&J}~RjtT`|-_3=WOl(TrAAQt1eXn)%@wL-66kUf<#|GzOY_5}E^{2d#n!{>Vt}{0*
z3NOlA{*tI>iR3D$xv2P4$26ipL=lT0#mBkNBOyIJB)loft8*@BuJ2Ze#sjQ1FR82J
zo8iE1g``(LXWP&!QFNlemz#6)O2ccn7N72`u>;w1B9opq+qUytc<gf!nF2-wLWjnX
z$a=`=z?_P+;o>|<jbj;unf^J>3Dee>U-V%@*IodFs(L5Vzz|VY6g7pBekg|7oDvX7
zON-~{rw7=6hav`2wHQcAzt5>xvQv`9Y!JM?ZvP$8qD7kP_#wf?+$XtcKahe2&6TJQ
z0QF9u)B%gC1l952@vPO%b^a6`!@BSg%(E|jON(<ZLx#RxHO*bw&C)}1y`J}%qWa?C
zXgIsx{E?Qww9{GwJ46$N--k`E*hFWR2##V`8}`O~{_K_87Rw0|5qH!J)YBFkW_@&h
z$HmK5n@5}!Y!Mf=v<2VL$&0!jP){-Fcj(nrJ{ULlEoa@IQv0H(7hatCqfzOs`BXe~
zx@#6%H4!s;c44GREB7P&TWn!U6Uc)PPZ&Q$s!~4TJT6Y@w{Yzb=vlU_>8<N+paYvn
zj$bYp9*nwsI>DRkw})EL7+z3bJOcR&@wpzx6B#>=llv+3tc+a=suX&L(UABOS207Y
z>@$W*mx)@W>Za2~a6J}ey6<O0&3tZ&;&p+84q?*n^lm_SfH?F6jsAzzW<%zg(wRj1
zkg{T1Ug*E_U4z#89QFinK8A=ANjCZ{pCsbe1adQ)@LP`;M`HMLw+zhsc+tj911?^d
z@3zN2Sj1;mWGa%jy--lfb7yGE^yrZp;6C3Zsycw#Fwrn?tUnZzGVcM2fS1P+;5Y82
zn@cQTh2w1>$U_l0(kMaZT2_yc|MzS~4P81qCMk7F2Z;LS;%gBkPT4lNbtv_h2ET?4
zw-*b=b#yP3byK{Oa3U5USv#o$zR$)`0PMU%KTo?Gc=)Xx_aYldD$kqc_4nE%W;&i)
zU;C#;%$i(=R{WFhh{Z30>M-TXT^wa`)mY!No^ZL_pUa(PeC+EH2~-gXeYkRb2RD5f
zLv@t0K~s5Wk=~clfsS%u{m6o)E!;|-Oijo+$7aU5TQv7_N<;@`!dvqK_O2ExgOqpo
zfl>cfax^u2`WyLjQ8VjAd*MS1)3n2g*Ui&vEaw+#2PmV@3jH*w7Zl3yEqVq`X+F58
zLfDsaL?TY($YG?9=U(nm&x2E%iE(&8UNLEeA=RqP2UWkU({ZHAq@2AlyWjoAKK8&Q
z&0WN?&~fpK)vbnFG(C5778d<=jtuGSaDgAOSEQ}pm|E_~fhZeP>-%amu}|&?zIK$w
zadSU>aM!~WBUznxv{xEiL1uVteqVb~n4eD1z{|kEyR&i<iZvKoO=7I$Neh*F=$DHD
z^*POk>zDD=$5QnujleHd`EVZLh)61`vceE|J<jLsApka{??aClmMDs7?b~<EK*cY5
zjw;ByY7}gMXhtE%*Dt&W2_JQwS4g-J4DDMZIp&e|wxwlYltGe|M3O|B!{a&)O=IrU
zu_V$2vmQpD;CbgjfUZk-qSi&G`ytlayEQgxwqRZDLw>gJ!eOsEGUB%l*?a52I`-~J
zs)#W+er&9b1^@_QC@P5v?0p7~3HG-0)EL*)V8GS2Whf}2EUu>zQ=V1ySAs0)>fE-i
zx%EL$)YzPgOe}A<L}B(`?w7J2pZ+2?q5r}4l`4={`I!7zI2kwFGUH@_oo~B5x)xW)
zM@4<_ht>Ea#v~IyI&+42*939Bz@<i%x8D%wNfSPqQZku%Tlu(UvY5t;nCOa~GQ~jz
zj;)b7034W;t7QMlP20od>A5a9R4d?EzujBVm&5K=i4}qLIL9)h&mGf0IxZTTDYh4=
zN-#zCt!@arnAhE_rTkT)O<XqJx@R{9)M4B5bTyQQg8}34W!Ne4LyW?rV}bU-_)>|D
zx}17PG@-M)K_F>p3`NJebz?DKO8A@%02E+y`YJk^7LjIHXFB&g{XCyj3`)FL&V33q
zY3^H3_^j2j))?zY)xvhpAt<!<kS~SUo4aWaQA?R+4B$B~4RHibv=OxJ@)K!fGV0{c
zfJ%}|bay^^4Ye6(|In(hRTT{tpq2v9{85!l+zYlG%-qd_ARdm^_AxOj2`On+X_&m;
zoQRCLVmwukK^Zc2U|(L3MrcLANodB)b*oOs*D?33u-xjj5EbIkJtL7YezwrG5#azi
z&XM0A?4<3a=>r&yqKrTtFzzCzS`J6QPDWp@?NRR2meJI$^9()r#66>i9-<YHiU>*e
zNT1!;HU~5XBnA{NVDl~d?$C|Pbyuy_SFxMZWKbG%&i9_C_;&&x?C*!&bG-#1Dj5<3
zO4}V#-D@}DlB>q;L`(MB>_7<K%Xe{3)O-AswOArb_wFqgt828;h<$K8h=%b@?2cnI
zB-9Jb1B=7W+X|VF!u%yX<NbE2plokkQ`lD}F^+_f)0k$NUvp&oWabnqWss$cY4aps
zC^#ptiQTzc`TxdvhH_RR^XEM}2}pJpkjYxze*VaX%P!@YZ{Yotc?}dz{)A}|>I9oz
zs=-&FqRE<69Po;7RMevoM#&;*BKCP@9d$saTcMs=p1@k4Y85(g(5!hUe#^)Eo0bfE
zftkLD;&ygjig)(JlI{(ifL7xJttaRr$M<iTRuevxflI^;)(3hGsP2TgnK+a}vKR*9
zTOCiS(M8+_cJd%OEOZp+qp)@-?Wut9XS)8sxLedXi?i13j@&fN%EjC{CA>6+7yTPT
z1o#G@UxmcCx`#Tic1S9-L@+n$)LlB|HAxa2#Ngrrd^B>{Jf!aCd_r8kEtIi#X5-Vc
zyg=;~5gy^@6}z8jG7$H;6X2}cqJ8eAR>bWgUuJKd4Qwm`@SUA?mU?A6-P5k;PA~ug
zhb2#P)$ukWwE;T9Ue^KicCbjpKK}mrdjFtQ?|wa;+Y~k(QoTm?Q9U#r%YH@Y0#di5
zZtiXGN)9m)dHe9-<?d3B-ds>6>k$X|O)CQ@MZ5Wg$)MO9*g1`|V3)>vcw&-4l{-Lv
zZ_Zb2xo15w6&B0g(Yf@84r#AO7fX8F3u=faK2H~K6LDk34RQXCnU0>89#A#vDK&j)
zhG~5xXcpqS7?jlPzoVUXGkQPB@wLDD8-99$gbCA^&YY=~8X_B-Dft*vU9vyew1#m{
zD@^xoBSh)YH{)j}zx2_}KInq*aq*oy5k)+{GD$P%C3@hyn)lbr5ZR1=$<g7S;M18%
zWG&d;aDCY~@YqY1+(=!_gAXyjs@E9{Bxdp~!>o+VB79G#>}!;cW2KXF!*W!j=eZ1@
zuxIHsLo4jA(<IIw%h<`dOmQB{z0JGLj%rU8+a9Q4lu|v@GU<KRXT#K}1D_c5!T;IO
zXBSI#pkQJDH+PLLVrO8VULvlAR!*d~XU!9O0ac30dM)*KN%a$!Z+N09A56ow>(}Dj
zA=OYf6Q;L>l*?KiwX5q7n?r|$CcXHc<OJBC`CEoM3H5&O%VR8Hyj8je99Dh7K~w$F
zS$>00g-;(lGYuj&wkaOKEgtfhH=9#k&Qpl5=MiBY0LRtI{q!Wg{^Bg4E(3IXAVW>4
zLN9eQax4)Z9C!2kbv~w(pZJh+sJ!&TSpbx?Y8t9nZ<bC5zH%pQ(qMPy_ZBeAH)DSi
zOy|joRqmmaWN>jhoGHqxc14!9ml;y13p=LG3fIwyRPk_@d%HLG{vO9!P!O)Jq8oJ~
zI0RW@S`1va$Sp~F4G9QtbH4TX6F<K3qC|EF{!qC0=w+s5U|<ZaJ=*WRP_yu62Rtk}
zwEfu`+2i|>>D$s7XYo;kbBQ056d88K&0$|v#m*o;<}$f@u8LP1mqSsz(%aTQKsDMU
zR1%IO4O+UMOw<k#e7+PNRdw7QJa^Yl9DUDni+D5%_3hoO$3s597uX`QW3giF-Nxf`
z8Aje|bb!*RR;m_!b?ImFn5q00%P=yeVbv>=<#z!Dj?zelR}N{H^~jjvm`U1v7$PM5
zZun&alma)(TQN%VR5^#r`k*9e?n-1Dyt}q1fFV9tDPypYuxnFj6nwM$VJztQ176MD
z;+RkhsLl%WbFag1sLYh#2PepZDiP7TK}}KV&idD>V4xdJd-H-SYfCr#$#DA5$cddM
zQQh4c`Jaw@D^6Q;egC7k>x^nLOT(x*0z*e+iHaab1_5DQLIez801*MDNl`~sh7KVb
z1R|ZGj6n#}2_-lQ5SmC6V-%^<0z@G6BBHc_2tsIra|yFMyL)zj?4H^A&i#?^<eYoH
z+u!$jp7UH^?%PHYuDfqEb+>vkJof<XJ86HqG4W1QRSh_!3<6?cQ_&F&RZ~1yb=?cy
z;G`SuF5A+U(y&-MrSPw$4ppDiu(km8$b0vV|AD3`Xn5(8?E)Y&w#97et<p~)s8C(l
zE*=S^IENXRTeFVoQd_*E(N~psoPeU$H0U)&@1!Kr<y2CZ#dy&bn7`rH9rw2jIk@cp
zEJD~Xm$~J$fIUc!tw80{z^r~iAl8_lNE=y93o$)PE^bV+;|X<J!@94DEHW3%7>lxD
zYEweF+G(2H8XL1Ka33BnliX-QU_w-Gl1<H4#=pA2L&3_bmY<{;0PZMwy?odS{K<KO
zQ$!ZhtbTjpBJllJGNnJ<iQ)h0^6+QY4XFzxY=X=ek^zG}&kD)d0>67mh591m+dZvw
zP>wmYi!1oFX^(~4XEoM4`yBfsiv-)H<iST1F%+e^*f{ihRpbXWu(WRYf?pexs~ye6
zJ2N0tEHf+Ho_plP)XG%CLya*sXMIF84&Rq>J<b_J?ohy#3Wq+7JV)^{_XN_m$a3px
za4a9k!TeB5Par7$fS#$sv633y3)k0~3)b{r9XmW?Qp1PXow1Tzl~Dys`<Mh+#I9aD
zBC*<VPK}{Uq2ztdx3_L<Y5J3YJeH=J{`7p8ahL0}%Z8}twj-V(q4d5p_nualJ9%xg
z$><@7ocXPhc6fkB^yb<%j>NQ@(4k>A{3TPBwamc$&ChkpeOPyyNe-8sWwuQMBhlLs
zyCQ1FL1U^iq}S1|>r`)P+ARZ{LULC9zCqpmAneC~%S=!&U%S3rUEFq3y&WuJJ_27j
zkuUzE9Abl|?kTW@;gyN&j1%mdQ;M*mlv~S#;Gf^vzkEZ4mh~W6r_Hozl&_bK7)TaR
zK#YhD{Olg{H{zuFc{SKtnUj#^?;(NcK5*2Tm&PF`*_Pc_Ush+wGcNlWX(g-JQeA??
zkmvj6Zvs+|SB7^NuV;HzMcU9X1#gxfbf}JJnzhipCCB{AuPuq{quI+PUj#`ty;YJk
z6Ucg}=#QKV;2?xpZriMzz640Jqb6vuPss}5onLds?mf<1FOBz*`4&Xi%WdKsfJr;P
zX+r4$lp9kskC^70**YeQOz=uLCnecz)Zb3dVBL{mvh!Eqqmw2}{nPf{jX$p!qR1%i
zwoGBs(s7x1s-j^JLp$OxY&G(hCByWIq&>+a8-uE)=Hq}ZP&#2KC7vV>6X%ubT<qMV
z<_8_Qv|nGw3+?Ku*`5T1-1U^=hm+^<04r0mHEl&k3CAr?Av`a%koE%tp@LqKB7{-3
zgwpcken?%B!NbF=(p^+HLiT{1Axg14{0#2w0mABAK>m9O05788q*_Yxn<8js{E=e{
zECoN$!&y!RPP3?V;S`-VaMF$~PxnqMcb#a>A4q+A5QGDc5AODDsmxs11>(oL>k&jT
ztqrB;i7PUfYz^|tt~xabp=en|Bc2ken+|=0D$6c2bs0k1a_?K*npV=s-C?yY{;}BZ
zL}1@E{G%pVT=iM?Z;OOlzHL>Eyh=TZadG}e*_e8s=ldsJM=-9&0WSXuA^!Y|rDtaJ
z@M?q7s^!}=jr}(X0o4P+g+BdZ!cdQfh}X@rSN1V4o;;_Ff0_SXURKU0B`41EG_#j4
zV5$1>b4hFE45uE4%JwthMW*ng7aAg4HwO2(;vPqTT*Zu!qz4=<m#4Jr7e-vgdVCDJ
zIn#je&=N)3h!(1MILaZ;S5>T9&DC#DZBk53cNtTYu_EoM69R1}99C0UyUAD4v|2U}
z7?CaJys##?k5EEZP!K+A@9WRFKSUn-#vutZL7C4<1O_zRn_rei6EiV>8XevmurFTT
z?rNjVi_aIM36BP@(*j;jESD1jwt7-!&SBtz-{|YL#x<pU&0f{j9#VS#P>O{;t_=5>
z{-P!CovGMb66Y4sU<%NOayiSN0+=tc>{jWsLyt=zpYp^R2F0Vq+$$8zKO{Kh`DyUT
zoZ{=;_TKXI97llk8F2h*TPF~3`IXIap>WA?;|WpZ@93HAG3ep!;v-&(0K@RL2Tscm
znvCnTB5GUwmYIuM5)R@bNV0f#s-n%mVmHg}2^YMx89ycT#vZ{s>)D>|U&g|>YdEXU
zQ8WGw$!vRr6x%V%8blr-tgu~rwCf}f=qkRb6rjk4kh$kE^k^T$n&!jln$CCM019Ee
zWJDGnaHBiX`8b9pD-SiBKV$V0!(BrI231Hza@d$Rt}MznPEj0@7`n9E6^9GqlOcas
zVDn7m#PoO3XU>FX*m*llB+k4shgi3h_Z~XUkP$9vLSAhm0r$9mA#lyO^avWZkE?wD
zb2W{5R250fE!C~$m`!-9em7B#RM;BTx@kRR=$C3`W%~L9nif;C(D&BNUI6S7VE+N-
z=0<JA*7w~GRJUd2K2^-;k;&WCAzi6R-sJAQPZl9b)TDHr;{33}b1NlQ%&XZHcL0il
z-UL7&MZTM)Q#QKrYAjs+uI#c%WQ2s{{vS5CTmvrgKPukKnZ*xlfq|k<3O82G07_f@
zNC*aKd&|8RkcCg%uvV3pqG)25cqB2myfnMKt%IH=iDy8Sl$j%WKW#wZ`brIewK+Co
zbSw;H>%OQ(e?PXzIlXT*@kJil2y}9BXin|?F#Aryv+ddaL!<Yy&AgPK0=r=>8KgMp
zn+;tEE>{FAd_fcr!A`@9bGsCC!>Ysf4I*2jwy@mtQ9PUdhjs)jxj8m}Cz$hm>N~q;
ze^H-qfkTN#DEcday7xC%!~?b3Md+k*r7kQGc6f)v%armxaOJDpZC0UyhtZtKzDNL2
z``_)Uz;zOOZwm)jRKvgJ^g?JI^AMLbH)yr3VA=aks>;1xz%16>vU-4PLIHbZeZ(hM
zXubnPjjKV|%S1Vu;-`5i<J#iH?7_i>r(aLfj{@od!k)1S2nS=lu|7u#JShVhMw6Gu
zAc38JH<*17GO~(Xo$gh$_b@(V0t$so^e541#DmnycGMl8Uh&5-v^P8#XJ0kP3oo+$
z>t712q!j0Bsh6m~u_giPGNy<PNpAE*9`tfJ9e~jAXGsJ8t;%47syu0FhlBUkSEh5+
ziFyJ+lfW?7yZ(TFzpW&rFS_9<nC?P>*y@dYhXPMrGe6hqSY8nqV;<-l*jJ@;QM__p
z#o+9fnh%o6v=~;tQvpCYEMl#MG2_Dp<Haf9phxGQ1|#nX&!(+OV_>=!0O{>mAd-sp
z8%J;?(S(VlOrqDL(F?t7!MXmu4ggX7(ET2wN`J$>yLVLKi>0$V-TbV@qqp{FSDQb9
zyjsnH%m23%vm4#T$EB)0lauIHRt()M2lr9r3<m?p{3^PmwFDuq)n3q|ok#kg>^py#
t=l^N;Vt;1f$!YQ*WQ+Dce|P=YU5=*>xW}h@#<#!6Q2(OdW8{s{UjfdzpcnuE

literal 0
HcmV?d00001

diff --git a/litellm/main.py b/litellm/main.py
index 0553cf9d422..66d69e9fb52 100644
--- a/litellm/main.py
+++ b/litellm/main.py
@@ -1,3 +1,5 @@
+# LiteLLM main module: public completion, embedding, streaming, and moderation entrypoints.
+#
 # +-----------------------------------------------+
 # |                                               |
 # |           Give Feedback / Get Help            |
diff --git a/tests/test_litellm/test_main_module_header.py b/tests/test_litellm/test_main_module_header.py
new file mode 100644
index 00000000000..a16e14e8c32
--- /dev/null
+++ b/tests/test_litellm/test_main_module_header.py
@@ -0,0 +1,13 @@
+from pathlib import Path
+
+
+def test_main_py_starts_with_brief_file_description():
+    repo_root = Path(__file__).resolve().parents[2]
+    main_py = repo_root / "litellm" / "main.py"
+
+    first_two_lines = main_py.read_text(encoding="utf-8").splitlines()[:2]
+
+    assert any(
+        "LiteLLM main module" in line and "entrypoints" in line
+        for line in first_two_lines
+    )

From b631863b13abe81c8de78a0787f3520d52427215 Mon Sep 17 00:00:00 2001
From: oss-agent-shin <279349115+oss-agent-shin@users.noreply.github.com>
Date: Wed, 6 May 2026 00:42:49 +0000
Subject: [PATCH 19/33] Add utils module docstring

Co-authored-by: ishaan-berri <ishaan-berri@users.noreply.github.com>
---
 litellm/utils.py                                  |  2 ++
 tests/test_litellm/test_utils_module_docstring.py | 11 +++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 tests/test_litellm/test_utils_module_docstring.py

diff --git a/litellm/utils.py b/litellm/utils.py
index 019fbc2add8..5589852ce41 100644
--- a/litellm/utils.py
+++ b/litellm/utils.py
@@ -1,3 +1,5 @@
+"""Utility helpers for LiteLLM core request handling and provider support."""
+
 # from __future__ import annotations must be the first non-comment statement
 from __future__ import annotations
 
diff --git a/tests/test_litellm/test_utils_module_docstring.py b/tests/test_litellm/test_utils_module_docstring.py
new file mode 100644
index 00000000000..ac99fb63fd4
--- /dev/null
+++ b/tests/test_litellm/test_utils_module_docstring.py
@@ -0,0 +1,11 @@
+import ast
+from pathlib import Path
+
+
+def test_utils_module_has_docstring():
+    utils_path = Path(__file__).parents[2] / "litellm" / "utils.py"
+    module = ast.parse(utils_path.read_text())
+
+    assert ast.get_docstring(module) == (
+        "Utility helpers for LiteLLM core request handling and provider support."
+    )

From 158b0c28c02556a80bf5992ad750aacb9d40ba6f Mon Sep 17 00:00:00 2001
From: "oss-pr-review-agent-shin[bot]"
 <281797381+oss-pr-review-agent-shin[bot]@users.noreply.github.com>
Date: Thu, 7 May 2026 21:29:47 +0000
Subject: [PATCH 20/33] =?UTF-8?q?[litellm-agent]=20Staging=20=E2=86=92=20l?=
 =?UTF-8?q?itellm=5Finternal=5Fstaging=20(5/7/2026)=20(#27375)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Squash-merged by litellm-agent from oss-pr-review-agent-shin[bot]'s PR.
---
 .../mcp_server/discoverable_endpoints.py      |  79 ++----
 .../_experimental/mcp_server/oauth_utils.py   | 109 ++++++++-
 litellm/proxy/auth/handle_jwt.py              |  30 +++
 .../proxy/guardrails/guardrail_endpoints.py   |  20 +-
 .../proxy/guardrails/guardrail_registry.py    |  65 ++++-
 litellm/proxy/guardrails/init_guardrails.py   |   1 +
 .../health_endpoints/_health_endpoints.py     |  67 +++--
 .../tag_management_endpoints.py               |  51 +++-
 litellm/proxy/management_endpoints/ui_sso.py  |   4 +-
 litellm/proxy/proxy_server.py                 |  10 +
 .../mcp_server/test_byok_oauth_endpoints.py   |  66 +++++
 .../mcp_server/test_discoverable_endpoints.py |  69 +++++-
 .../proxy/auth/test_handle_jwt.py             |  71 +++++-
 .../guardrails/test_guardrail_endpoints.py    |  64 +++++
 .../guardrails/test_guardrail_registry.py     | 120 +++++++++
 .../health_endpoints/test_health_endpoints.py | 230 ++++++++++++++++++
 .../test_tag_management_endpoints.py          | 111 +++++++++
 .../UsagePage/components/UsagePageView.tsx    |  41 ++--
 .../src/components/model_info_view.test.tsx   |  27 ++
 .../src/components/model_info_view.tsx        |   6 +
 .../src/components/networking.tsx             |  21 +-
 .../components/templates/key_info_view.tsx    |   4 +-
 22 files changed, 1145 insertions(+), 121 deletions(-)

diff --git a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
index 1794cd14381..62691641234 100644
--- a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
+++ b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
@@ -12,7 +12,8 @@ from litellm.llms.custom_httpx.http_handler import (
 )
 from litellm.proxy._experimental.mcp_server.oauth_utils import (
     TOKEN_NO_CACHE_HEADERS,
-    validate_loopback_redirect_uri,
+    get_request_base_url,
+    validate_trusted_redirect_uri,
 )
 from litellm.proxy.auth.ip_address_utils import IPAddressUtils
 from litellm.proxy.common_utils.encrypt_decrypt_utils import (
@@ -29,51 +30,6 @@ router = APIRouter(
 )
 
 
-def get_request_base_url(request: Request) -> str:
-    """
-    Get the base URL for the request, considering X-Forwarded-* headers.
-
-    X-Forwarded-Proto / X-Forwarded-Host / X-Forwarded-Port are only honoured
-    when the request comes from a configured trusted proxy
-    (``use_x_forwarded_for`` enabled AND caller in ``mcp_trusted_proxy_ranges``).
-    Otherwise the request's literal ``base_url`` is returned, so an
-    untrusted caller cannot poison OAuth-discovery / redirect_uri values
-    by injecting headers.
-
-    Args:
-        request: FastAPI Request object
-
-    Returns:
-        The reconstructed base URL (e.g., "https://proxy.example.com")
-    """
-    base_url = str(request.base_url).rstrip("/")
-    parsed = urlparse(base_url)
-
-    if not IPAddressUtils.is_request_from_trusted_proxy(request):
-        return base_url
-
-    x_forwarded_proto = request.headers.get("X-Forwarded-Proto")
-    x_forwarded_host = request.headers.get("X-Forwarded-Host")
-    x_forwarded_port = request.headers.get("X-Forwarded-Port")
-
-    scheme = x_forwarded_proto if x_forwarded_proto else parsed.scheme
-
-    if x_forwarded_host:
-        # X-Forwarded-Host may already include port (e.g., "example.com:8080")
-        if ":" in x_forwarded_host and not x_forwarded_host.startswith("["):
-            netloc = x_forwarded_host
-        elif x_forwarded_port:
-            netloc = f"{x_forwarded_host}:{x_forwarded_port}"
-        else:
-            netloc = x_forwarded_host
-    else:
-        netloc = parsed.netloc
-        if x_forwarded_port and ":" not in netloc:
-            netloc = f"{netloc}:{x_forwarded_port}"
-
-    return urlunparse((scheme, netloc, parsed.path, "", "", ""))
-
-
 def encode_state_with_base_url(
     base_url: str,
     original_state: str,
@@ -127,12 +83,14 @@ def decode_state_hash(encrypted_state: str) -> dict:
     return state_data
 
 
-def _get_validated_client_redirect_uri(state_data: Dict[str, Any]) -> str:
-    """Return a loopback client redirect URI from OAuth state."""
+def _get_validated_client_redirect_uri(
+    request: Request, state_data: Dict[str, Any]
+) -> str:
+    """Return a trusted (same-origin or loopback) client redirect URI from OAuth state."""
     redirect_uri = state_data.get("client_redirect_uri") or state_data.get("base_url")
     if not redirect_uri or not isinstance(redirect_uri, str):
         raise HTTPException(status_code=400, detail="Invalid redirect URI")
-    validate_loopback_redirect_uri(redirect_uri)
+    validate_trusted_redirect_uri(request, redirect_uri)
     return redirect_uri
 
 
@@ -338,12 +296,12 @@ async def authorize_with_server(
             status_code=400, detail="MCP server authorization url is not set"
         )
 
-    # Loopback-only redirect_uri. The URI is encrypted into the OAuth
-    # state and decoded on /callback to redirect the user back; a non-
-    # loopback URI would be an open-redirect + code-theft primitive
-    # (VERIA-57 root cause B). MCP clients are native apps — loopback is
-    # the spec-compliant callback pattern.
-    validate_loopback_redirect_uri(redirect_uri)
+    # Loopback OR same-origin redirect_uri. The URI is encrypted into the
+    # OAuth state and decoded on /callback to redirect the user back;
+    # restricting to trusted origins blocks the open-redirect +
+    # code-theft primitive (VERIA-57 root cause B). Loopback supports
+    # native MCP clients; same-origin supports the proxy's own UI callback.
+    validate_trusted_redirect_uri(request, redirect_uri)
     parsed = urlparse(redirect_uri)
     base_url = urlunparse(parsed._replace(query=""))
     request_base_url = get_request_base_url(request)
@@ -660,17 +618,18 @@ async def token_endpoint(
 
 
 @router.get("/callback")
-async def callback(code: str, state: str):
+async def callback(request: Request, code: str, state: str):
     try:
         state_data = decode_state_hash(state)
         original_state = state_data["original_state"]
 
-        # Re-validate loopback at the sink. /authorize rejects non-loopback
+        # Re-validate at the sink. /authorize rejects untrusted
         # redirect_uri before encoding into state, but encrypted states
         # minted before that check was added have no expiry and remain
-        # valid indefinitely. Validating here blocks the open-redirect +
-        # code-theft primitive even for pre-fix states.
-        redirect_uri = _get_validated_client_redirect_uri(state_data)
+        # valid indefinitely. Validating here (same-origin OR loopback)
+        # blocks the open-redirect + code-theft primitive even for pre-fix
+        # states while allowing the UI's same-origin callback to work.
+        redirect_uri = _get_validated_client_redirect_uri(request, state_data)
 
         params = {"code": code, "state": original_state}
         complete_returned_url = _append_query_params(redirect_uri, params)
diff --git a/litellm/proxy/_experimental/mcp_server/oauth_utils.py b/litellm/proxy/_experimental/mcp_server/oauth_utils.py
index b13cf83058c..343d1bee613 100644
--- a/litellm/proxy/_experimental/mcp_server/oauth_utils.py
+++ b/litellm/proxy/_experimental/mcp_server/oauth_utils.py
@@ -2,15 +2,63 @@
 (BYOK + discoverable / pass-through OAuth proxy)."""
 
 from ipaddress import ip_address
-from urllib.parse import urlparse
+from urllib.parse import urlparse, urlunparse
 
-from fastapi import HTTPException
+from fastapi import HTTPException, Request
+
+from litellm._logging import verbose_logger
+from litellm.proxy.auth.ip_address_utils import IPAddressUtils
 
 # RFC 6749 §5.1 / OAuth 2.1 draft-15 §4.1.3: token-endpoint responses
 # must not be cached — both success and error bodies may reveal secrets.
 TOKEN_NO_CACHE_HEADERS = {"Cache-Control": "no-store", "Pragma": "no-cache"}
 
 
+def get_request_base_url(request: Request) -> str:
+    """
+    Get the base URL for the request, considering X-Forwarded-* headers.
+
+    X-Forwarded-Proto / X-Forwarded-Host / X-Forwarded-Port are only honoured
+    when the request comes from a configured trusted proxy
+    (``use_x_forwarded_for`` enabled AND caller in ``mcp_trusted_proxy_ranges``).
+    Otherwise the request's literal ``base_url`` is returned, so an
+    untrusted caller cannot poison OAuth-discovery / redirect_uri values
+    by injecting headers.
+
+    Args:
+        request: FastAPI Request object
+
+    Returns:
+        The reconstructed base URL (e.g., "https://proxy.example.com")
+    """
+    base_url = str(request.base_url).rstrip("/")
+    parsed = urlparse(base_url)
+
+    if not IPAddressUtils.is_request_from_trusted_proxy(request):
+        return base_url
+
+    x_forwarded_proto = request.headers.get("X-Forwarded-Proto")
+    x_forwarded_host = request.headers.get("X-Forwarded-Host")
+    x_forwarded_port = request.headers.get("X-Forwarded-Port")
+
+    scheme = x_forwarded_proto if x_forwarded_proto else parsed.scheme
+
+    if x_forwarded_host:
+        # X-Forwarded-Host may already include port (e.g., "example.com:8080")
+        if ":" in x_forwarded_host and not x_forwarded_host.startswith("["):
+            netloc = x_forwarded_host
+        elif x_forwarded_port:
+            netloc = f"{x_forwarded_host}:{x_forwarded_port}"
+        else:
+            netloc = x_forwarded_host
+    else:
+        netloc = parsed.netloc
+        if x_forwarded_port and ":" not in netloc:
+            netloc = f"{netloc}:{x_forwarded_port}"
+
+    return urlunparse((scheme, netloc, parsed.path, "", "", ""))
+
+
 def validate_loopback_redirect_uri(redirect_uri: str) -> None:
     """Require a loopback ``redirect_uri`` (OAuth 2.1 §4.1.2.1 + RFC 8252
     §7.3 native-app pattern). MCP clients are native apps that listen on
@@ -46,3 +94,60 @@ def validate_loopback_redirect_uri(redirect_uri: str) -> None:
         # don't let it bubble up as a 500.
         pass
     raise HTTPException(status_code=400, detail="invalid_request")
+
+
+def validate_trusted_redirect_uri(request: Request, redirect_uri: str) -> None:
+    """Accept same-origin (proxy's own origin) OR loopback ``redirect_uri``.
+
+    Same-origin is required for the LiteLLM UI's OAuth flow: the UI
+    redirects to ``<proxy>/ui/mcp/oauth/callback`` which is not loopback
+    but is on the proxy's own trusted HTTPS origin. An attacker cannot
+    host content on the proxy's own origin without already owning the
+    proxy, so the open-redirect / code-theft primitive that motivated
+    :func:`validate_loopback_redirect_uri` does not apply here.
+
+    Loopback continues to be accepted for native MCP clients (per
+    OAuth 2.1 §4.1.2.1 + RFC 8252 §7.3).
+
+    Use this in the discoverable OAuth proxy endpoints that serve both
+    native clients and the proxy's own UI. BYOK endpoints that only
+    support native clients should keep
+    :func:`validate_loopback_redirect_uri`.
+    """
+    try:
+        parsed = urlparse(redirect_uri)
+    except ValueError:
+        raise HTTPException(status_code=400, detail="invalid_request")
+    if parsed.scheme not in ("http", "https"):
+        raise HTTPException(status_code=400, detail="invalid_request")
+    if parsed.fragment:
+        raise HTTPException(status_code=400, detail="invalid_request")
+
+    # Same-origin: scheme + netloc (host[:port]) must match the proxy's
+    # own base URL at this request (honouring trusted X-Forwarded-*).
+    try:
+        proxy_base = urlparse(get_request_base_url(request))
+        if (
+            parsed.netloc
+            and parsed.scheme == proxy_base.scheme
+            and parsed.netloc.lower() == proxy_base.netloc.lower()
+        ):
+            return
+    except Exception as exc:
+        # If we can't determine the proxy's origin, fall through to
+        # loopback. Log so the failure is diagnosable in production.
+        verbose_logger.warning(
+            "validate_trusted_redirect_uri: could not determine proxy origin, "
+            "falling back to loopback-only check. error=%s",
+            exc,
+        )
+
+    host = (parsed.hostname or "").lower()
+    if host == "localhost":
+        return
+    try:
+        if ip_address(host).is_loopback:
+            return
+    except ValueError:
+        pass
+    raise HTTPException(status_code=400, detail="invalid_request")
diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py
index d1fd5818f35..a270031c33c 100644
--- a/litellm/proxy/auth/handle_jwt.py
+++ b/litellm/proxy/auth/handle_jwt.py
@@ -224,6 +224,36 @@ class JWTHandler:
 
         return []
 
+    def get_all_jwt_team_ids(self, token: dict) -> List[str]:
+        """
+        Return team IDs from both the plural ``team_ids_jwt_field`` and the
+        singular ``team_id_jwt_field`` claim, as a deduplicated list preserving
+        plural-first order.
+
+        Membership-reconciliation paths (SSO callback, JWT-bearer sync) need
+        to consider both claim shapes. Reading only the plural field — as
+        callers historically did — silently dropped users whose IdP populates
+        the singular field, which is what Okta and Auth0 default to when a
+        user has a single primary team.
+
+        This intentionally does NOT consult ``team_id_default``: that fallback
+        is a property of how the JWT-bearer auth flow resolves a single
+        request-bound team, not of the token's claims. Callers that want the
+        default-team behavior should still go through ``get_team_id``.
+        """
+        team_ids: List[str] = list(self.get_team_ids_from_jwt(token))
+        if self.litellm_jwtauth.team_id_jwt_field is not None:
+            singular = get_nested_value(
+                data=token,
+                key_path=self.litellm_jwtauth.team_id_jwt_field,
+                default=None,
+            )
+            if isinstance(singular, list):
+                singular = singular[0] if singular else None
+            if singular and singular not in team_ids:
+                team_ids.append(singular)
+        return team_ids
+
     def get_end_user_id(
         self, token: dict, default_value: Optional[str]
     ) -> Optional[str]:
diff --git a/litellm/proxy/guardrails/guardrail_endpoints.py b/litellm/proxy/guardrails/guardrail_endpoints.py
index 5351391e5e1..e55f3b6e16b 100644
--- a/litellm/proxy/guardrails/guardrail_endpoints.py
+++ b/litellm/proxy/guardrails/guardrail_endpoints.py
@@ -242,6 +242,10 @@ async def list_guardrails_v2(
             gid = guardrail.get("guardrail_id")
             if gid in seen_guardrail_ids:
                 continue
+            # Skip stale DB-backed entries — the DB row was deleted (likely by
+            # another pod) and reconciliation hasn't fired yet on this pod.
+            if gid is not None and IN_MEMORY_GUARDRAIL_HANDLER.get_source(gid) == "db":
+                continue
             if not is_admin:
                 g_team_id = guardrail.get("team_id")
                 if g_team_id is not None and g_team_id not in caller_team_ids:
@@ -360,7 +364,7 @@ async def create_guardrail(
 
         try:
             IN_MEMORY_GUARDRAIL_HANDLER.initialize_guardrail(
-                guardrail=cast(Guardrail, result)
+                guardrail=cast(Guardrail, result), source="db"
             )
             verbose_proxy_logger.info(
                 f"Immediate sync: Successfully initialized guardrail '{guardrail_name}' (ID: {guardrail_id})"
@@ -1017,7 +1021,7 @@ async def approve_guardrail_submission(
         }
         try:
             IN_MEMORY_GUARDRAIL_HANDLER.initialize_guardrail(
-                guardrail=cast(Guardrail, guardrail_dict)
+                guardrail=cast(Guardrail, guardrail_dict), source="db"
             )
             verbose_proxy_logger.info(
                 "Approved guardrail %s (ID: %s) and initialized in memory",
@@ -1295,10 +1299,18 @@ async def get_guardrail_info(guardrail_id: str):
             guardrail_id=guardrail_id, prisma_client=prisma_client
         )
         if result is None:
-            result = IN_MEMORY_GUARDRAIL_HANDLER.get_guardrail_by_id(
+            in_memory = IN_MEMORY_GUARDRAIL_HANDLER.get_guardrail_by_id(
                 guardrail_id=guardrail_id
             )
-            guardrail_definition_location = GUARDRAIL_DEFINITION_LOCATION.CONFIG
+            # Only return config-loaded entries here. A DB-backed entry that's
+            # missing from the DB is stale (deleted on another pod, awaiting
+            # reconciliation on this one) and must surface as 404.
+            if (
+                in_memory is not None
+                and IN_MEMORY_GUARDRAIL_HANDLER.get_source(guardrail_id) == "config"
+            ):
+                result = in_memory
+                guardrail_definition_location = GUARDRAIL_DEFINITION_LOCATION.CONFIG
 
         if result is None:
             raise HTTPException(
diff --git a/litellm/proxy/guardrails/guardrail_registry.py b/litellm/proxy/guardrails/guardrail_registry.py
index 868b23756d2..3aa612c761e 100644
--- a/litellm/proxy/guardrails/guardrail_registry.py
+++ b/litellm/proxy/guardrails/guardrail_registry.py
@@ -3,7 +3,7 @@
 import importlib
 import os
 from datetime import datetime, timezone
-from typing import Any, Dict, List, Optional, Type, cast
+from typing import Any, Dict, List, Literal, Optional, Set, Type, cast
 
 import litellm
 from litellm import Router
@@ -403,11 +403,19 @@ class InMemoryGuardrailHandler:
         Guardrail id to CustomGuardrail object mapping
         """
 
+        self._sources: Dict[str, Literal["db", "config"]] = {}
+        """
+        Guardrail id to provenance marker. "db" entries are reconciled against
+        the DB on each polling tick; "config" entries are owned by proxy_config.yaml
+        and never deleted by reconciliation.
+        """
+
     def initialize_guardrail(
         self,
         guardrail: Guardrail,
         config_file_path: Optional[str] = None,
         llm_router: Optional["Router"] = None,
+        source: Literal["db", "config"] = "config",
     ) -> Optional[Guardrail]:
         """
         Initialize a guardrail from a dictionary and add it to the litellm callback manager
@@ -420,6 +428,10 @@ class InMemoryGuardrailHandler:
             verbose_proxy_logger.debug(
                 "guardrail_id already exists in IN_MEMORY_GUARDRAILS"
             )
+            # Honor the caller's source even on the early-return path so a
+            # racing polling tick or a hot-reload of config can correct an
+            # entry's provenance.
+            self._sources[guardrail_id] = source
             return self.IN_MEMORY_GUARDRAILS[guardrail_id]
 
         custom_guardrail_callback: Optional[CustomGuardrail] = None
@@ -492,6 +504,7 @@ class InMemoryGuardrailHandler:
         # store references to the guardrail in memory
         self.IN_MEMORY_GUARDRAILS[guardrail_id] = parsed_guardrail
         self.guardrail_id_to_custom_guardrail[guardrail_id] = custom_guardrail_callback
+        self._sources[guardrail_id] = source
 
         return parsed_guardrail
 
@@ -552,7 +565,10 @@ class InMemoryGuardrailHandler:
         return _guardrail_callback
 
     def update_in_memory_guardrail(
-        self, guardrail_id: str, guardrail: Guardrail
+        self,
+        guardrail_id: str,
+        guardrail: Guardrail,
+        source: Literal["db", "config"] = "db",
     ) -> None:
         """
         Update a guardrail in memory
@@ -561,6 +577,7 @@ class InMemoryGuardrailHandler:
         - updates the guardrail params in litellm.callback_manager
         """
         self.IN_MEMORY_GUARDRAILS[guardrail_id] = guardrail
+        self._sources[guardrail_id] = source
 
         custom_guardrail_callback = self.guardrail_id_to_custom_guardrail.get(
             guardrail_id
@@ -579,6 +596,7 @@ class InMemoryGuardrailHandler:
         """
         # Remove from in-memory storage
         self.IN_MEMORY_GUARDRAILS.pop(guardrail_id, None)
+        self._sources.pop(guardrail_id, None)
 
         # Remove the callback from litellm.callbacks
         custom_guardrail_callback = self.guardrail_id_to_custom_guardrail.pop(
@@ -603,6 +621,34 @@ class InMemoryGuardrailHandler:
         """
         return self.IN_MEMORY_GUARDRAILS.get(guardrail_id)
 
+    def get_source(self, guardrail_id: str) -> Optional[Literal["db", "config"]]:
+        """
+        Return the provenance of an in-memory guardrail.
+        """
+        return self._sources.get(guardrail_id)
+
+    def reconcile_db_guardrails(self, db_guardrail_ids: Set[str]) -> List[str]:
+        """
+        Drop in-memory entries that originated from the DB but are no longer
+        present in db_guardrail_ids. Config-loaded guardrails are never touched.
+
+        Called by the periodic DB polling tick so that a guardrail deleted
+        on another pod is eventually purged from this pod's memory + callbacks.
+        """
+        stale_ids = [
+            guardrail_id
+            for guardrail_id, source in self._sources.items()
+            if source == "db" and guardrail_id not in db_guardrail_ids
+        ]
+        for guardrail_id in stale_ids:
+            verbose_proxy_logger.info(
+                "Reconcile: removing stale DB-backed guardrail '%s' from memory "
+                "(deleted in DB by another pod)",
+                guardrail_id,
+            )
+            self.delete_in_memory_guardrail(guardrail_id)
+        return stale_ids
+
     def _has_guardrail_params_changed(
         self, guardrail_id: str, new_guardrail: Guardrail
     ) -> bool:
@@ -656,7 +702,10 @@ class InMemoryGuardrailHandler:
         return len(changed_fields) > 0
 
     def reinitialize_guardrail(
-        self, guardrail: Guardrail, config_file_path: Optional[str] = None
+        self,
+        guardrail: Guardrail,
+        config_file_path: Optional[str] = None,
+        source: Literal["db", "config"] = "config",
     ) -> Optional[Guardrail]:
         """
         Force re-initialization of a guardrail even if it exists in memory.
@@ -675,7 +724,7 @@ class InMemoryGuardrailHandler:
 
         # Initialize fresh (will add new callback to litellm.callbacks)
         return self.initialize_guardrail(
-            guardrail=guardrail, config_file_path=config_file_path
+            guardrail=guardrail, config_file_path=config_file_path, source=source
         )
 
     def sync_guardrail_from_db(
@@ -696,9 +745,15 @@ class InMemoryGuardrailHandler:
                 f"Guardrail '{guardrail_name}' (ID: {guardrail_id}) params changed, re-initializing..."
             )
             return self.reinitialize_guardrail(
-                guardrail=guardrail, config_file_path=config_file_path
+                guardrail=guardrail,
+                config_file_path=config_file_path,
+                source="db",
             )
 
+        # Params unchanged but the entry is still DB-backed; make sure the
+        # source marker reflects that even if it was previously set differently
+        # (e.g. a config entry whose UUID later collided with a DB row).
+        self._sources[guardrail_id] = "db"
         return self.IN_MEMORY_GUARDRAILS.get(guardrail_id)
 
 
diff --git a/litellm/proxy/guardrails/init_guardrails.py b/litellm/proxy/guardrails/init_guardrails.py
index d742cc223b4..83f1281dc02 100644
--- a/litellm/proxy/guardrails/init_guardrails.py
+++ b/litellm/proxy/guardrails/init_guardrails.py
@@ -30,6 +30,7 @@ def init_guardrails_v2(
             guardrail=cast(Guardrail, guardrail),
             config_file_path=config_file_path,
             llm_router=llm_router,
+            source="config",
         )
         if initialized_guardrail:
             guardrail_list.append(initialized_guardrail)
diff --git a/litellm/proxy/health_endpoints/_health_endpoints.py b/litellm/proxy/health_endpoints/_health_endpoints.py
index 096e23e673d..2c857c0fde8 100644
--- a/litellm/proxy/health_endpoints/_health_endpoints.py
+++ b/litellm/proxy/health_endpoints/_health_endpoints.py
@@ -1742,29 +1742,54 @@ async def test_model_connection(
         # Look up model configuration from router if model name is provided
         # This gets the litellm_params from proxy config (with resolved env vars)
         config_litellm_params: dict = {}
-        if model_name and llm_router is not None:
+        if llm_router is not None:
+            # Prefer disambiguation by deployment id (`model_info.id`) when
+            # the caller supplies it. This is required when multiple
+            # deployments share a `model_name` (e.g. wildcard `openai/*`
+            # with multiple `api_base` values for failover): the UI's
+            # "Test Connection" button targets a specific row, and that
+            # row's id is the only thing that uniquely identifies which
+            # deployment to probe. Without this, all duplicates collapse
+            # onto `deployments[0]`.
+            request_model_info = model_info or {}
+            request_model_id = request_model_info.get("id")
             try:
-                # First try to find by proxy model_name (e.g., "gpt-4o")
-                deployments = llm_router.get_model_list(model_name=model_name)
-
-                # If not found, try to find by litellm model name (e.g., "azure/gpt-4o")
-                if not deployments or len(deployments) == 0:
-                    all_deployments = llm_router.get_model_list(model_name=None)
-                    if all_deployments:
-                        for deployment in all_deployments:
-                            if (
-                                deployment.get("litellm_params", {}).get("model")
-                                == model_name
-                            ):
-                                deployments = [deployment]
-                                break
-
-                if deployments and len(deployments) > 0:
-                    # Use the first deployment's litellm_params as base config
-                    # These already have resolved environment variables from proxy config
-                    config_litellm_params = dict(
-                        deployments[0].get("litellm_params", {})
+                deployment_by_id = None
+                if request_model_id:
+                    deployment_by_id = llm_router.get_deployment(
+                        model_id=request_model_id
                     )
+
+                if deployment_by_id is not None:
+                    config_litellm_params = deployment_by_id.litellm_params.model_dump(
+                        exclude_none=True
+                    )
+                elif model_name:
+                    # Fall back to model_name lookup for callers (e.g. the
+                    # "Add Model" wizard, or curl) that don't supply an id.
+                    # First try to find by proxy model_name (e.g., "gpt-4o")
+                    deployments = llm_router.get_model_list(model_name=model_name)
+
+                    # If not found, try to find by litellm model name
+                    # (e.g., "azure/gpt-4o")
+                    if not deployments or len(deployments) == 0:
+                        all_deployments = llm_router.get_model_list(model_name=None)
+                        if all_deployments:
+                            for deployment in all_deployments:
+                                if (
+                                    deployment.get("litellm_params", {}).get("model")
+                                    == model_name
+                                ):
+                                    deployments = [deployment]
+                                    break
+
+                    if deployments and len(deployments) > 0:
+                        # Use the first deployment's litellm_params as base
+                        # config. These already have resolved environment
+                        # variables from proxy config.
+                        config_litellm_params = dict(
+                            deployments[0].get("litellm_params", {})
+                        )
             except Exception as e:
                 verbose_proxy_logger.debug(
                     f"Could not find model {model_name} in router: {e}. "
diff --git a/litellm/proxy/management_endpoints/tag_management_endpoints.py b/litellm/proxy/management_endpoints/tag_management_endpoints.py
index 0e60820aab1..2a4895d0299 100644
--- a/litellm/proxy/management_endpoints/tag_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/tag_management_endpoints.py
@@ -12,9 +12,10 @@ All /tag management endpoints
 
 import asyncio
 import json
-from typing import TYPE_CHECKING, Dict, List, Optional
+from datetime import datetime
+from typing import TYPE_CHECKING, Any, Dict, List, Optional
 
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Query
 
 from litellm._logging import verbose_proxy_logger
 from litellm.proxy._types import UserAPIKeyAuth
@@ -395,6 +396,32 @@ async def info_tag(
         raise HTTPException(status_code=500, detail=str(e))
 
 
+def _validate_tag_list_date_range(
+    start_date: Optional[str], end_date: Optional[str]
+) -> None:
+    """Require both dates together, and enforce YYYY-MM-DD format with start <= end."""
+    if (start_date is None) != (end_date is None):
+        raise HTTPException(
+            status_code=400,
+            detail="start_date and end_date must be provided together",
+        )
+    if start_date is None:
+        return
+    try:
+        start = datetime.strptime(start_date, "%Y-%m-%d")
+        end = datetime.strptime(end_date, "%Y-%m-%d")  # type: ignore[arg-type]
+    except ValueError as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Invalid date format, expected YYYY-MM-DD: {e}",
+        )
+    if start > end:
+        raise HTTPException(
+            status_code=400,
+            detail="start_date must be on or before end_date",
+        )
+
+
 @router.get(
     "/tag/list",
     tags=["tag management"],
@@ -402,6 +429,18 @@ async def info_tag(
 )
 async def list_tags(
     user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
+    start_date: Optional[str] = Query(
+        None,
+        description=(
+            "Optional start date (YYYY-MM-DD). When provided together with "
+            "end_date, dynamic tags are limited to those active in the window. "
+            "Stored tags are always returned."
+        ),
+    ),
+    end_date: Optional[str] = Query(
+        None,
+        description="Optional end date (YYYY-MM-DD). Must be given with start_date.",
+    ),
 ):
     """
     List all available tags with their budget information.
@@ -411,6 +450,8 @@ async def list_tags(
     if prisma_client is None:
         raise HTTPException(status_code=500, detail="Database not connected")
 
+    _validate_tag_list_date_range(start_date, end_date)
+
     try:
         ## QUERY STORED TAGS ##
         tag_records = await prisma_client.db.litellm_tagtable.find_many(
@@ -453,9 +494,13 @@ async def list_tags(
         # Prisma's distinct fetches all columns for all rows and deduplicates
         # in application code, which is extremely slow on large tables.
         # See: https://www.prisma.io/docs/orm/prisma-client/queries/aggregation-grouping-summarizing#distinct-under-the-hood
+        dynamic_tag_where: Dict[str, Any] = {"tag": {"not": None}}
+        if start_date is not None and end_date is not None:
+            dynamic_tag_where["date"] = {"gte": start_date, "lte": end_date}
+
         dynamic_tag_rows = await prisma_client.db.litellm_dailytagspend.group_by(
             by=["tag"],
-            where={"tag": {"not": None}},
+            where=dynamic_tag_where,
             min={"created_at": True},
             max={"updated_at": True},
         )
diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py
index 74ee7c7220d..ea629f24485 100644
--- a/litellm/proxy/management_endpoints/ui_sso.py
+++ b/litellm/proxy/management_endpoints/ui_sso.py
@@ -740,7 +740,7 @@ def generic_response_convertor(
 
     all_teams = []
     if sso_jwt_handler is not None:
-        team_ids = sso_jwt_handler.get_team_ids_from_jwt(cast(dict, response))
+        team_ids = sso_jwt_handler.get_all_jwt_team_ids(cast(dict, response))
         all_teams.extend(team_ids)
 
     if team_mappings is not None and team_mappings.team_ids_jwt_field is not None:
@@ -755,7 +755,7 @@ def generic_response_convertor(
                 f"Loaded team_ids from DB team_mappings.team_ids_jwt_field='{team_mappings.team_ids_jwt_field}': {team_ids_from_db_mapping}"
             )
     else:
-        team_ids = jwt_handler.get_team_ids_from_jwt(cast(dict, response))
+        team_ids = jwt_handler.get_all_jwt_team_ids(cast(dict, response))
         all_teams.extend(team_ids)
 
     # Determine user role based on role_mappings if available
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index c96d0acb008..f0b3faa7267 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -5936,10 +5936,20 @@ class ProxyConfig:
             verbose_proxy_logger.debug(
                 "guardrails from the DB %s", str(guardrails_in_db)
             )
+            db_guardrail_ids: set = set()
             for guardrail in guardrails_in_db:
+                guardrail_id = guardrail.get("guardrail_id")
+                if guardrail_id:
+                    db_guardrail_ids.add(guardrail_id)
                 IN_MEMORY_GUARDRAIL_HANDLER.sync_guardrail_from_db(
                     guardrail=cast(Guardrail, guardrail),
                 )
+
+            # Drop in-memory DB-backed entries whose row was deleted on another
+            # pod. Config-loaded entries are never touched.
+            IN_MEMORY_GUARDRAIL_HANDLER.reconcile_db_guardrails(
+                db_guardrail_ids=db_guardrail_ids
+            )
         except Exception as e:
             verbose_proxy_logger.exception(
                 "litellm.proxy.proxy_server.py::ProxyConfig:_init_guardrails_in_db - {}".format(
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_byok_oauth_endpoints.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_byok_oauth_endpoints.py
index 89992c510f5..9f004318488 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_byok_oauth_endpoints.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_byok_oauth_endpoints.py
@@ -1135,3 +1135,69 @@ def test_validate_loopback_redirect_uri_rejects_malformed_cleanly():
     with pytest.raises(HTTPException) as exc:
         validate_loopback_redirect_uri("http://[not-an-ip]/cb")
     assert exc.value.status_code == 400
+
+
+def _mock_request_with_base_url(base_url: str):
+    req = MagicMock()
+    req.base_url = base_url
+    req.headers = {}
+    return req
+
+
+def test_validate_trusted_redirect_uri_accepts_same_origin():
+    """UI OAuth flow: redirect_uri on the proxy's own origin is allowed."""
+    from litellm.proxy._experimental.mcp_server.oauth_utils import (
+        validate_trusted_redirect_uri,
+    )
+
+    req = _mock_request_with_base_url("https://proxy.example.com/")
+    # Should not raise.
+    validate_trusted_redirect_uri(
+        req, "https://proxy.example.com/ui/mcp/oauth/callback"
+    )
+
+
+def test_validate_trusted_redirect_uri_accepts_loopback():
+    """Native MCP client flow: loopback is still allowed."""
+    from litellm.proxy._experimental.mcp_server.oauth_utils import (
+        validate_trusted_redirect_uri,
+    )
+
+    req = _mock_request_with_base_url("https://proxy.example.com/")
+    validate_trusted_redirect_uri(req, "http://127.0.0.1:3000/cb")
+    validate_trusted_redirect_uri(req, "http://localhost:3000/cb")
+
+
+def test_validate_trusted_redirect_uri_rejects_external_origin():
+    """An attacker-controlled origin must still be rejected."""
+    from litellm.proxy._experimental.mcp_server.oauth_utils import (
+        validate_trusted_redirect_uri,
+    )
+
+    req = _mock_request_with_base_url("https://proxy.example.com/")
+    with pytest.raises(HTTPException) as exc:
+        validate_trusted_redirect_uri(req, "https://attacker.example.com/cb")
+    assert exc.value.status_code == 400
+
+
+def test_validate_trusted_redirect_uri_rejects_scheme_mismatch():
+    """https→http (or vice versa) on the same host is not same-origin."""
+    from litellm.proxy._experimental.mcp_server.oauth_utils import (
+        validate_trusted_redirect_uri,
+    )
+
+    req = _mock_request_with_base_url("https://proxy.example.com/")
+    with pytest.raises(HTTPException) as exc:
+        validate_trusted_redirect_uri(req, "http://proxy.example.com/ui/callback")
+    assert exc.value.status_code == 400
+
+
+def test_validate_trusted_redirect_uri_rejects_fragment():
+    from litellm.proxy._experimental.mcp_server.oauth_utils import (
+        validate_trusted_redirect_uri,
+    )
+
+    req = _mock_request_with_base_url("https://proxy.example.com/")
+    with pytest.raises(HTTPException) as exc:
+        validate_trusted_redirect_uri(req, "https://proxy.example.com/ui/cb#code=1")
+    assert exc.value.status_code == 400
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
index 85d5d6ba466..581324d47d2 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
@@ -23,6 +23,20 @@ def mock_mcp_client_ip():
         yield
 
 
+def _mock_callback_request(base_url: str = "http://localhost:3000/"):
+    """Return a MagicMock Request for callback/authorize same-origin tests.
+
+    The callback handler only uses ``request`` to compute the proxy's own
+    base URL via ``get_request_base_url`` (which reads ``request.base_url``
+    and trusted ``X-Forwarded-*`` headers). A simple MagicMock with the
+    right attributes is sufficient.
+    """
+    req = MagicMock()
+    req.base_url = base_url
+    req.headers = {}
+    return req
+
+
 @pytest.fixture
 def trust_xff():
     """Force ``IPAddressUtils.is_request_from_trusted_proxy`` to True.
@@ -1844,6 +1858,7 @@ async def test_oauth_callback_redirects_with_state():
 
         # Call callback endpoint with code and state
         response = await callback(
+            request=_mock_callback_request(),
             code="test_authorization_code_12345",
             state="encrypted_state_value",
         )
@@ -1887,6 +1902,7 @@ async def test_oauth_callback_preserves_client_redirect_uri_query():
         }
 
         response = await callback(
+            request=_mock_callback_request(),
             code="test_authorization_code_12345",
             state="encrypted_state_value",
         )
@@ -1917,6 +1933,7 @@ async def test_oauth_callback_handles_invalid_state():
 
         # Call callback endpoint with invalid state
         response = await callback(
+            request=_mock_callback_request(),
             code="test_code",
             state="invalid_encrypted_state",
         )
@@ -1926,6 +1943,40 @@ async def test_oauth_callback_handles_invalid_state():
         assert "Authentication incomplete" in response.body.decode()
 
 
+@pytest.mark.asyncio
+async def test_oauth_callback_accepts_same_origin_ui_redirect():
+    """UI OAuth flow: the callback should redirect to the proxy's own UI
+    origin when the encrypted state carries a same-origin client_redirect_uri."""
+    from litellm.proxy._experimental.mcp_server.discoverable_endpoints import (
+        callback,
+    )
+
+    with patch(
+        "litellm.proxy._experimental.mcp_server.discoverable_endpoints.decode_state_hash"
+    ) as mock_decode:
+        mock_decode.return_value = {
+            "base_url": "https://proxy.example.com/ui/mcp/oauth/callback",
+            "original_state": "state-123",
+            "code_challenge": None,
+            "code_challenge_method": None,
+            "client_redirect_uri": "https://proxy.example.com/ui/mcp/oauth/callback",
+        }
+
+        response = await callback(
+            request=_mock_callback_request(base_url="https://proxy.example.com/"),
+            code="auth-code-123",
+            state="encrypted_state",
+        )
+
+    assert response.status_code == 302
+    assert (
+        "https://proxy.example.com/ui/mcp/oauth/callback"
+        in response.headers["location"]
+    )
+    assert "code=auth-code-123" in response.headers["location"]
+    assert "state=state-123" in response.headers["location"]
+
+
 @pytest.mark.asyncio
 async def test_oauth_authorize_includes_scopes_from_server_config():
     """Test that authorize endpoint includes scopes from server configuration."""
@@ -2307,7 +2358,11 @@ async def test_callback_revalidates_loopback_on_decoded_base_url():
             "client_redirect_uri": "https://attacker.example.com/cb",
         }
         with pytest.raises(HTTPException) as exc_info:
-            await callback(code="stolen_code", state="encrypted_stale_state")
+            await callback(
+                request=_mock_callback_request(),
+                code="stolen_code",
+                state="encrypted_stale_state",
+            )
         assert exc_info.value.status_code == 400
 
 
@@ -2329,7 +2384,11 @@ async def test_callback_revalidates_loopback_on_decoded_client_redirect_uri():
             "client_redirect_uri": "https://attacker.example.com/cb",
         }
         with pytest.raises(HTTPException) as exc_info:
-            await callback(code="stolen_code", state="encrypted_stale_state")
+            await callback(
+                request=_mock_callback_request(),
+                code="stolen_code",
+                state="encrypted_stale_state",
+            )
         assert exc_info.value.status_code == 400
 
 
@@ -2349,7 +2408,11 @@ async def test_callback_rejects_state_missing_redirect_uri():
             "code_challenge_method": None,
         }
         with pytest.raises(HTTPException) as exc_info:
-            await callback(code="code", state="encrypted_malformed_state")
+            await callback(
+                request=_mock_callback_request(),
+                code="code",
+                state="encrypted_malformed_state",
+            )
         assert exc_info.value.status_code == 400
 
 
diff --git a/tests/test_litellm/proxy/auth/test_handle_jwt.py b/tests/test_litellm/proxy/auth/test_handle_jwt.py
index b7dba9c1d16..c09c303deee 100644
--- a/tests/test_litellm/proxy/auth/test_handle_jwt.py
+++ b/tests/test_litellm/proxy/auth/test_handle_jwt.py
@@ -1,5 +1,5 @@
 from typing import Optional
-from unittest.mock import AsyncMock, patch
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 
@@ -494,6 +494,75 @@ async def test_sync_user_role_and_teams_no_cache_write_when_nothing_changes():
     mock_cache.async_set_cache.assert_not_called()
 
 
+def test_get_all_jwt_team_ids_unions_singular_and_plural():
+    """get_all_jwt_team_ids must include the singular team_id_jwt_field claim
+    in addition to the plural team_ids_jwt_field, deduplicated."""
+    jwt_handler = JWTHandler()
+    jwt_handler.update_environment(
+        prisma_client=None,
+        user_api_key_cache=MagicMock(),
+        litellm_jwtauth=LiteLLM_JWTAuth(
+            team_id_jwt_field="team_id",
+            team_ids_jwt_field="teams",
+        ),
+    )
+
+    # singular only — Okta/Auth0 default shape
+    assert jwt_handler.get_all_jwt_team_ids({"team_id": "team-low"}) == ["team-low"]
+
+    # plural only — pre-fix shape
+    assert jwt_handler.get_all_jwt_team_ids({"teams": ["a", "b"]}) == ["a", "b"]
+
+    # both populated, no overlap
+    assert jwt_handler.get_all_jwt_team_ids(
+        {"team_id": "primary", "teams": ["a", "b"]}
+    ) == ["a", "b", "primary"]
+
+    # both populated with overlap — singular dedup'd
+    assert jwt_handler.get_all_jwt_team_ids({"team_id": "a", "teams": ["a", "b"]}) == [
+        "a",
+        "b",
+    ]
+
+    # neither populated
+    assert jwt_handler.get_all_jwt_team_ids({}) == []
+
+
+def test_get_all_jwt_team_ids_does_not_use_team_id_default():
+    """team_id_default is a JWT-bearer-flow auth-builder fallback, not a token
+    claim. It must NOT leak into get_all_jwt_team_ids — otherwise SSO logins
+    would silently start adding users to the default team for any tenant that
+    has team_id_default configured."""
+    jwt_handler = JWTHandler()
+    jwt_handler.update_environment(
+        prisma_client=None,
+        user_api_key_cache=MagicMock(),
+        litellm_jwtauth=LiteLLM_JWTAuth(
+            team_id_jwt_field="team_id",
+            team_ids_jwt_field="teams",
+            team_id_default="default-team",
+        ),
+    )
+
+    # team_id claim missing — must not fall back to default-team
+    assert jwt_handler.get_all_jwt_team_ids({"teams": []}) == []
+    assert jwt_handler.get_all_jwt_team_ids({}) == []
+
+    # only the plural is populated — default still must not be added
+    assert jwt_handler.get_all_jwt_team_ids({"teams": ["a"]}) == ["a"]
+
+    # team_id_jwt_field unset entirely + only default configured: still no default
+    jwt_handler.update_environment(
+        prisma_client=None,
+        user_api_key_cache=MagicMock(),
+        litellm_jwtauth=LiteLLM_JWTAuth(
+            team_ids_jwt_field="teams",
+            team_id_default="default-team",
+        ),
+    )
+    assert jwt_handler.get_all_jwt_team_ids({"teams": []}) == []
+
+
 @pytest.mark.asyncio
 async def test_map_jwt_role_to_litellm_role():
     """Test JWT role mapping to LiteLLM roles with various patterns"""
diff --git a/tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py b/tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py
index 033deb3ff42..0d7becd3e2e 100644
--- a/tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py
+++ b/tests/test_litellm/proxy/guardrails/test_guardrail_endpoints.py
@@ -106,9 +106,11 @@ def mock_in_memory_handler(mocker):
     mock_handler = mocker.Mock(spec=InMemoryGuardrailHandler)
     mock_handler.list_in_memory_guardrails.return_value = [MOCK_CONFIG_GUARDRAIL]
     mock_handler.get_guardrail_by_id.return_value = MOCK_CONFIG_GUARDRAIL
+    mock_handler.get_source.return_value = "config"
     mock_handler.initialize_guardrail = mocker.Mock()
     mock_handler.update_in_memory_guardrail = mocker.Mock()
     mock_handler.delete_in_memory_guardrail = mocker.Mock()
+    mock_handler.reconcile_db_guardrails = mocker.Mock(return_value=[])
     return mock_handler
 
 
@@ -162,6 +164,67 @@ async def test_list_guardrails_v2_with_db_and_config(
     assert isinstance(config_guardrail.litellm_params, BaseLitellmParams)
 
 
+@pytest.mark.asyncio
+async def test_list_guardrails_v2_skips_stale_db_backed_in_memory_entries(mocker):
+    """
+    A guardrail that's still in this pod's memory tagged source='db' but is no
+    longer in the DB result (deleted on another pod, awaiting reconcile) must
+    NOT surface in the list response — pre-fix it leaked as 'config'.
+    """
+    stale_guardrail = {
+        "guardrail_id": "stale-db-id",
+        "guardrail_name": "Stale DB Guardrail",
+        "litellm_params": {"guardrail": "bedrock", "mode": "pre_call"},
+        "guardrail_info": {},
+    }
+    mock_prisma_client = mocker.Mock()
+    mock_prisma_client.db = mocker.Mock()
+    mock_prisma_client.db.litellm_guardrailstable = mocker.Mock()
+    mock_prisma_client.db.litellm_guardrailstable.find_many = AsyncMock(return_value=[])
+
+    mock_in_memory_handler = mocker.Mock()
+    mock_in_memory_handler.list_in_memory_guardrails.return_value = [stale_guardrail]
+    mock_in_memory_handler.get_source.return_value = "db"
+
+    mocker.patch("litellm.proxy.proxy_server.prisma_client", mock_prisma_client)
+    mocker.patch(
+        "litellm.proxy.guardrails.guardrail_registry.IN_MEMORY_GUARDRAIL_HANDLER",
+        mock_in_memory_handler,
+    )
+
+    admin_auth = UserAPIKeyAuth(user_role=LitellmUserRoles.PROXY_ADMIN)
+    response = await list_guardrails_v2(user_api_key_dict=admin_auth)
+
+    assert response.guardrails == []
+    mock_in_memory_handler.get_source.assert_called_with("stale-db-id")
+
+
+@pytest.mark.asyncio
+async def test_get_guardrail_info_404s_stale_db_backed_entry(
+    mocker, mock_prisma_client, mock_in_memory_handler
+):
+    """
+    Stale DB-backed entry (in-memory but not in DB) must 404 instead of being
+    returned as if it were a config-loaded guardrail.
+    """
+    mocker.patch("litellm.proxy.proxy_server.prisma_client", mock_prisma_client)
+    mocker.patch(
+        "litellm.proxy.guardrails.guardrail_registry.IN_MEMORY_GUARDRAIL_HANDLER",
+        mock_in_memory_handler,
+    )
+    mock_prisma_client.db.litellm_guardrailstable.find_unique = AsyncMock(
+        return_value=None
+    )
+    # In-memory still has it, but it's tagged as 'db' (stale, awaiting reconcile)
+    mock_in_memory_handler.get_source.return_value = "db"
+
+    with pytest.raises(HTTPException) as exc_info:
+        await get_guardrail_info("stale-db-id")
+
+    assert exc_info.value.status_code == 404
+    assert "not found" in str(exc_info.value.detail)
+
+
 @pytest.mark.asyncio
 async def test_list_guardrails_v2_masks_sensitive_data_in_db_guardrails(mocker):
     """Test that sensitive litellm_params are masked for DB guardrails in list response"""
@@ -1160,6 +1223,7 @@ async def test_get_guardrail_info_endpoint_config_guardrail(mocker):
     # Mock IN_MEMORY_GUARDRAIL_HANDLER at its source to return config guardrail
     mock_in_memory_handler = mocker.Mock()
     mock_in_memory_handler.get_guardrail_by_id.return_value = MOCK_CONFIG_GUARDRAIL
+    mock_in_memory_handler.get_source.return_value = "config"
     mocker.patch(
         "litellm.proxy.guardrails.guardrail_registry.IN_MEMORY_GUARDRAIL_HANDLER",
         mock_in_memory_handler,
diff --git a/tests/test_litellm/proxy/guardrails/test_guardrail_registry.py b/tests/test_litellm/proxy/guardrails/test_guardrail_registry.py
index 1d70126681d..9f7173383b0 100644
--- a/tests/test_litellm/proxy/guardrails/test_guardrail_registry.py
+++ b/tests/test_litellm/proxy/guardrails/test_guardrail_registry.py
@@ -60,3 +60,123 @@ def test_update_in_memory_guardrail():
         handler.guardrail_id_to_custom_guardrail["123"].event_hook
         is GuardrailEventHooks.pre_call
     )
+
+
+def _make_guardrail(guardrail_id: str, name: str = "g") -> Guardrail:
+    return Guardrail(
+        guardrail_id=guardrail_id,
+        guardrail_name=name,
+        litellm_params=LitellmParams(guardrail=name, mode="pre_call", default_on=False),
+    )
+
+
+def test_reconcile_db_guardrails_drops_stale_db_entries_only():
+    """
+    The reconcile pass must drop in-memory entries marked source='db' that are
+    missing from the DB result, and never touch source='config' entries.
+    Models the multi-pod case where another pod deleted a DB-backed guardrail.
+    """
+    handler = InMemoryGuardrailHandler()
+
+    # Two DB-backed entries on this pod (synced from earlier polling cycles)
+    handler.IN_MEMORY_GUARDRAILS["db-keep"] = _make_guardrail("db-keep")
+    handler.IN_MEMORY_GUARDRAILS["db-stale"] = _make_guardrail("db-stale")
+    handler._sources["db-keep"] = "db"
+    handler._sources["db-stale"] = "db"
+
+    # One config-loaded entry that must survive reconciliation
+    handler.IN_MEMORY_GUARDRAILS["cfg"] = _make_guardrail("cfg")
+    handler._sources["cfg"] = "config"
+
+    # The DB now only contains db-keep — db-stale was deleted on another pod.
+    removed = handler.reconcile_db_guardrails(db_guardrail_ids={"db-keep"})
+
+    assert removed == ["db-stale"]
+    assert "db-stale" not in handler.IN_MEMORY_GUARDRAILS
+    assert "db-stale" not in handler._sources
+    assert "db-keep" in handler.IN_MEMORY_GUARDRAILS
+    assert "cfg" in handler.IN_MEMORY_GUARDRAILS
+    assert handler._sources["cfg"] == "config"
+
+
+def test_reconcile_does_not_drop_config_entries_missing_from_db():
+    """A config-only guardrail (no DB row) must never be reconciled away."""
+    handler = InMemoryGuardrailHandler()
+    handler.IN_MEMORY_GUARDRAILS["cfg-only"] = _make_guardrail("cfg-only")
+    handler._sources["cfg-only"] = "config"
+
+    removed = handler.reconcile_db_guardrails(db_guardrail_ids=set())
+
+    assert removed == []
+    assert "cfg-only" in handler.IN_MEMORY_GUARDRAILS
+
+
+def test_get_source_returns_marker_set_at_insert():
+    handler = InMemoryGuardrailHandler()
+    handler.IN_MEMORY_GUARDRAILS["a"] = _make_guardrail("a")
+    handler._sources["a"] = "db"
+    handler.IN_MEMORY_GUARDRAILS["b"] = _make_guardrail("b")
+    handler._sources["b"] = "config"
+
+    assert handler.get_source("a") == "db"
+    assert handler.get_source("b") == "config"
+    assert handler.get_source("missing") is None
+
+
+def test_delete_in_memory_guardrail_clears_source_marker():
+    handler = InMemoryGuardrailHandler()
+    handler.IN_MEMORY_GUARDRAILS["a"] = _make_guardrail("a")
+    handler._sources["a"] = "db"
+
+    handler.delete_in_memory_guardrail("a")
+
+    assert "a" not in handler.IN_MEMORY_GUARDRAILS
+    assert "a" not in handler._sources
+    assert handler.get_source("a") is None
+
+
+def test_initialize_guardrail_early_return_updates_source_marker():
+    """
+    When initialize_guardrail is called for a guardrail that already exists
+    in memory, the early-return path must still honor the caller's source.
+    Otherwise a racing polling tick that placed a DB entry in memory first
+    would leave a later config-init call wrongly marked as 'db' (or vice
+    versa), and the entry would be reconciled with the wrong classification.
+    """
+    handler = InMemoryGuardrailHandler()
+    # Simulate a polling tick already placing the entry as DB-backed.
+    handler.IN_MEMORY_GUARDRAILS["collide"] = _make_guardrail("collide", name="bedrock")
+    handler._sources["collide"] = "db"
+
+    # Config init re-visits the same id (e.g., hot-reload, or UUID collision).
+    g = Guardrail(
+        guardrail_id="collide",
+        guardrail_name="bedrock",
+        litellm_params=LitellmParams(
+            guardrail="bedrock", mode="pre_call", default_on=False
+        ),
+    )
+    handler.initialize_guardrail(guardrail=g, source="config")
+
+    assert handler.get_source("collide") == "config"
+
+    # And the symmetric direction: db sync should override an entry left
+    # marked as 'config' from a stale init path.
+    handler.initialize_guardrail(guardrail=g, source="db")
+    assert handler.get_source("collide") == "db"
+
+
+def test_sync_guardrail_from_db_marks_source_db_when_unchanged():
+    """
+    sync_guardrail_from_db must enforce source='db' even when params are
+    unchanged, so a config entry whose UUID happens to collide with a later
+    DB row gets re-tagged correctly.
+    """
+    handler = InMemoryGuardrailHandler()
+    g = _make_guardrail("collide")
+    handler.IN_MEMORY_GUARDRAILS["collide"] = g
+    handler._sources["collide"] = "config"
+
+    handler.sync_guardrail_from_db(g)
+
+    assert handler.get_source("collide") == "db"
diff --git a/tests/test_litellm/proxy/health_endpoints/test_health_endpoints.py b/tests/test_litellm/proxy/health_endpoints/test_health_endpoints.py
index 2edcb00c967..bcd7fcb37b3 100644
--- a/tests/test_litellm/proxy/health_endpoints/test_health_endpoints.py
+++ b/tests/test_litellm/proxy/health_endpoints/test_health_endpoints.py
@@ -466,6 +466,236 @@ async def test_test_model_connection_loads_config_from_router():
         assert "result" in result
 
 
+@pytest.mark.asyncio
+async def test_test_model_connection_uses_model_info_id_to_disambiguate_duplicate_model_names():
+    """
+    When two deployments share the same `model_name` (e.g. wildcard
+    `openai/*`) but have different `api_base` values, clicking "Test
+    Connection" on a specific row in the UI must probe THAT row's
+    `api_base` — not whichever happens to be `deployments[0]`.
+
+    The UI passes `model_info.id` to identify the deployment the user
+    actually clicked on. The backend must use that id to look up the
+    specific deployment rather than always grabbing the first match.
+
+    Regression test for: silent fallback to deployments[0] when
+    multiple deployments share a wildcard model_name.
+    """
+    from litellm.types.router import Deployment, LiteLLM_Params
+
+    mock_request = MagicMock()
+    mock_user_api_key_dict = MagicMock()
+    mock_user_api_key_dict.user_id = "test-user"
+    mock_user_api_key_dict.token = "test-token"
+
+    mock_prisma_client = MagicMock()
+
+    deployment_a = {
+        "model_name": "openai/*",
+        "litellm_params": {
+            "model": "openai/*",
+            "api_base": "https://deployment-A-base.invalid/v1",
+            "api_key": "fake-key-A",
+        },
+        "model_info": {"id": "deployment-A-id"},
+    }
+    deployment_b = {
+        "model_name": "openai/*",
+        "litellm_params": {
+            "model": "openai/*",
+            "api_base": "https://deployment-B-base.invalid/v1",
+            "api_key": "fake-key-B",
+        },
+        "model_info": {"id": "deployment-B-id"},
+    }
+
+    mock_router = MagicMock()
+    mock_router.get_model_list.return_value = [deployment_a, deployment_b]
+
+    # Backend uses get_deployment(model_id=...) for O(1) lookup by id.
+    def _get_deployment_by_id(model_id):
+        if model_id == "deployment-A-id":
+            return Deployment(
+                model_name="openai/*",
+                litellm_params=LiteLLM_Params(**deployment_a["litellm_params"]),
+                model_info=deployment_a["model_info"],
+            )
+        if model_id == "deployment-B-id":
+            return Deployment(
+                model_name="openai/*",
+                litellm_params=LiteLLM_Params(**deployment_b["litellm_params"]),
+                model_info=deployment_b["model_info"],
+            )
+        return None
+
+    mock_router.get_deployment.side_effect = _get_deployment_by_id
+
+    mock_can_user_make_model_call = AsyncMock()
+
+    mock_health_check_result = {"status": "healthy", "response_time_ms": 50}
+    mock_ahealth_check = AsyncMock(return_value=mock_health_check_result)
+    mock_run_with_timeout = AsyncMock(return_value=mock_health_check_result)
+
+    def mock_update_params(model_info, litellm_params):
+        params = litellm_params.copy()
+        params["messages"] = [{"role": "user", "content": "test"}]
+        return params
+
+    def mock_reject_os_environ(params):
+        return None
+
+    with (
+        patch(
+            "litellm.proxy.proxy_server.prisma_client",
+            mock_prisma_client,
+        ),
+        patch(
+            "litellm.proxy.proxy_server.llm_router",
+            mock_router,
+        ),
+        patch(
+            "litellm.proxy.proxy_server.premium_user",
+            False,
+        ),
+        patch(
+            "litellm.proxy.management_endpoints.model_management_endpoints.ModelManagementAuthChecks.can_user_make_model_call",
+            mock_can_user_make_model_call,
+        ),
+        patch(
+            "litellm.proxy.health_endpoints._health_endpoints.litellm.ahealth_check",
+            mock_ahealth_check,
+        ),
+        patch(
+            "litellm.proxy.health_endpoints._health_endpoints.run_with_timeout",
+            mock_run_with_timeout,
+        ),
+        patch(
+            "litellm.proxy.health_endpoints._health_endpoints._update_litellm_params_for_health_check",
+            mock_update_params,
+        ),
+        patch(
+            "litellm.proxy.health_endpoints._health_endpoints._reject_os_environ_references",
+            mock_reject_os_environ,
+        ),
+    ):
+        # Click "Test Connection" on deployment B (NOT the first one).
+        # The UI sends only `model` + `model_info.id` — it does NOT
+        # send `api_base`/`api_key`, so the backend must resolve them
+        # from the right deployment.
+        await health_test_model_connection(
+            request=mock_request,
+            mode="chat",
+            litellm_params={"model": "openai/*"},
+            model_info={"id": "deployment-B-id"},
+            user_api_key_dict=mock_user_api_key_dict,
+        )
+
+        # The outbound health check must hit deployment B's api_base.
+        ahealth_check_call_args = mock_ahealth_check.call_args
+        assert ahealth_check_call_args is not None
+        model_params = ahealth_check_call_args.kwargs.get("model_params", {})
+
+        assert model_params.get("api_base") == (
+            "https://deployment-B-base.invalid/v1"
+        ), (
+            "Expected /health/test_connection to probe deployment B's "
+            "api_base when model_info.id='deployment-B-id' was provided. "
+            f"Got: {model_params.get('api_base')!r}. This means the "
+            "backend silently fell back to deployments[0] (A) instead "
+            "of disambiguating by model_info.id."
+        )
+        assert model_params.get("api_key") == "fake-key-B"
+
+
+@pytest.mark.asyncio
+async def test_test_model_connection_falls_back_to_deployments_zero_without_id():
+    """
+    Backwards-compat: when the request body does NOT include
+    `model_info.id`, the legacy behavior of using `deployments[0]`
+    is preserved (single-deployment case, or callers that haven't
+    been updated to pass an id).
+    """
+    mock_request = MagicMock()
+    mock_user_api_key_dict = MagicMock()
+    mock_user_api_key_dict.user_id = "test-user"
+    mock_user_api_key_dict.token = "test-token"
+
+    mock_prisma_client = MagicMock()
+
+    deployment_a = {
+        "model_name": "openai/*",
+        "litellm_params": {
+            "model": "openai/*",
+            "api_base": "https://deployment-A-base.invalid/v1",
+            "api_key": "fake-key-A",
+        },
+        "model_info": {"id": "deployment-A-id"},
+    }
+    deployment_b = {
+        "model_name": "openai/*",
+        "litellm_params": {
+            "model": "openai/*",
+            "api_base": "https://deployment-B-base.invalid/v1",
+            "api_key": "fake-key-B",
+        },
+        "model_info": {"id": "deployment-B-id"},
+    }
+
+    mock_router = MagicMock()
+    mock_router.get_model_list.return_value = [deployment_a, deployment_b]
+
+    mock_can_user_make_model_call = AsyncMock()
+    mock_health_check_result = {"status": "healthy"}
+    mock_ahealth_check = AsyncMock(return_value=mock_health_check_result)
+    mock_run_with_timeout = AsyncMock(return_value=mock_health_check_result)
+
+    def mock_update_params(model_info, litellm_params):
+        params = litellm_params.copy()
+        params["messages"] = [{"role": "user", "content": "test"}]
+        return params
+
+    def mock_reject_os_environ(params):
+        return None
+
+    with (
+        patch("litellm.proxy.proxy_server.prisma_client", mock_prisma_client),
+        patch("litellm.proxy.proxy_server.llm_router", mock_router),
+        patch("litellm.proxy.proxy_server.premium_user", False),
+        patch(
+            "litellm.proxy.management_endpoints.model_management_endpoints.ModelManagementAuthChecks.can_user_make_model_call",
+            mock_can_user_make_model_call,
+        ),
+        patch(
+            "litellm.proxy.health_endpoints._health_endpoints.litellm.ahealth_check",
+            mock_ahealth_check,
+        ),
+        patch(
+            "litellm.proxy.health_endpoints._health_endpoints.run_with_timeout",
+            mock_run_with_timeout,
+        ),
+        patch(
+            "litellm.proxy.health_endpoints._health_endpoints._update_litellm_params_for_health_check",
+            mock_update_params,
+        ),
+        patch(
+            "litellm.proxy.health_endpoints._health_endpoints._reject_os_environ_references",
+            mock_reject_os_environ,
+        ),
+    ):
+        await health_test_model_connection(
+            request=mock_request,
+            mode="chat",
+            litellm_params={"model": "openai/*"},
+            model_info={},  # no id provided
+            user_api_key_dict=mock_user_api_key_dict,
+        )
+
+        # Without id, deployments[0] (A) should be used (legacy behavior).
+        model_params = mock_ahealth_check.call_args.kwargs.get("model_params", {})
+        assert model_params.get("api_base") == "https://deployment-A-base.invalid/v1"
+        assert model_params.get("api_key") == "fake-key-A"
+
+
 @pytest.mark.asyncio
 async def test_health_services_endpoint_datadog_llm_observability():
     """
diff --git a/tests/test_litellm/proxy/management_endpoints/test_tag_management_endpoints.py b/tests/test_litellm/proxy/management_endpoints/test_tag_management_endpoints.py
index 39ec6f075d7..ee2d72d2dd4 100644
--- a/tests/test_litellm/proxy/management_endpoints/test_tag_management_endpoints.py
+++ b/tests/test_litellm/proxy/management_endpoints/test_tag_management_endpoints.py
@@ -380,6 +380,117 @@ async def test_list_tags_no_dynamic_tags():
         app.dependency_overrides.clear()
 
 
+@pytest.mark.asyncio
+async def test_list_tags_with_date_range_filters_dynamic_tags():
+    """
+    /tag/list?start_date=...&end_date=... should push the date window into
+    the dailytagspend group_by WHERE clause so large tables don't get scanned.
+    """
+    from unittest.mock import AsyncMock, Mock
+
+    from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+
+    mock_user_auth = UserAPIKeyAuth(
+        user_id="test-user-123",
+        user_role=LitellmUserRoles.PROXY_ADMIN,
+    )
+    app.dependency_overrides[user_api_key_auth] = lambda: mock_user_auth
+
+    try:
+        with patch("litellm.proxy.proxy_server.prisma_client") as mock_prisma:
+            mock_db = Mock()
+            mock_prisma.db = mock_db
+            mock_db.litellm_tagtable.find_many = AsyncMock(return_value=[])
+            group_by_mock = AsyncMock(return_value=[])
+            mock_db.litellm_dailytagspend.group_by = group_by_mock
+
+            headers = {"Authorization": "Bearer sk-1234"}
+            response = client.get(
+                "/tag/list?start_date=2026-04-01&end_date=2026-04-29",
+                headers=headers,
+            )
+
+            assert response.status_code == 200
+            group_by_mock.assert_awaited_once()
+            where = group_by_mock.await_args.kwargs["where"]
+            assert where["tag"] == {"not": None}
+            assert where["date"] == {"gte": "2026-04-01", "lte": "2026-04-29"}
+
+    finally:
+        app.dependency_overrides.clear()
+
+
+@pytest.mark.asyncio
+async def test_list_tags_without_date_range_omits_date_filter():
+    """When no date range is passed, the WHERE clause must not carry a date key."""
+    from unittest.mock import AsyncMock, Mock
+
+    from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+
+    mock_user_auth = UserAPIKeyAuth(
+        user_id="test-user-123",
+        user_role=LitellmUserRoles.PROXY_ADMIN,
+    )
+    app.dependency_overrides[user_api_key_auth] = lambda: mock_user_auth
+
+    try:
+        with patch("litellm.proxy.proxy_server.prisma_client") as mock_prisma:
+            mock_db = Mock()
+            mock_prisma.db = mock_db
+            mock_db.litellm_tagtable.find_many = AsyncMock(return_value=[])
+            group_by_mock = AsyncMock(return_value=[])
+            mock_db.litellm_dailytagspend.group_by = group_by_mock
+
+            headers = {"Authorization": "Bearer sk-1234"}
+            response = client.get("/tag/list", headers=headers)
+
+            assert response.status_code == 200
+            group_by_mock.assert_awaited_once()
+            where = group_by_mock.await_args.kwargs["where"]
+            assert "date" not in where
+
+    finally:
+        app.dependency_overrides.clear()
+
+
+@pytest.mark.parametrize(
+    "query, expected_detail_fragment",
+    [
+        ("?start_date=2026-04-01", "must be provided together"),
+        ("?end_date=2026-04-29", "must be provided together"),
+        ("?start_date=2026-04-29&end_date=2026-04-01", "on or before end_date"),
+        ("?start_date=not-a-date&end_date=2026-04-29", "YYYY-MM-DD"),
+    ],
+)
+@pytest.mark.asyncio
+async def test_list_tags_rejects_invalid_date_range(query, expected_detail_fragment):
+    from unittest.mock import AsyncMock, Mock
+
+    from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+
+    mock_user_auth = UserAPIKeyAuth(
+        user_id="test-user-123",
+        user_role=LitellmUserRoles.PROXY_ADMIN,
+    )
+    app.dependency_overrides[user_api_key_auth] = lambda: mock_user_auth
+
+    try:
+        with patch("litellm.proxy.proxy_server.prisma_client") as mock_prisma:
+            mock_db = Mock()
+            mock_prisma.db = mock_db
+            mock_db.litellm_tagtable.find_many = AsyncMock(return_value=[])
+            mock_db.litellm_dailytagspend.group_by = AsyncMock(return_value=[])
+
+            headers = {"Authorization": "Bearer sk-1234"}
+            response = client.get(f"/tag/list{query}", headers=headers)
+
+            assert response.status_code == 400
+            assert expected_detail_fragment in response.json()["detail"]
+
+    finally:
+        app.dependency_overrides.clear()
+
+
 @pytest.mark.asyncio
 async def test_get_deployments_by_model_id():
     """
diff --git a/ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx b/ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx
index 809f1d4e17b..efc1166a398 100644
--- a/ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx
+++ b/ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx
@@ -145,23 +145,6 @@ const UsagePage: React.FC<UsagePageProps> = ({ teams, organizations }) => {
   const [topKeysLimit, setTopKeysLimit] = useState<number>(5);
   const [topModelsLimit, setTopModelsLimit] = useState<number>(5);
   const [showTokenBreakdown, setShowTokenBreakdown] = useState(false);
-  const getAllTags = async () => {
-    if (!accessToken) {
-      return;
-    }
-    const tags = await tagListCall(accessToken);
-    setAllTags(
-      Object.values(tags).map((tag: Tag) => ({
-        label: tag.name,
-        value: tag.name,
-      })),
-    );
-  };
-
-  useEffect(() => {
-    getAllTags();
-  }, [accessToken]);
-
   // Sync selectedUserId when auth state settles (isAdmin/userID may be null on initial render)
   useEffect(() => {
     if (!isAdmin && userID) {
@@ -175,6 +158,30 @@ const UsagePage: React.FC<UsagePageProps> = ({ teams, organizations }) => {
   const startTime = useMemo(() => (dateValue.from ? new Date(dateValue.from) : null), [dateValue.from]);
   const endTime = useMemo(() => (dateValue.to ? new Date(dateValue.to) : null), [dateValue.to]);
 
+  useEffect(() => {
+    if (!accessToken) return;
+    let cancelled = false;
+    (async () => {
+      try {
+        const tags = await tagListCall(accessToken, startTime, endTime);
+        if (cancelled) return;
+        setAllTags(
+          Object.values(tags).map((tag: Tag) => ({
+            label: tag.name,
+            value: tag.name,
+          })),
+        );
+      } catch (e) {
+        if (!cancelled) {
+          console.error("Failed to fetch tag list", e);
+        }
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [accessToken, startTime, endTime]);
+
   // Try aggregated endpoint first, fall back to paginated on failure
   const aggregatedFetchIdRef = useRef(0);
   useEffect(() => {
diff --git a/ui/litellm-dashboard/src/components/model_info_view.test.tsx b/ui/litellm-dashboard/src/components/model_info_view.test.tsx
index 29eb8e0019b..54144d02eda 100644
--- a/ui/litellm-dashboard/src/components/model_info_view.test.tsx
+++ b/ui/litellm-dashboard/src/components/model_info_view.test.tsx
@@ -250,6 +250,33 @@ describe("ModelInfoView", () => {
     });
   });
 
+  it("should pass model_info.id to disambiguate duplicate model_name deployments", async () => {
+    // Regression test: when two deployments share `model_name` (e.g.
+    // wildcard `openai/*` with different `api_base` values), the UI
+    // must forward the clicked row's `model_info.id` to the backend.
+    // Otherwise /health/test_connection silently probes deployments[0]
+    // instead of the deployment the user actually selected.
+    const user = userEvent.setup();
+    render(<ModelInfoView {...DEFAULT_ADMIN_PROPS} />, { wrapper });
+
+    await waitFor(() => {
+      expect(screen.getByText("Model Settings")).toBeInTheDocument();
+    });
+
+    const testButton = screen.getByRole("button", { name: /test connection/i });
+    await user.click(testButton);
+
+    await waitFor(() => {
+      expect(mockTestConnectionRequest).toHaveBeenCalled();
+    });
+
+    const callArgs = mockTestConnectionRequest.mock.calls[0];
+    // Signature: (accessToken, litellm_params, model_info, mode)
+    const modelInfoArg = callArgs[2] as Record<string, unknown>;
+    expect(modelInfoArg).toBeDefined();
+    expect(modelInfoArg.id).toBe("123");
+  });
+
   it("should display error notification when connection test fails", async () => {
     const user = userEvent.setup();
     mockTestConnectionRequest.mockRejectedValue(new Error("Connection failed"));
diff --git a/ui/litellm-dashboard/src/components/model_info_view.tsx b/ui/litellm-dashboard/src/components/model_info_view.tsx
index ea8af2fcd62..95a43862de5 100644
--- a/ui/litellm-dashboard/src/components/model_info_view.tsx
+++ b/ui/litellm-dashboard/src/components/model_info_view.tsx
@@ -379,6 +379,12 @@ export default function ModelInfoView({
           model: localModelData.litellm_model_name,
         },
         {
+          // `id` is required to disambiguate when multiple deployments
+          // share the same model_name (e.g. wildcard `openai/*` with two
+          // different `api_base` values for failover). Without it the
+          // backend silently falls back to deployments[0] and probes
+          // the wrong endpoint.
+          id: localModelData.model_info?.id,
           mode: localModelData.model_info?.mode,
         },
         localModelData.model_info?.mode,
diff --git a/ui/litellm-dashboard/src/components/networking.tsx b/ui/litellm-dashboard/src/components/networking.tsx
index 44208904a70..abe17616bef 100644
--- a/ui/litellm-dashboard/src/components/networking.tsx
+++ b/ui/litellm-dashboard/src/components/networking.tsx
@@ -7288,10 +7288,29 @@ export const tagInfoCall = async (accessToken: string, tagNames: string[]): Prom
   }
 };
 
-export const tagListCall = async (accessToken: string): Promise<TagListResponse> => {
+const formatYmd = (value: Date): string => {
+  const year = value.getFullYear();
+  const month = String(value.getMonth() + 1).padStart(2, "0");
+  const day = String(value.getDate()).padStart(2, "0");
+  return `${year}-${month}-${day}`;
+};
+
+export const tagListCall = async (
+  accessToken: string,
+  startTime?: Date | null,
+  endTime?: Date | null,
+): Promise<TagListResponse> => {
   try {
     let url = proxyBaseUrl ? `${proxyBaseUrl}/tag/list` : `/tag/list`;
 
+    if (startTime && endTime) {
+      const params = new URLSearchParams({
+        start_date: formatYmd(startTime),
+        end_date: formatYmd(endTime),
+      });
+      url = `${url}?${params.toString()}`;
+    }
+
     const response = await fetch(url, {
       method: "GET",
       headers: {
diff --git a/ui/litellm-dashboard/src/components/templates/key_info_view.tsx b/ui/litellm-dashboard/src/components/templates/key_info_view.tsx
index 492e43cbc81..65bd9d9eb95 100644
--- a/ui/litellm-dashboard/src/components/templates/key_info_view.tsx
+++ b/ui/litellm-dashboard/src/components/templates/key_info_view.tsx
@@ -396,7 +396,7 @@ export default function KeyInfoView({
   };
 
   return (
-    <div className="w-full h-screen p-4">
+    <div className="w-full h-full overflow-y-auto p-4">
       <KeyInfoHeader
         data={{
           keyName: currentKeyData.key_alias || "Virtual Key",
@@ -614,7 +614,7 @@ export default function KeyInfoView({
 
           {/* Settings Panel */}
           <TabPanel>
-            <Card className="overflow-y-auto max-h-[65vh]">
+            <Card>
               <div className="flex justify-between items-center mb-4">
                 <Title>Key Settings</Title>
                 {!isEditing && canModifyKey && (

From bac03ac3f162c752457990430bf8461606aae03e Mon Sep 17 00:00:00 2001
From: milan-berri <milan@berri.ai>
Date: Fri, 8 May 2026 00:34:49 +0300
Subject: [PATCH 21/33] feat(auth): add scope and wildcard support for JWT
 routing overrides (#26325)

Squash-merged by litellm-agent from milan-berri's PR.
---
 litellm/proxy/_types.py                       |   6 +
 litellm/proxy/auth/user_api_key_auth.py       |  41 ++-
 .../proxy/auth/test_user_api_key_auth.py      | 335 +++++++++++++++++-
 3 files changed, 377 insertions(+), 5 deletions(-)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index ed20fe86cdc..89b422bd5d0 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -4342,10 +4342,16 @@ class JWTRoutingOverride(BaseModel):
 
     A rule matches when all provided selectors match token claims.
     If matched, request is routed to the configured auth path.
+
+    Wildcard selectors use shell-style patterns (* and ?) and are matched with
+    case-sensitive semantics; use the same casing your IdP emits in JWT claims.
+    Space-delimited tokenization applies only to the ``scope`` claim (OAuth/OIDC
+    scope strings), not to ``iss``, ``aud``, or ``client_id``.
     """
 
     iss: Union[str, List[str]]
     client_id: Optional[Union[str, List[str]]] = None
+    scope: Optional[Union[str, List[str]]] = None
     aud: Optional[Union[str, List[str]]] = None
     path: Literal["oauth2"] = "oauth2"
 
diff --git a/litellm/proxy/auth/user_api_key_auth.py b/litellm/proxy/auth/user_api_key_auth.py
index 9d3c06e641f..2f61a40bc9a 100644
--- a/litellm/proxy/auth/user_api_key_auth.py
+++ b/litellm/proxy/auth/user_api_key_auth.py
@@ -8,6 +8,7 @@ Returns a UserAPIKeyAuth object if the API key is valid
 """
 
 import asyncio
+import fnmatch
 import re
 import secrets
 from datetime import datetime, timezone
@@ -183,22 +184,49 @@ def _get_bearer_token_or_received_api_key(api_key: str) -> str:
 
 
 def _routing_selector_matches_claim(
-    selector_value: Optional[Any], claim_value: Optional[Any]
+    selector_value: Optional[Any],
+    claim_value: Optional[Any],
+    *,
+    split_space_delimited: bool = False,
 ) -> bool:
     if selector_value is None:
         return True
 
-    selector_list = (
+    selector_list: List[str] = (
         [str(v) for v in selector_value]
         if isinstance(selector_value, list)
         else [str(selector_value)]
     )
 
+    if claim_value is None:
+        return False
+
     if isinstance(claim_value, list):
         claim_list = [str(v) for v in claim_value]
-        return any(v in claim_list for v in selector_list)
+    elif (
+        split_space_delimited
+        and isinstance(claim_value, str)
+        and " " in claim_value.strip()
+    ):
+        # OAuth/OIDC often sends scope as a single space-delimited string. Only split
+        # for the scope selector: iss/aud/client_id must stay exact full-string match
+        # on unverified claims (see routing override security review). The elif guard
+        # (`" " in claim_value.strip()`) ensures at least two non-empty tokens survive.
+        claim_list = [v for v in claim_value.strip().split(" ") if v]
+    else:
+        claim_list = [str(claim_value)]
 
-    return str(claim_value) in selector_list if claim_value is not None else False
+    def _selector_matches_claim(selector: str, claim: str) -> bool:
+        # NOTE: wildcard matching is case-sensitive (fnmatch.fnmatchcase).
+        if "*" in selector or "?" in selector:
+            return fnmatch.fnmatchcase(claim, selector)
+        return selector == claim
+
+    return any(
+        _selector_matches_claim(selector=s, claim=c)
+        for s in selector_list
+        for c in claim_list
+    )
 
 
 def _matches_routing_override(
@@ -209,6 +237,11 @@ def _matches_routing_override(
         and _routing_selector_matches_claim(
             override.client_id, token_claims.get("client_id")
         )
+        and _routing_selector_matches_claim(
+            override.scope,
+            token_claims.get("scope"),
+            split_space_delimited=True,
+        )
         and _routing_selector_matches_claim(override.aud, token_claims.get("aud"))
     )
 
diff --git a/tests/test_litellm/proxy/auth/test_user_api_key_auth.py b/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
index 95b3d746c66..4b0f6c0ea2f 100644
--- a/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
+++ b/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
@@ -29,8 +29,10 @@ from litellm.proxy.auth.handle_jwt import JWTHandler
 from litellm.proxy.auth.auth_checks import get_key_object, _cache_key_object
 from litellm.proxy.auth.route_checks import RouteChecks
 from litellm.proxy.auth.user_api_key_auth import (
-    _route_requires_auth_despite_public,
+    _matches_routing_override,
     _reserve_budget_after_common_checks,
+    _route_requires_auth_despite_public,
+    _routing_selector_matches_claim,
     _run_centralized_common_checks,
     _run_post_custom_auth_checks,
     get_api_key,
@@ -572,6 +574,140 @@ def _assert_get_api_key_with_custom_litellm_key_header(
     ) == (api_key, passed_in_key)
 
 
+@pytest.mark.parametrize(
+    "selector_value, claim_value, expected, split_space_delimited",
+    [
+        (None, "any-value", True, False),
+        ("issuer.example.com", "issuer.example.com", True, False),
+        ("issuer.example.com", "other-issuer.example.com", False, False),
+        # iss (and other non-scope claims) must not match via space-split injection
+        (
+            "trusted.example.com",
+            "trusted.example.com attacker.example.com",
+            False,
+            False,
+        ),
+        (
+            ["issuer-a.example.com", "issuer-b.example.com"],
+            "issuer-b.example.com",
+            True,
+            False,
+        ),
+        ("*MID_LITELLM", "STREAM_MID_LITELLM", True, False),
+        ("*MID_LITELLM", "REDIS_LITELLM", False, False),
+        ("machine-??", "machine-01", True, False),
+        ("machine-??", "machine-001", False, False),
+        # Wildcard matching is case-sensitive (fnmatch.fnmatchcase)
+        ("*litellm", "BATCH_LITELLM", False, False),
+        ("*LITELLM", "BATCH_LITELLM", True, False),
+        ("App:LiteLLM", "App:LiteLLM openid", True, True),
+        ("App:*", "App:LiteLLM openid", True, True),
+        (["openid", "App:LiteLLM"], "openid profile", True, True),
+        (["service-*", "batch-*"], "batch-123", True, False),
+        (["service-*", "batch-*"], "other-123", False, False),
+        ("App:LiteLLM", ["openid", "App:LiteLLM"], True, False),
+        ("App:LiteLLM", None, False, False),
+    ],
+)
+def test_routing_selector_matches_claim_parametrized(
+    selector_value, claim_value, expected, split_space_delimited
+):
+    assert (
+        _routing_selector_matches_claim(
+            selector_value=selector_value,
+            claim_value=claim_value,
+            split_space_delimited=split_space_delimited,
+        )
+        is expected
+    )
+
+
+@pytest.mark.parametrize(
+    "override, token_claims, expected",
+    [
+        # Only iss selector is required and should match.
+        (
+            JWTRoutingOverride(iss="oauth-issuer.example.com", path="oauth2"),
+            {"iss": "oauth-issuer.example.com"},
+            True,
+        ),
+        # Scope selector narrows the match.
+        (
+            JWTRoutingOverride(
+                iss="oauth-issuer.example.com",
+                scope="App:LiteLLM",
+                path="oauth2",
+            ),
+            {"iss": "oauth-issuer.example.com", "scope": "App:LiteLLM openid"},
+            True,
+        ),
+        # client_id wildcard selector narrows the match.
+        (
+            JWTRoutingOverride(
+                iss="oauth-issuer.example.com",
+                client_id="*MID_LITELLM",
+                path="oauth2",
+            ),
+            {"iss": "oauth-issuer.example.com", "client_id": "BATCH_MID_LITELLM"},
+            True,
+        ),
+        (
+            JWTRoutingOverride(
+                iss="oauth-issuer.example.com",
+                client_id="*MID_LITELLM",
+                path="oauth2",
+            ),
+            {"iss": "oauth-issuer.example.com", "client_id": "BATCH_PORTAL"},
+            False,
+        ),
+        # aud selector still works with list claims.
+        (
+            JWTRoutingOverride(
+                iss="oauth-issuer.example.com",
+                aud=["api://litellm", "api://fallback"],
+                path="oauth2",
+            ),
+            {"iss": "oauth-issuer.example.com", "aud": ["api://other", "api://litellm"]},
+            True,
+        ),
+        # All provided selectors are AND-ed.
+        (
+            JWTRoutingOverride(
+                iss="oauth-issuer.example.com",
+                scope="App:LiteLLM",
+                client_id="*MID_LITELLM",
+                path="oauth2",
+            ),
+            {
+                "iss": "oauth-issuer.example.com",
+                "scope": "App:LiteLLM openid",
+                "client_id": "BATCH_MID_LITELLM",
+            },
+            True,
+        ),
+        (
+            JWTRoutingOverride(
+                iss="oauth-issuer.example.com",
+                scope="App:LiteLLM",
+                client_id="*MID_LITELLM",
+                path="oauth2",
+            ),
+            {
+                "iss": "oauth-issuer.example.com",
+                "scope": "App:Other openid",
+                "client_id": "BATCH_MID_LITELLM",
+            },
+            False,
+        ),
+    ],
+)
+def test_matches_routing_override_parametrized(override, token_claims, expected):
+    assert (
+        _matches_routing_override(token_claims=token_claims, override=override)
+        is expected
+    )
+
+
 def test_get_api_key_with_custom_litellm_key_header_bearer_prefix():
     token = "sk-" + "1" * 8
     header = f"Bearer {token}"
@@ -1578,6 +1714,203 @@ class TestJWTOAuth2Coexistence:
             mock_jwt_auth.assert_not_called()
             assert result.user_id == "machine-client-aud-list"
 
+    @pytest.mark.asyncio
+    async def test_routing_override_matches_scope_claim(self):
+        """
+        Match routing override when scope selector is configured and scope claim matches.
+        """
+        jwt_token = (
+            "eyJhbGciOiJSUzI1NiJ9."
+            "eyJpc3MiOiJvYXV0aC1pc3N1ZXIuZXhhbXBsZS5jb20iLCJzY29wZSI6IkFwcDpMaXRlTExNIiwiY2xpZW50X2lkIjoiTUFDSElORV9NSURfTElURUxMTSJ9."
+            "c2ln"
+        )
+        general_settings = {
+            "enable_oauth2_auth": False,
+            "enable_jwt_auth": True,
+        }
+        mock_oauth2_response = UserAPIKeyAuth(
+            api_key=jwt_token,
+            user_id="machine-client-scope-match",
+        )
+
+        mock_request = MagicMock()
+        mock_request.url.path = "/v1/chat/completions"
+        mock_request.headers = {"authorization": f"Bearer {jwt_token}"}
+        mock_request.query_params = {}
+
+        with patch(
+            "litellm.proxy.proxy_server.general_settings", general_settings
+        ), patch("litellm.proxy.proxy_server.premium_user", True), patch(
+            "litellm.proxy.proxy_server.master_key", "sk-master"
+        ), patch(
+            "litellm.proxy.proxy_server.prisma_client", None
+        ), patch(
+            "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
+            new_callable=AsyncMock,
+            return_value=mock_oauth2_response,
+        ) as mock_oauth2, patch(
+            "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
+            new_callable=AsyncMock,
+        ) as mock_jwt_auth:
+            litellm.proxy.proxy_server.jwt_handler.update_environment(
+                prisma_client=None,
+                user_api_key_cache=DualCache(),
+                litellm_jwtauth=LiteLLM_JWTAuth(
+                    routing_overrides=[
+                        JWTRoutingOverride(
+                            iss="oauth-issuer.example.com",
+                            scope="App:LiteLLM",
+                            path="oauth2",
+                        )
+                    ]
+                ),
+            )
+
+            result = await user_api_key_auth(
+                request=mock_request,
+                api_key=f"Bearer {jwt_token}",
+            )
+
+            mock_oauth2.assert_called_once_with(token=jwt_token)
+            mock_jwt_auth.assert_not_called()
+            assert result.user_id == "machine-client-scope-match"
+
+    @pytest.mark.asyncio
+    async def test_routing_override_scope_mismatch_falls_back_to_jwt(self):
+        """
+        If scope selector does not match, continue default JWT flow.
+        """
+        jwt_token = (
+            "eyJhbGciOiJSUzI1NiJ9."
+            "eyJpc3MiOiJvYXV0aC1pc3N1ZXIuZXhhbXBsZS5jb20iLCJzY29wZSI6IkFwcDpPdGhlciIsImNsaWVudF9pZCI6IlBPUlRBTF9NSURfTElURUxMTSJ9."
+            "c2ln"
+        )
+        general_settings = {
+            "enable_oauth2_auth": False,
+            "enable_jwt_auth": True,
+        }
+        mock_jwt_result = {
+            "is_proxy_admin": True,
+            "team_object": None,
+            "user_object": None,
+            "end_user_object": None,
+            "org_object": None,
+            "token": jwt_token,
+            "team_id": "jwt-team",
+            "user_id": "jwt-user-scope-mismatch",
+            "end_user_id": None,
+            "org_id": None,
+            "team_membership": None,
+            "jwt_claims": {"sub": "user1"},
+        }
+
+        mock_request = MagicMock()
+        mock_request.url.path = "/v1/chat/completions"
+        mock_request.headers = {"authorization": f"Bearer {jwt_token}"}
+        mock_request.query_params = {}
+
+        with patch(
+            "litellm.proxy.proxy_server.general_settings", general_settings
+        ), patch("litellm.proxy.proxy_server.premium_user", True), patch(
+            "litellm.proxy.proxy_server.master_key", "sk-master"
+        ), patch(
+            "litellm.proxy.proxy_server.prisma_client", None
+        ), patch(
+            "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
+            new_callable=AsyncMock,
+        ) as mock_oauth2, patch(
+            "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
+            new_callable=AsyncMock,
+            return_value=mock_jwt_result,
+        ) as mock_jwt_auth:
+            litellm.proxy.proxy_server.jwt_handler.update_environment(
+                prisma_client=None,
+                user_api_key_cache=DualCache(),
+                litellm_jwtauth=LiteLLM_JWTAuth(
+                    routing_overrides=[
+                        JWTRoutingOverride(
+                            iss="oauth-issuer.example.com",
+                            scope="App:LiteLLM",
+                            path="oauth2",
+                        )
+                    ]
+                ),
+            )
+
+            result = await user_api_key_auth(
+                request=mock_request,
+                api_key=f"Bearer {jwt_token}",
+            )
+
+            mock_oauth2.assert_not_called()
+            mock_jwt_auth.assert_called_once()
+            assert result.user_id == "jwt-user-scope-mismatch"
+
+    @pytest.mark.asyncio
+    async def test_routing_override_matches_scope_and_client_wildcard_when_scope_claim_is_space_delimited(
+        self,
+    ):
+        """
+        Integration check: combined scope + wildcard selectors match on OAuth2 path
+        when scope claim is a space-delimited string.
+        """
+        jwt_token = (
+            "eyJhbGciOiJSUzI1NiJ9."
+            "eyJpc3MiOiJvYXV0aC1pc3N1ZXIuZXhhbXBsZS5jb20iLCJzY29wZSI6IkFwcDpMaXRlTExNIG9wZW5pZCIsImNsaWVudF9pZCI6IkJBVENIX01JRF9MSVRFTExNIn0."
+            "c2ln"
+        )
+        general_settings = {
+            "enable_oauth2_auth": False,
+            "enable_jwt_auth": True,
+        }
+        mock_oauth2_response = UserAPIKeyAuth(
+            api_key=jwt_token,
+            user_id="machine-client-space-delimited-scope-match",
+        )
+
+        mock_request = MagicMock()
+        mock_request.url.path = "/v1/chat/completions"
+        mock_request.headers = {"authorization": f"Bearer {jwt_token}"}
+        mock_request.query_params = {}
+
+        with patch(
+            "litellm.proxy.proxy_server.general_settings", general_settings
+        ), patch("litellm.proxy.proxy_server.premium_user", True), patch(
+            "litellm.proxy.proxy_server.master_key", "sk-master"
+        ), patch(
+            "litellm.proxy.proxy_server.prisma_client", None
+        ), patch(
+            "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
+            new_callable=AsyncMock,
+            return_value=mock_oauth2_response,
+        ) as mock_oauth2, patch(
+            "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
+            new_callable=AsyncMock,
+        ) as mock_jwt_auth:
+            litellm.proxy.proxy_server.jwt_handler.update_environment(
+                prisma_client=None,
+                user_api_key_cache=DualCache(),
+                litellm_jwtauth=LiteLLM_JWTAuth(
+                    routing_overrides=[
+                        JWTRoutingOverride(
+                            iss="oauth-issuer.example.com",
+                            scope="App:LiteLLM",
+                            client_id="*MID_LITELLM",
+                            path="oauth2",
+                        )
+                    ]
+                ),
+            )
+
+            result = await user_api_key_auth(
+                request=mock_request,
+                api_key=f"Bearer {jwt_token}",
+            )
+
+            mock_oauth2.assert_called_once_with(token=jwt_token)
+            mock_jwt_auth.assert_not_called()
+            assert result.user_id == "machine-client-space-delimited-scope-match"
+
     @pytest.mark.asyncio
     async def test_routing_override_routes_jwt_to_oauth2_when_oauth2_globally_disabled(
         self,

From b834817785d0ce163d2422cdca452e7fff16574d Mon Sep 17 00:00:00 2001
From: Michael-RZ-Berri <michael@berri.ai>
Date: Sat, 9 May 2026 12:32:16 -0700
Subject: [PATCH 22/33] [Feat] Add endpoint for bulk key updates for team
 (#26468)

Squash-merged by litellm-agent from Michael-RZ-Berri's PR.
---
 litellm/proxy/_types.py                       |   2 +
 litellm/proxy/auth/route_checks.py            |   2 +
 .../key_management_endpoints.py               | 261 +++++++-
 .../key_management_endpoints.py               |  80 ++-
 .../test_key_management_endpoints.py          | 591 +++++++++++++++++-
 5 files changed, 905 insertions(+), 31 deletions(-)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index d58612d5054..29178d23059 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -239,6 +239,7 @@ class KeyManagementRoutes(str, enum.Enum):
     KEY_BLOCK = "/key/block"
     KEY_UNBLOCK = "/key/unblock"
     KEY_BULK_UPDATE = "/key/bulk_update"
+    TEAM_KEY_BULK_UPDATE = "/team/key/bulk_update"
     KEY_RESET_SPEND = "/key/{key_id}/reset_spend"
 
     # info and health routes
@@ -540,6 +541,7 @@ class LiteLLMRoutes(enum.Enum):
         KeyManagementRoutes.KEY_BLOCK.value,
         KeyManagementRoutes.KEY_UNBLOCK.value,
         KeyManagementRoutes.KEY_BULK_UPDATE.value,
+        KeyManagementRoutes.TEAM_KEY_BULK_UPDATE.value,
         KeyManagementRoutes.TEAM_DAILY_ACTIVITY.value,
         KeyManagementRoutes.SPEND_LOGS.value,
         KeyManagementRoutes.KEY_RESET_SPEND.value,
diff --git a/litellm/proxy/auth/route_checks.py b/litellm/proxy/auth/route_checks.py
index 8bcfbb67539..a9c36dfc512 100644
--- a/litellm/proxy/auth/route_checks.py
+++ b/litellm/proxy/auth/route_checks.py
@@ -50,6 +50,7 @@ _PROXY_ADMIN_VIEW_ONLY_BLOCKED_ROUTES = frozenset(
         KeyManagementRoutes.KEY_BLOCK.value,
         KeyManagementRoutes.KEY_UNBLOCK.value,
         KeyManagementRoutes.KEY_BULK_UPDATE.value,
+        KeyManagementRoutes.TEAM_KEY_BULK_UPDATE.value,
     ]
 )
 
@@ -671,6 +672,7 @@ class RouteChecks:
             "/key/service-account/generate",
             "/key/block",
             "/key/unblock",
+            "/team/key/bulk_update",
         ]
     )
 
diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py
index b112af1fe20..4439a55c1c6 100644
--- a/litellm/proxy/management_endpoints/key_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/key_management_endpoints.py
@@ -88,8 +88,8 @@ from litellm.router import Router
 from litellm.secret_managers.main import get_secret
 from litellm.types.proxy.management_endpoints.key_management_endpoints import (
     BulkUpdateKeyRequest,
-    BulkUpdateKeyRequestItem,
     BulkUpdateKeyResponse,
+    BulkUpdateTeamKeysRequest,
     FailedKeyUpdate,
     SuccessfulKeyUpdate,
 )
@@ -1881,7 +1881,7 @@ async def _get_and_validate_existing_key(
 
 
 async def _process_single_key_update(
-    key_update_item: BulkUpdateKeyRequestItem,
+    update_key_request: UpdateKeyRequest,
     user_api_key_dict: UserAPIKeyAuth,
     litellm_changed_by: Optional[str],
     prisma_client: Optional[PrismaClient],
@@ -1889,6 +1889,7 @@ async def _process_single_key_update(
     proxy_logging_obj: Any,
     llm_router: Optional[Router],
     user_custom_key_update: Optional[Callable] = None,
+    existing_key_row: Optional[LiteLLM_VerificationToken] = None,
 ) -> Dict[str, Any]:
     """
     Process a single key update with all validations and checks.
@@ -1897,13 +1898,14 @@ async def _process_single_key_update(
     including validation, permission checks, team checks, and database updates.
 
     Args:
-        key_update_item: The key update request item
+        update_key_request: Fully-constructed UpdateKeyRequest for the target key
         user_api_key_dict: The authenticated user's API key info
         litellm_changed_by: Optional header for tracking who made the change
         prisma_client: Prisma client instance
         user_api_key_cache: User API key cache
         proxy_logging_obj: Proxy logging object
         llm_router: LLM router instance
+        existing_key_row: Optional pre-fetched key row to avoid redundant lookups
 
     Returns:
         Dict containing the updated key information
@@ -1912,13 +1914,14 @@ async def _process_single_key_update(
         HTTPException: For various validation and permission errors
     """
     # Validate max_budget
-    _validate_max_budget(key_update_item.max_budget)
+    _validate_max_budget(update_key_request.max_budget)
 
     # Get and validate existing key
-    existing_key_row = await _get_and_validate_existing_key(
-        token=key_update_item.key,
-        prisma_client=prisma_client,
-    )
+    if existing_key_row is None:
+        existing_key_row = await _get_and_validate_existing_key(
+            token=update_key_request.key,
+            prisma_client=prisma_client,
+        )
 
     # Check team member permissions
     if prisma_client is not None:
@@ -1930,15 +1933,6 @@ async def _process_single_key_update(
             user_api_key_cache=user_api_key_cache,
         )
 
-    # Create UpdateKeyRequest from BulkUpdateKeyRequestItem
-    update_key_request = UpdateKeyRequest(
-        key=key_update_item.key,
-        budget_id=key_update_item.budget_id,
-        max_budget=key_update_item.max_budget,
-        team_id=key_update_item.team_id,
-        tags=key_update_item.tags,
-    )
-
     # Custom key update hook
     if user_custom_key_update is not None:
         if inspect.iscoroutinefunction(user_custom_key_update):
@@ -2003,12 +1997,12 @@ async def _process_single_key_update(
             detail={"error": "Database not connected"},
         )
 
-    _data = {**non_default_values, "token": key_update_item.key}
-    response = await prisma_client.update_data(token=key_update_item.key, data=_data)
+    _data = {**non_default_values, "token": update_key_request.key}
+    response = await prisma_client.update_data(token=update_key_request.key, data=_data)
 
     # Delete cache
     await _delete_cache_key_object(
-        hashed_token=_hash_token_if_needed(key_update_item.key),
+        hashed_token=_hash_token_if_needed(update_key_request.key),
         user_api_key_cache=user_api_key_cache,
         proxy_logging_obj=proxy_logging_obj,
     )
@@ -2598,9 +2592,15 @@ async def bulk_update_keys(
 
     for key_update_item in data.keys:
         try:
-            # Process single key update using reusable function
+            update_key_request = UpdateKeyRequest(
+                key=key_update_item.key,
+                budget_id=key_update_item.budget_id,
+                max_budget=key_update_item.max_budget,
+                team_id=key_update_item.team_id,
+                tags=key_update_item.tags,
+            )
             updated_key_info = await _process_single_key_update(
-                key_update_item=key_update_item,
+                update_key_request=update_key_request,
                 user_api_key_dict=user_api_key_dict,
                 litellm_changed_by=litellm_changed_by,
                 prisma_client=prisma_client,
@@ -2665,6 +2665,223 @@ async def bulk_update_keys(
     )
 
 
+def _build_failed_team_key_update(
+    token: str,
+    exception: Exception,
+    existing_key_row: Optional[LiteLLM_VerificationToken],
+) -> FailedKeyUpdate:
+    """Normalize an exception from the per-key update loop into a FailedKeyUpdate."""
+    if isinstance(exception, HTTPException):
+        detail = exception.detail
+        if isinstance(detail, dict):
+            error_message = detail.get("error", str(exception))
+        else:
+            error_message = str(detail)
+    elif isinstance(exception, ProxyException):
+        error_message = exception.message
+    else:
+        error_message = str(exception)
+
+    key_info: Optional[Dict[str, Any]] = None
+    if existing_key_row is not None:
+        if hasattr(existing_key_row, "model_dump"):
+            key_info = existing_key_row.model_dump()
+        elif hasattr(existing_key_row, "dict"):
+            key_info = existing_key_row.dict()
+        if key_info:
+            key_info.pop("token", None)
+
+    return FailedKeyUpdate(key=token, key_info=key_info, failed_reason=error_message)
+
+
+@router.post(
+    "/team/key/bulk_update",
+    tags=["key management"],
+    dependencies=[Depends(user_api_key_auth)],
+    response_model=BulkUpdateKeyResponse,
+)
+@management_endpoint_wrapper
+async def bulk_update_team_keys(
+    data: BulkUpdateTeamKeysRequest,
+    user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
+    litellm_changed_by: Optional[str] = Header(
+        None,
+        description="The litellm-changed-by header enables tracking of actions performed by authorized users on behalf of other users, providing an audit trail for accountability",
+    ),
+):
+    """
+    Apply one update payload to many keys inside a single team.
+
+    Pass `team_id` plus either `key_ids` or `all_keys_in_team=True`. The
+    `update_fields` payload is broadcast to every selected key. Per-key
+    failures are returned in `failed_updates` rather than aborting the batch.
+
+    Callable by proxy admins, or by team admins with `KEY_UPDATE` permission.
+    """
+    from litellm.proxy.proxy_server import (
+        llm_router,
+        prisma_client,
+        proxy_logging_obj,
+        user_api_key_cache,
+        user_custom_key_update,
+    )
+
+    if prisma_client is None:
+        raise HTTPException(
+            status_code=500,
+            detail={"error": "Database not connected"},
+        )
+
+    if not data.team_id:
+        raise HTTPException(
+            status_code=400,
+            detail={"error": "team_id is required"},
+        )
+
+    MAX_BATCH_SIZE = 500
+    if data.key_ids is not None and len(data.key_ids) > MAX_BATCH_SIZE:
+        raise HTTPException(
+            status_code=400,
+            detail={
+                "error": f"Maximum {MAX_BATCH_SIZE} keys can be updated at once. Found {len(data.key_ids)} key_ids."
+            },
+        )
+
+    if data.all_keys_in_team:
+        # "all" excludes blocked/expired — bulk refresh shouldn't revive a key an admin disabled.
+        # `blocked` is Boolean? with no default; `/key/generate` writes NULL. Prisma's `NOT`
+        # excludes NULLs, so explicitly OR `false` with `null` to include them.
+        now = datetime.now(timezone.utc)
+        existing_keys = await prisma_client.db.litellm_verificationtoken.find_many(
+            where={
+                "team_id": data.team_id,
+                "AND": [
+                    {"OR": [{"blocked": False}, {"blocked": None}]},
+                    {"OR": [{"expires": None}, {"expires": {"gt": now}}]},
+                ],
+            },
+            order={"token": "asc"},
+            take=MAX_BATCH_SIZE + 1,
+        )
+        if len(existing_keys) > MAX_BATCH_SIZE:
+            raise HTTPException(
+                status_code=400,
+                detail={
+                    "error": f"Team {data.team_id} has more than {MAX_BATCH_SIZE} keys. Use `key_ids` to update in batches of {MAX_BATCH_SIZE}."
+                },
+            )
+        requested_tokens = [row.token for row in existing_keys]
+    else:
+        if data.key_ids is None or len(data.key_ids) == 0:
+            raise HTTPException(
+                status_code=400,
+                detail={
+                    "error": "key_ids must be provided when all_keys_in_team is False"
+                },
+            )
+        # Dedupe by hashed form — duplicates collapse to one update.
+        requested_tokens = []
+        hashed_key_ids = []
+        seen_hashes = set()
+        for k in data.key_ids:
+            h = _hash_token_if_needed(k)
+            if h in seen_hashes:
+                continue
+            seen_hashes.add(h)
+            requested_tokens.append(k)
+            hashed_key_ids.append(h)
+        existing_keys = await prisma_client.db.litellm_verificationtoken.find_many(
+            where={"team_id": data.team_id, "token": {"in": hashed_key_ids}}
+        )
+
+    # Anchor membership check on data.team_id (not existing_keys[0]); empty result must still gate non-admins.
+    if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN.value:
+        auth_anchor = (
+            existing_keys[0]
+            if existing_keys
+            else LiteLLM_VerificationToken(
+                token="__team_scope_auth_check__",
+                team_id=data.team_id,
+                models=[],
+            )
+        )
+        await TeamMemberPermissionChecks.can_team_member_execute_key_management_endpoint(
+            user_api_key_dict=user_api_key_dict,
+            route=KeyManagementRoutes.KEY_UPDATE,
+            prisma_client=prisma_client,
+            existing_key_row=auth_anchor,
+            user_api_key_cache=user_api_key_cache,
+        )
+
+    # Block metadata.allowed_passthrough_routes for non-admins — the runtime
+    # route checker reads it from key/team metadata to grant passthrough.
+    _check_passthrough_routes_caller_permission(
+        data=data.update_fields, user_api_key_dict=user_api_key_dict
+    )
+
+    if not requested_tokens:
+        raise HTTPException(
+            status_code=404,
+            detail={"error": f"No keys found for team {data.team_id}"},
+        )
+
+    existing_by_token = {row.token: row for row in existing_keys}
+    update_field_dict = data.update_fields.model_dump(exclude_unset=True)
+
+    successful_updates: List[SuccessfulKeyUpdate] = []
+    failed_updates: List[FailedKeyUpdate] = []
+
+    for token in requested_tokens:
+        db_token = _hash_token_if_needed(token)
+        try:
+            if db_token not in existing_by_token:
+                raise HTTPException(
+                    status_code=404,
+                    detail={"error": f"Key not found in team {data.team_id}"},
+                )
+
+            # team_id from validated scope, never user payload — drives _check_team_key_limits.
+            update_key_request = UpdateKeyRequest(
+                key=token,
+                team_id=data.team_id,
+                **update_field_dict,
+            )
+            updated_key_info = await _process_single_key_update(
+                update_key_request=update_key_request,
+                user_api_key_dict=user_api_key_dict,
+                litellm_changed_by=litellm_changed_by,
+                prisma_client=prisma_client,
+                user_api_key_cache=user_api_key_cache,
+                proxy_logging_obj=proxy_logging_obj,
+                llm_router=llm_router,
+                user_custom_key_update=user_custom_key_update,
+                existing_key_row=existing_by_token[db_token],
+            )
+
+            successful_updates.append(
+                SuccessfulKeyUpdate(key=token, key_info=updated_key_info)
+            )
+
+        except Exception as e:
+            # Log the hashed prefix — `token` may be a raw sk-... and ERROR logs persist.
+            verbose_proxy_logger.exception(
+                f"Failed to update key {db_token[:12]}... in team {data.team_id}: {e}"
+            )
+            failed_updates.append(
+                _build_failed_team_key_update(
+                    token=token,
+                    exception=e,
+                    existing_key_row=existing_by_token.get(db_token),
+                )
+            )
+
+    return BulkUpdateKeyResponse(
+        total_requested=len(requested_tokens),
+        successful_updates=successful_updates,
+        failed_updates=failed_updates,
+    )
+
+
 async def validate_key_team_change(
     key: LiteLLM_VerificationToken,
     team: LiteLLM_TeamTable,
diff --git a/litellm/types/proxy/management_endpoints/key_management_endpoints.py b/litellm/types/proxy/management_endpoints/key_management_endpoints.py
index b1d25455d18..d214cdb4f5d 100644
--- a/litellm/types/proxy/management_endpoints/key_management_endpoints.py
+++ b/litellm/types/proxy/management_endpoints/key_management_endpoints.py
@@ -1,6 +1,7 @@
-from typing import Any, Dict, List, Optional
+from datetime import datetime
+from typing import Any, Dict, List, Literal, Optional
 
-from pydantic import BaseModel
+from pydantic import BaseModel, ConfigDict, model_validator
 
 
 class BulkUpdateKeyRequestItem(BaseModel):
@@ -40,3 +41,78 @@ class BulkUpdateKeyResponse(BaseModel):
     total_requested: int
     successful_updates: List[SuccessfulKeyUpdate]
     failed_updates: List[FailedKeyUpdate]
+
+
+class KeyUpdateFields(BaseModel):
+    """Allowlist of bulk-broadcastable fields for /team/key/bulk_update; `extra="forbid"` blocks RBAC/ownership/scope mutations even by team admins."""
+
+    model_config = ConfigDict(extra="forbid", protected_namespaces=())
+
+    # Budgets
+    max_budget: Optional[float] = None
+    budget_id: Optional[str] = None
+    budget_duration: Optional[str] = None
+    budget_limits: Optional[List[Any]] = None
+    model_max_budget: Optional[Dict[str, Any]] = None
+
+    # Rate limits
+    tpm_limit: Optional[int] = None
+    rpm_limit: Optional[int] = None
+    model_tpm_limit: Optional[Dict[str, Any]] = None
+    model_rpm_limit: Optional[Dict[str, Any]] = None
+    max_parallel_requests: Optional[int] = None
+    rpm_limit_type: Optional[
+        Literal["guaranteed_throughput", "best_effort_throughput", "dynamic"]
+    ] = None
+    tpm_limit_type: Optional[
+        Literal["guaranteed_throughput", "best_effort_throughput", "dynamic"]
+    ] = None
+
+    # Temporary budget grants (auto-expire). `spend` deliberately omitted — bulk-zeroing it bypasses budget enforcement; admin-only via /key/update.
+    temp_budget_increase: Optional[float] = None
+    temp_budget_expiry: Optional[datetime] = None
+
+    # Expiry
+    duration: Optional[str] = None
+
+    # Operational metadata
+    tags: Optional[List[str]] = None
+    metadata: Optional[Dict[str, Any]] = None
+
+    @model_validator(mode="after")
+    def validate_temp_budget(self) -> "KeyUpdateFields":
+        if self.temp_budget_increase is not None or self.temp_budget_expiry is not None:
+            if self.temp_budget_increase is None or self.temp_budget_expiry is None:
+                raise ValueError(
+                    "temp_budget_increase and temp_budget_expiry must be set together"
+                )
+        return self
+
+    @model_validator(mode="after")
+    def require_at_least_one_field(self) -> "KeyUpdateFields":
+        # Reject empty payload — would iterate every key with no-op writes.
+        if not self.model_fields_set:
+            raise ValueError("update_fields must specify at least one field to update.")
+        return self
+
+
+class BulkUpdateTeamKeysRequest(BaseModel):
+    """Apply one update payload to many keys inside a team; provide either `key_ids` or `all_keys_in_team=True`."""
+
+    team_id: str
+    key_ids: Optional[List[str]] = None
+    all_keys_in_team: bool = False
+    update_fields: KeyUpdateFields
+
+    @model_validator(mode="after")
+    def validate_selection(self) -> "BulkUpdateTeamKeysRequest":
+        has_key_ids = self.key_ids is not None and len(self.key_ids) > 0
+        if has_key_ids and self.all_keys_in_team:
+            raise ValueError(
+                "Provide either `key_ids` or `all_keys_in_team=True`, not both."
+            )
+        if not has_key_ids and not self.all_keys_in_team:
+            raise ValueError(
+                "Must provide either `key_ids` (non-empty) or `all_keys_in_team=True`."
+            )
+        return self
diff --git a/tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py b/tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py
index b292e8d0cae..66716400c4f 100644
--- a/tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py
+++ b/tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py
@@ -5689,7 +5689,7 @@ async def test_process_single_key_update():
                             "litellm.proxy.management_endpoints.key_management_endpoints.KeyManagementEventHooks.async_key_updated_hook"
                         ):
                             # Create update request
-                            key_update_item = BulkUpdateKeyRequestItem(
+                            update_key_request = UpdateKeyRequest(
                                 key="test-key-123",
                                 max_budget=100.0,
                                 tags=["production"],
@@ -5703,7 +5703,7 @@ async def test_process_single_key_update():
 
                             # Call the function
                             result = await _process_single_key_update(
-                                key_update_item=key_update_item,
+                                update_key_request=update_key_request,
                                 user_api_key_dict=user_api_key_dict,
                                 litellm_changed_by=None,
                                 prisma_client=mock_prisma_client,
@@ -9855,9 +9855,6 @@ async def test_process_single_key_update_cache_invalidation_with_token_hash():
     from litellm.proxy.management_endpoints.key_management_endpoints import (
         _process_single_key_update,
     )
-    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
-        BulkUpdateKeyRequestItem,
-    )
 
     token_hash = "abc123def456"
 
@@ -9900,7 +9897,7 @@ async def test_process_single_key_update_cache_invalidation_with_token_hash():
             new_callable=AsyncMock,
         ),
     ):
-        key_update_item = BulkUpdateKeyRequestItem(
+        update_key_request = UpdateKeyRequest(
             key=token_hash,
             max_budget=100.0,
         )
@@ -9912,7 +9909,7 @@ async def test_process_single_key_update_cache_invalidation_with_token_hash():
         )
 
         await _process_single_key_update(
-            key_update_item=key_update_item,
+            update_key_request=update_key_request,
             user_api_key_dict=user_api_key_dict,
             litellm_changed_by=None,
             prisma_client=mock_prisma_client,
@@ -10019,3 +10016,583 @@ async def test_execute_virtual_key_regeneration_cache_invalidation_with_token_ha
         call_kwargs = mock_delete_cache.call_args.kwargs
         # The token hash should be passed as-is, NOT double-hashed
         assert call_kwargs["hashed_token"] == token_hash
+
+
+# ---------------------------------------------------------------------------
+# /team/key/bulk_update tests
+# ---------------------------------------------------------------------------
+
+
+_BULK_PKG = "litellm.proxy.management_endpoints.key_management_endpoints"
+
+
+def _make_team_key(token: str, team_id: str = "team-abc") -> LiteLLM_VerificationToken:
+    return LiteLLM_VerificationToken(
+        token=token,
+        user_id="user-123",
+        models=[],
+        team_id=team_id,
+        max_budget=None,
+    )
+
+
+def _admin() -> UserAPIKeyAuth:
+    return UserAPIKeyAuth(
+        user_role=LitellmUserRoles.PROXY_ADMIN, api_key="sk-admin", user_id="admin"
+    )
+
+
+def _internal_user() -> UserAPIKeyAuth:
+    return UserAPIKeyAuth(
+        user_role=LitellmUserRoles.INTERNAL_USER, api_key="sk-iu", user_id="iu"
+    )
+
+
+def _updated(payload):
+    m = MagicMock()
+    m.model_dump.return_value = payload
+    return m
+
+
+def _setup_team_keys_mocks(
+    monkeypatch,
+    *,
+    find_many=None,
+    find_unique=None,
+    update_data=None,
+    hash_identity=True,
+):
+    """Set up mocks for bulk_update_team_keys; returns mock_prisma."""
+    mock_prisma = AsyncMock()
+    mock_prisma.db.litellm_verificationtoken.find_many = AsyncMock(
+        return_value=[] if find_many is None else find_many
+    )
+    if find_unique is not None:
+        mock_prisma.db.litellm_verificationtoken.find_unique = find_unique
+    if update_data is not None:
+        mock_prisma.update_data = update_data
+    monkeypatch.setattr("litellm.proxy.proxy_server.prisma_client", mock_prisma)
+    monkeypatch.setattr("litellm.proxy.proxy_server.user_api_key_cache", MagicMock())
+    monkeypatch.setattr("litellm.proxy.proxy_server.proxy_logging_obj", MagicMock())
+    monkeypatch.setattr("litellm.proxy.proxy_server.llm_router", MagicMock())
+    monkeypatch.setattr("litellm.proxy.proxy_server.user_custom_key_update", None)
+    monkeypatch.setattr(
+        f"{_BULK_PKG}.prepare_key_update_data",
+        AsyncMock(return_value={"max_budget": 50.0}),
+    )
+    monkeypatch.setattr(f"{_BULK_PKG}._delete_cache_key_object", AsyncMock())
+    monkeypatch.setattr(
+        f"{_BULK_PKG}.KeyManagementEventHooks.async_key_updated_hook", AsyncMock()
+    )
+    monkeypatch.setattr(f"{_BULK_PKG}.get_team_object", AsyncMock(return_value=None))
+    monkeypatch.setattr(f"{_BULK_PKG}._check_team_key_limits", AsyncMock())
+    monkeypatch.setattr(
+        f"{_BULK_PKG}.TeamMemberPermissionChecks.can_team_member_execute_key_management_endpoint",
+        AsyncMock(),
+    )
+    if hash_identity:
+        # Tests use already-hashed tokens; the raw-sk regression opts out.
+        monkeypatch.setattr(f"{_BULK_PKG}._hash_token_if_needed", lambda token: token)
+    return mock_prisma
+
+
+async def _call_as_admin(data):
+    from litellm.proxy.management_endpoints.key_management_endpoints import (
+        bulk_update_team_keys,
+    )
+
+    return await bulk_update_team_keys(
+        data=data, user_api_key_dict=_admin(), litellm_changed_by=None
+    )
+
+
+# ---- happy paths ----------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_success_with_key_ids(monkeypatch):
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    keys = [_make_team_key("tok-a"), _make_team_key("tok-b")]
+    find_unique = AsyncMock(side_effect=keys)
+    mock = _setup_team_keys_mocks(
+        monkeypatch,
+        find_many=keys,
+        find_unique=find_unique,
+        update_data=AsyncMock(
+            side_effect=[{"data": _updated({"max_budget": 50.0})}] * 2
+        ),
+    )
+
+    response = await _call_as_admin(
+        BulkUpdateTeamKeysRequest(
+            team_id="team-abc",
+            key_ids=["tok-a", "tok-b"],
+            update_fields=KeyUpdateFields(max_budget=50.0),
+        )
+    )
+
+    assert len(response.successful_updates) == 2
+    assert len(response.failed_updates) == 0
+    where = mock.db.litellm_verificationtoken.find_many.await_args.kwargs["where"]
+    assert where["team_id"] == "team-abc"
+    assert where["token"] == {"in": ["tok-a", "tok-b"]}
+    find_unique.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_success_all_keys_in_team(monkeypatch):
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    keys = [_make_team_key(f"tok-{i}") for i in range(3)]
+    find_unique = AsyncMock(side_effect=keys)
+    mock = _setup_team_keys_mocks(
+        monkeypatch,
+        find_many=keys,
+        find_unique=find_unique,
+        update_data=AsyncMock(
+            side_effect=[{"data": _updated({"max_budget": 50.0})}] * 3
+        ),
+    )
+
+    response = await _call_as_admin(
+        BulkUpdateTeamKeysRequest(
+            team_id="team-abc",
+            all_keys_in_team=True,
+            update_fields=KeyUpdateFields(max_budget=50.0),
+        )
+    )
+
+    assert len(response.successful_updates) == 3
+    where = mock.db.litellm_verificationtoken.find_many.await_args.kwargs["where"]
+    # `blocked` is Boolean? with no default → /key/generate writes NULL. Prisma's
+    # NOT excludes NULLs, so the filter has to OR `false` with `null` explicitly.
+    blocked_or, expires_or = where["AND"][0]["OR"], where["AND"][1]["OR"]
+    assert {"blocked": False} in blocked_or and {"blocked": None} in blocked_or
+    assert {"expires": None} in expires_or
+    assert any(
+        "gt" in c.get("expires", {})
+        for c in expires_or
+        if isinstance(c.get("expires"), dict)
+    )
+    find_unique.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_key_not_in_team(monkeypatch):
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    in_team = _make_team_key("tok-a")
+    _setup_team_keys_mocks(
+        monkeypatch,
+        find_many=[in_team],
+        find_unique=AsyncMock(return_value=in_team),
+        update_data=AsyncMock(return_value={"data": _updated({"max_budget": 50.0})}),
+    )
+
+    response = await _call_as_admin(
+        BulkUpdateTeamKeysRequest(
+            team_id="team-abc",
+            key_ids=["tok-a", "tok-foreign"],
+            update_fields=KeyUpdateFields(max_budget=50.0),
+        )
+    )
+    assert [u.key for u in response.successful_updates] == ["tok-a"]
+    assert [u.key for u in response.failed_updates] == ["tok-foreign"]
+    assert "not found in team" in response.failed_updates[0].failed_reason
+
+
+# ---- error paths ----------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_batch_size_cap(monkeypatch):
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    _setup_team_keys_mocks(
+        monkeypatch,
+        find_many=[_make_team_key(f"tok-{i}") for i in range(501)],
+    )
+
+    with pytest.raises(HTTPException) as exc:
+        await _call_as_admin(
+            BulkUpdateTeamKeysRequest(
+                team_id="team-abc",
+                all_keys_in_team=True,
+                update_fields=KeyUpdateFields(max_budget=50.0),
+            )
+        )
+    assert exc.value.status_code == 400
+    assert "more than 500" in exc.value.detail["error"]
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_empty_team_returns_404(monkeypatch):
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    _setup_team_keys_mocks(monkeypatch, find_many=[])
+    with pytest.raises(HTTPException) as exc:
+        await _call_as_admin(
+            BulkUpdateTeamKeysRequest(
+                team_id="team-empty",
+                all_keys_in_team=True,
+                update_fields=KeyUpdateFields(max_budget=50.0),
+            )
+        )
+    assert exc.value.status_code == 404
+
+
+# ---- auth -----------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_team_member_with_permission(monkeypatch):
+    from litellm.proxy.management_endpoints.key_management_endpoints import (
+        bulk_update_team_keys,
+    )
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    key_a = _make_team_key("tok-a")
+    _setup_team_keys_mocks(
+        monkeypatch,
+        find_many=[key_a],
+        find_unique=AsyncMock(return_value=key_a),
+        update_data=AsyncMock(return_value={"data": _updated({"max_budget": 50.0})}),
+    )
+    auth_check = AsyncMock()
+    monkeypatch.setattr(
+        f"{_BULK_PKG}.TeamMemberPermissionChecks.can_team_member_execute_key_management_endpoint",
+        auth_check,
+    )
+
+    response = await bulk_update_team_keys(
+        data=BulkUpdateTeamKeysRequest(
+            team_id="team-abc",
+            all_keys_in_team=True,
+            update_fields=KeyUpdateFields(max_budget=50.0),
+        ),
+        user_api_key_dict=_internal_user(),
+        litellm_changed_by=None,
+    )
+    assert len(response.successful_updates) == 1
+    # Upfront check + per-key check inside _process_single_key_update
+    assert auth_check.await_count == 2
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_team_member_no_permission(monkeypatch):
+    from litellm.proxy.management_endpoints.key_management_endpoints import (
+        bulk_update_team_keys,
+    )
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    mock = _setup_team_keys_mocks(monkeypatch, find_many=[_make_team_key("tok-a")])
+    monkeypatch.setattr(
+        f"{_BULK_PKG}.TeamMemberPermissionChecks.can_team_member_execute_key_management_endpoint",
+        AsyncMock(
+            side_effect=ProxyException(
+                message="not in team",
+                type="team_member_permission_error",
+                param="/key/update",
+                code=401,
+            )
+        ),
+    )
+
+    with pytest.raises(ProxyException):
+        await bulk_update_team_keys(
+            data=BulkUpdateTeamKeysRequest(
+                team_id="team-abc",
+                all_keys_in_team=True,
+                update_fields=KeyUpdateFields(max_budget=1.0),
+            ),
+            user_api_key_dict=_internal_user(),
+            litellm_changed_by=None,
+        )
+    mock.update_data.assert_not_called()
+
+
+# ---- pydantic-layer validation -------------------------------------------
+
+
+def test_bulk_update_team_keys_request_validation():
+    """Allowlist (extra='forbid'), empty-payload rejection, and selection XOR."""
+    from pydantic import ValidationError
+
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    forbidden = [
+        "key",
+        "key_alias",
+        "team_id",
+        "allowed_routes",
+        "allowed_passthrough_routes",
+        "permissions",
+        "object_permission",
+        "access_group_ids",
+        "user_id",
+        "organization_id",
+        "blocked",
+        "key_type",
+        "models",
+        "config",
+        "router_settings",
+        "spend",
+    ]
+    for f in forbidden:
+        with pytest.raises(ValidationError, match=f):
+            KeyUpdateFields(**{f: True})
+
+    with pytest.raises(ValidationError, match="at least one"):
+        KeyUpdateFields()
+
+    assert KeyUpdateFields(max_budget=50.0, tags=["x"]).max_budget == 50.0
+
+    valid = KeyUpdateFields(max_budget=10)
+    with pytest.raises(ValidationError):
+        BulkUpdateTeamKeysRequest(
+            team_id="t", key_ids=["k"], all_keys_in_team=True, update_fields=valid
+        )
+    with pytest.raises(ValidationError):
+        BulkUpdateTeamKeysRequest(team_id="t", update_fields=valid)
+
+
+# ---- security regressions ------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_hashes_raw_sk_key_ids(monkeypatch):
+    """Regression: raw sk-... key_ids must be hashed before the find_many lookup."""
+    from litellm.proxy._types import hash_token
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    raw_sk = "sk-rawkey1234567890"
+    hashed = hash_token(raw_sk)
+    row = LiteLLM_VerificationToken(
+        token=hashed, user_id="u", models=[], team_id="team-abc", max_budget=None
+    )
+    mock = _setup_team_keys_mocks(
+        monkeypatch,
+        find_many=[row],
+        find_unique=AsyncMock(return_value=row),
+        update_data=AsyncMock(return_value={"data": _updated({"max_budget": 50.0})}),
+        hash_identity=False,
+    )
+
+    response = await _call_as_admin(
+        BulkUpdateTeamKeysRequest(
+            team_id="team-abc",
+            key_ids=[raw_sk],
+            update_fields=KeyUpdateFields(max_budget=50.0),
+        )
+    )
+    where = mock.db.litellm_verificationtoken.find_many.await_args.kwargs["where"]
+    assert where["token"] == {"in": [hashed]}
+    # Response reports the user-supplied form, not the hash.
+    assert response.successful_updates[0].key == raw_sk
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_auth_check_runs_when_no_keys_match(monkeypatch):
+    """Regression: non-admin with bogus key_ids must still hit the membership gate."""
+    from litellm.proxy.management_endpoints.key_management_endpoints import (
+        bulk_update_team_keys,
+    )
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    mock = _setup_team_keys_mocks(monkeypatch, find_many=[])
+    auth_check = AsyncMock(
+        side_effect=ProxyException(
+            message="not in team",
+            type="team_member_permission_error",
+            param="/key/update",
+            code=401,
+        )
+    )
+    monkeypatch.setattr(
+        f"{_BULK_PKG}.TeamMemberPermissionChecks.can_team_member_execute_key_management_endpoint",
+        auth_check,
+    )
+
+    with pytest.raises(ProxyException):
+        await bulk_update_team_keys(
+            data=BulkUpdateTeamKeysRequest(
+                team_id="victim-team",
+                key_ids=["bogus-1", "bogus-2"],
+                update_fields=KeyUpdateFields(max_budget=1.0),
+            ),
+            user_api_key_dict=_internal_user(),
+            litellm_changed_by=None,
+        )
+    # Anchored on data.team_id, not existing_keys[0].
+    assert auth_check.await_args.kwargs["existing_key_row"].team_id == "victim-team"
+    mock.update_data.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_does_not_log_raw_sk_token_on_failure(
+    monkeypatch, caplog
+):
+    """Regression: per-key failure must not log the raw sk-... (ERROR-level logs persist)."""
+    import logging
+
+    from litellm.proxy._types import hash_token
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    raw_sk = "sk-supersecret1234567890"
+    row = LiteLLM_VerificationToken(
+        token=hash_token(raw_sk),
+        user_id="u",
+        models=[],
+        team_id="team-abc",
+        max_budget=None,
+    )
+    _setup_team_keys_mocks(
+        monkeypatch,
+        find_many=[row],
+        update_data=AsyncMock(side_effect=RuntimeError("boom")),
+        hash_identity=False,
+    )
+
+    with caplog.at_level(logging.ERROR, logger="LiteLLM Proxy"):
+        response = await _call_as_admin(
+            BulkUpdateTeamKeysRequest(
+                team_id="team-abc",
+                key_ids=[raw_sk],
+                update_fields=KeyUpdateFields(max_budget=50.0),
+            )
+        )
+    assert len(response.failed_updates) == 1
+    log_text = "\n".join(r.getMessage() for r in caplog.records)
+    assert raw_sk not in log_text
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_propagates_team_id_to_per_key_request(monkeypatch):
+    """Regression: per-key UpdateKeyRequest carries data.team_id (gates _check_team_key_limits)."""
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    _setup_team_keys_mocks(monkeypatch, find_many=[_make_team_key("tok-a")])
+    captured = []
+
+    async def fake_process(*, update_key_request, **kw):
+        captured.append(update_key_request)
+        return {"max_budget": update_key_request.max_budget}
+
+    monkeypatch.setattr(f"{_BULK_PKG}._process_single_key_update", fake_process)
+
+    await _call_as_admin(
+        BulkUpdateTeamKeysRequest(
+            team_id="team-abc",
+            key_ids=["tok-a"],
+            update_fields=KeyUpdateFields(
+                tpm_limit=10_000, tpm_limit_type="guaranteed_throughput"
+            ),
+        )
+    )
+    assert captured[0].team_id == "team-abc"
+    assert captured[0].tpm_limit_type == "guaranteed_throughput"
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_dedupes_key_ids(monkeypatch):
+    """Duplicate key_ids collapse to a single update (no redundant DB writes, no inflated counts)."""
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    key_a = _make_team_key("tok-a")
+    update_data = AsyncMock(return_value={"data": _updated({"max_budget": 50.0})})
+    _setup_team_keys_mocks(
+        monkeypatch,
+        find_many=[key_a],
+        find_unique=AsyncMock(return_value=key_a),
+        update_data=update_data,
+    )
+
+    response = await _call_as_admin(
+        BulkUpdateTeamKeysRequest(
+            team_id="team-abc",
+            key_ids=["tok-a", "tok-a", "tok-a"],
+            update_fields=KeyUpdateFields(max_budget=50.0),
+        )
+    )
+
+    assert response.total_requested == 1
+    assert len(response.successful_updates) == 1
+    assert len(response.failed_updates) == 0
+    update_data.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+async def test_bulk_update_team_keys_blocks_metadata_allowed_passthrough_routes(
+    monkeypatch,
+):
+    """Non-admin can't grant passthrough access by smuggling allowed_passthrough_routes through metadata."""
+    from fastapi import HTTPException
+
+    from litellm.proxy.management_endpoints.key_management_endpoints import (
+        bulk_update_team_keys,
+    )
+    from litellm.types.proxy.management_endpoints.key_management_endpoints import (
+        BulkUpdateTeamKeysRequest,
+        KeyUpdateFields,
+    )
+
+    mock = _setup_team_keys_mocks(monkeypatch, find_many=[_make_team_key("tok-a")])
+
+    request = BulkUpdateTeamKeysRequest(
+        team_id="team-abc",
+        all_keys_in_team=True,
+        update_fields=KeyUpdateFields(
+            metadata={"allowed_passthrough_routes": ["/admin/*"]}
+        ),
+    )
+
+    with pytest.raises(HTTPException) as exc:
+        await bulk_update_team_keys(
+            data=request,
+            user_api_key_dict=_internal_user(),
+            litellm_changed_by=None,
+        )
+
+    assert exc.value.status_code == 403
+    assert "allowed_passthrough_routes" in str(exc.value.detail)
+    mock.update_data.assert_not_called()

From 2b4beae29a3025d5f6dc24cd42c76cbd713fc603 Mon Sep 17 00:00:00 2001
From: Noah Nistler <60981020+noahnistler@users.noreply.github.com>
Date: Sat, 9 May 2026 15:14:40 -0500
Subject: [PATCH 23/33] Fix/shared health check polling (#26434)

Squash-merged by litellm-agent from noahnistler's PR.
---
 .../shared_health_check_manager.py            |  62 ++++++--
 .../proxy/test_shared_health_check.py         | 143 ++++++++++++++++--
 2 files changed, 180 insertions(+), 25 deletions(-)

diff --git a/litellm/proxy/health_check_utils/shared_health_check_manager.py b/litellm/proxy/health_check_utils/shared_health_check_manager.py
index 5b8370fece8..ad58bc7e286 100644
--- a/litellm/proxy/health_check_utils/shared_health_check_manager.py
+++ b/litellm/proxy/health_check_utils/shared_health_check_manager.py
@@ -253,27 +253,63 @@ class SharedHealthCheckManager:
                 # Always release the lock
                 await self.release_health_check_lock()
         else:
-            # Lock not acquired, wait briefly and try to get cached results
+            # If Redis is not configured, skip polling — there is no cache
+            # to wait for.
+            if self.redis_cache is None:
+                return await perform_health_check(
+                    model_list=model_list,
+                    details=details,
+                    max_concurrency=max_concurrency,
+                )
+
+            # Lock not acquired — poll for cached results until the lock
+            # holder finishes or the lock expires, rather than falling back
+            # to a redundant local health check after only 2 seconds.
             verbose_proxy_logger.debug(
                 "Pod %s waiting for other pod to complete health check", self.pod_id
             )
 
-            # Wait a bit for the other pod to complete
-            await asyncio.sleep(2)
+            poll_interval = 5  # seconds between cache checks
+            max_wait = self.lock_ttl  # wait at most as long as the lock can live
+            elapsed = 0
 
-            # Try to get cached results again
-            cached_results = await self.get_cached_health_check_results()
-            if cached_results is not None:
-                return (
-                    cached_results.get("healthy_endpoints", []),
-                    cached_results.get("unhealthy_endpoints", []),
-                    {},
-                )
+            while elapsed < max_wait:
+                await asyncio.sleep(poll_interval)
+                elapsed += poll_interval
 
-            # Still no cache, fall back to local health check
+                cached_results = await self.get_cached_health_check_results()
+                if cached_results is not None:
+                    verbose_proxy_logger.info(
+                        "Pod %s using cached health check results after waiting %ds",
+                        self.pod_id,
+                        elapsed,
+                    )
+                    return (
+                        cached_results.get("healthy_endpoints", []),
+                        cached_results.get("unhealthy_endpoints", []),
+                        {},
+                    )
+
+                # Check if the lock is still held — if it was released without
+                # caching (e.g. the holder crashed), stop waiting early.
+                try:
+                    lock_key = self.get_health_check_lock_key()
+                    current_owner = await self.redis_cache.async_get_cache(lock_key)
+                    if current_owner is None:
+                        verbose_proxy_logger.debug(
+                            "Pod %s detected lock released without cache, stopping wait",
+                            self.pod_id,
+                        )
+                        break
+                except Exception:
+                    # Redis hiccup — continue polling rather than crashing out
+                    pass
+
+            # Exhausted wait — fall back to local health check
             verbose_proxy_logger.warning(
-                "Pod %s falling back to local health check (no cache available)",
+                "Pod %s falling back to local health check after waiting %ds (no cache available)",
                 self.pod_id,
+                elapsed,
             )
 
             return await perform_health_check(
diff --git a/tests/test_litellm/proxy/test_shared_health_check.py b/tests/test_litellm/proxy/test_shared_health_check.py
index 04099f2634b..1530d336085 100644
--- a/tests/test_litellm/proxy/test_shared_health_check.py
+++ b/tests/test_litellm/proxy/test_shared_health_check.py
@@ -322,13 +322,13 @@ class TestSharedHealthCheckManager:
     async def test_perform_shared_health_check_lock_failed_then_cache(
         self, shared_health_manager, mock_redis_cache
     ):
-        """Test performing shared health check when lock fails but cache becomes available"""
+        """Test performing shared health check when lock fails but cache becomes available during polling"""
         # First call: no cache, lock fails
-        # Second call: cache available
+        # Polling finds cache on first iteration
         mock_redis_cache.async_get_cache.side_effect = [
-            None,  # No cache initially
+            None,  # No cache initially (get_cached_health_check_results)
             json.dumps(
-                {  # Cache available after waiting
+                {  # Cache available on first poll iteration
                     "healthy_endpoints": [{"model": "cached-model"}],
                     "unhealthy_endpoints": [],
                     "healthy_count": 1,
@@ -350,18 +350,68 @@ class TestSharedHealthCheckManager:
                 )
             )
 
-        # Should wait and then get cached results
-        mock_sleep.assert_called_once_with(2)
+        # Should poll once (5s interval) and find cached results
+        mock_sleep.assert_called_once_with(5)
         assert healthy == [{"model": "cached-model"}]
         assert unhealthy == []
 
     @pytest.mark.asyncio
-    async def test_perform_shared_health_check_fallback(
+    async def test_perform_shared_health_check_fallback(self, mock_redis_cache):
+        """Test performing shared health check with fallback to local health check"""
+        # Use short lock_ttl so the polling loop only runs 2 iterations
+        manager = SharedHealthCheckManager(
+            redis_cache=mock_redis_cache,
+            health_check_ttl=300,
+            lock_ttl=10,
+        )
+
+        # No cache ever, lock always held by another pod
+        mock_redis_cache.async_get_cache.side_effect = [
+            None,  # Initial cache check
+            None,  # Iteration 1: cache check
+            "other_pod",  # Iteration 1: lock check (still held)
+            None,  # Iteration 2: cache check
+            "other_pod",  # Iteration 2: lock check (still held)
+        ]
+        mock_redis_cache.async_set_cache.return_value = False  # Lock acquisition fails
+
+        model_list = [
+            {"model_name": "test-model", "litellm_params": {"model": "test-model"}}
+        ]
+        expected_healthy = [{"model": "test-model", "status": "healthy"}]
+        expected_unhealthy = []
+
+        with (
+            patch("asyncio.sleep") as mock_sleep,
+            patch(
+                "litellm.proxy.health_check_utils.shared_health_check_manager.perform_health_check"
+            ) as mock_perform,
+        ):
+            mock_perform.return_value = (expected_healthy, expected_unhealthy, {})
+
+            healthy, unhealthy, _ = await manager.perform_shared_health_check(
+                model_list, details=True
+            )
+
+        # Should poll twice (5s * 2 = 10s >= lock_ttl) then fall back
+        assert mock_sleep.call_count == 2
+        mock_sleep.assert_called_with(5)
+        mock_perform.assert_called_once_with(
+            model_list=model_list, details=True, max_concurrency=None
+        )
+        assert healthy == expected_healthy
+        assert unhealthy == expected_unhealthy
+
+    @pytest.mark.asyncio
+    async def test_perform_shared_health_check_early_exit_orphaned_lock(
         self, shared_health_manager, mock_redis_cache
     ):
-        """Test performing shared health check with fallback to local health check"""
-        # No cache, lock fails, no cache after waiting
-        mock_redis_cache.async_get_cache.return_value = None
+        """Test that polling exits early when the lock disappears without a cache write (crash recovery)"""
+        mock_redis_cache.async_get_cache.side_effect = [
+            None,  # Initial cache check
+            None,  # Iteration 1: cache check (still no cache)
+            None,  # Iteration 1: lock check -> lock gone (holder crashed)
+        ]
         mock_redis_cache.async_set_cache.return_value = False  # Lock acquisition fails
 
         model_list = [
@@ -384,8 +434,77 @@ class TestSharedHealthCheckManager:
                 )
             )
 
-        # Should fall back to local health check
-        mock_sleep.assert_called_once_with(2)
+        # Should detect orphaned lock after 1 iteration and fall back immediately
+        mock_sleep.assert_called_once_with(5)
+        mock_perform.assert_called_once_with(
+            model_list=model_list, details=True, max_concurrency=None
+        )
+        assert healthy == expected_healthy
+        assert unhealthy == expected_unhealthy
+
+    @pytest.mark.asyncio
+    async def test_perform_shared_health_check_redis_error_during_polling(
+        self, shared_health_manager, mock_redis_cache
+    ):
+        """Test that a transient Redis error during lock polling doesn't crash the loop"""
+        cached_data = json.dumps(
+            {
+                "healthy_endpoints": [{"model": "cached-model"}],
+                "unhealthy_endpoints": [],
+                "healthy_count": 1,
+                "unhealthy_count": 0,
+                "timestamp": time.time() - 100,
+            }
+        )
+        mock_redis_cache.async_get_cache.side_effect = [
+            None,  # Initial cache check
+            None,  # Iteration 1: cache check
+            Exception("Redis connection lost"),  # Iteration 1: lock check errors
+            cached_data,  # Iteration 2: cache check -> found!
+        ]
+        mock_redis_cache.async_set_cache.return_value = False  # Lock acquisition fails
+
+        model_list = [
+            {"model_name": "test-model", "litellm_params": {"model": "test-model"}}
+        ]
+
+        with patch("asyncio.sleep") as mock_sleep:
+            healthy, unhealthy, _ = (
+                await shared_health_manager.perform_shared_health_check(
+                    model_list, details=True
+                )
+            )
+
+        # Should survive the Redis error and find cache on iteration 2
+        assert mock_sleep.call_count == 2
+        assert healthy == [{"model": "cached-model"}]
+        assert unhealthy == []
+
+    @pytest.mark.asyncio
+    async def test_perform_shared_health_check_no_redis_skips_polling(self):
+        """Test that polling is skipped entirely when redis_cache is None"""
+        manager = SharedHealthCheckManager(redis_cache=None)
+
+        model_list = [
+            {"model_name": "test-model", "litellm_params": {"model": "test-model"}}
+        ]
+        expected_healthy = [{"model": "test-model", "status": "healthy"}]
+        expected_unhealthy = []
+
+        with (
+            patch("asyncio.sleep") as mock_sleep,
+            patch(
+                "litellm.proxy.health_check_utils.shared_health_check_manager.perform_health_check"
+            ) as mock_perform,
+        ):
+            mock_perform.return_value = (expected_healthy, expected_unhealthy, {})
+
+            healthy, unhealthy, _ = await manager.perform_shared_health_check(
+                model_list, details=True
+            )
+
+        # Should NOT sleep at all — falls back to local health check immediately
+        mock_sleep.assert_not_called()
         mock_perform.assert_called_once_with(
             model_list=model_list, details=True, max_concurrency=None
         )

From 0f908e6885c31a390a393e1475b638e7382a162b Mon Sep 17 00:00:00 2001
From: Tai An <antai12232931@outlook.com>
Date: Sat, 9 May 2026 13:23:15 -0700
Subject: [PATCH 24/33] fix(proxy): resolve provider from deployment for
 multi-provider defaultconfig (#27516) (#27517)

Squash-merged by litellm-agent from Anai-Guo's PR.
---
 litellm/proxy/litellm_pre_call_utils.py       |  55 +++++-
 .../proxy/test_litellm_pre_call_utils.py      | 172 ++++++++++++++++++
 2 files changed, 226 insertions(+), 1 deletion(-)

diff --git a/litellm/proxy/litellm_pre_call_utils.py b/litellm/proxy/litellm_pre_call_utils.py
index a63613c5836..9d7d6f476ac 100644
--- a/litellm/proxy/litellm_pre_call_utils.py
+++ b/litellm/proxy/litellm_pre_call_utils.py
@@ -1731,6 +1731,7 @@ async def add_litellm_data_to_request(  # noqa: PLR0915
         data=data,
         user_api_key_dict=user_api_key_dict,
         pre_alias_model_name=_pre_alias_model,
+        llm_router=llm_router,
     )
 
     ## ENFORCED PARAMS CHECK
@@ -1864,6 +1865,7 @@ def _apply_credential_overrides_from_model_config(
     data: dict,
     user_api_key_dict: UserAPIKeyAuth,
     pre_alias_model_name: Optional[str] = None,
+    llm_router: Optional[Router] = None,
 ) -> None:
     """
     Walk the model_config precedence chain in team/project metadata.
@@ -1899,10 +1901,19 @@ def _apply_credential_overrides_from_model_config(
     if not project_model_config and not team_model_config:
         return
 
-    # Extract provider hint from model name (e.g. "azure/gpt-4" -> "azure")
+    # Extract provider hint from model name (e.g. "azure/gpt-4" -> "azure").
+    # When the user-facing name has no provider prefix, fall back to the
+    # deployment's litellm_params so multi-provider defaultconfig entries
+    # don't silently match the first dict key (#27516).
     provider: Optional[str] = None
     if "/" in model_name:
         provider = model_name.split("/", 1)[0]
+    elif llm_router is not None:
+        provider = _resolve_provider_from_deployment(
+            llm_router=llm_router,
+            model_name=model_name,
+            pre_alias_model_name=pre_alias_model_name,
+        )
 
     credential_name = _resolve_credential_from_model_config(
         model_name=model_name,
@@ -1938,6 +1949,48 @@ def _apply_credential_overrides_from_model_config(
     )
 
 
+def _resolve_provider_from_deployment(
+    llm_router: Router,
+    model_name: str,
+    pre_alias_model_name: Optional[str] = None,
+) -> Optional[str]:
+    """
+    Resolve a provider hint from the deployment's litellm_params when the
+    user-facing model name has no provider prefix.
+
+    Tries the post-alias name first (the resolved model group), then the
+    pre-alias name. Returns None if no deployment is found or the deployment
+    has no usable provider info.
+    """
+    candidates = [model_name]
+    if pre_alias_model_name and pre_alias_model_name != model_name:
+        candidates.append(pre_alias_model_name)
+
+    for name in candidates:
+        try:
+            deployment = llm_router.get_deployment_by_model_group_name(
+                model_group_name=name
+            )
+        except Exception:
+            deployment = None
+        if deployment is None:
+            continue
+
+        litellm_params = getattr(deployment, "litellm_params", None)
+        if litellm_params is None:
+            continue
+
+        custom_provider = getattr(litellm_params, "custom_llm_provider", None)
+        if custom_provider:
+            return custom_provider
+
+        deployment_model = getattr(litellm_params, "model", "") or ""
+        if "/" in deployment_model:
+            return deployment_model.split("/", 1)[0]
+
+    return None
+
+
 def _resolve_credential_from_model_config(
     model_name: str,
     project_model_config: Optional[dict],
diff --git a/tests/test_litellm/proxy/test_litellm_pre_call_utils.py b/tests/test_litellm/proxy/test_litellm_pre_call_utils.py
index 92611431a15..b803dfb709a 100644
--- a/tests/test_litellm/proxy/test_litellm_pre_call_utils.py
+++ b/tests/test_litellm/proxy/test_litellm_pre_call_utils.py
@@ -21,6 +21,7 @@ from litellm.proxy.litellm_pre_call_utils import (
     _get_enforced_params,
     _get_metadata_variable_name,
     _resolve_credential_from_model_config,
+    _resolve_provider_from_deployment,
     _update_model_if_key_alias_exists,
     add_guardrails_from_policy_engine,
     add_litellm_data_to_request,
@@ -4043,3 +4044,174 @@ def test_get_guardrail_from_metadata_reads_litellm_metadata_when_no_metadata():
     assert result == [
         "my-guardrail"
     ], f"Expected guardrails from litellm_metadata fallback, got: {result}"
+
+
+# ============================================================================
+# Tests for #27516: provider hint resolution from deployment when the
+# user-facing model name has no provider prefix.
+# ============================================================================
+
+
+def test_resolve_provider_from_deployment_uses_litellm_params_model():
+    """When custom_llm_provider is unset, fall back to the prefix of model."""
+    router = MagicMock()
+    deployment = MagicMock()
+    deployment.litellm_params.model = "bedrock/us.anthropic.claude-sonnet-4-6"
+    deployment.litellm_params.custom_llm_provider = None
+    router.get_deployment_by_model_group_name.return_value = deployment
+
+    assert (
+        _resolve_provider_from_deployment(router, "claude-sonnet-4.6") == "bedrock"
+    )
+
+
+def test_resolve_provider_from_deployment_prefers_custom_llm_provider():
+    """Explicit custom_llm_provider on the deployment wins over model prefix."""
+    router = MagicMock()
+    deployment = MagicMock()
+    deployment.litellm_params.model = "us.anthropic.claude-sonnet-4-6"
+    deployment.litellm_params.custom_llm_provider = "bedrock"
+    router.get_deployment_by_model_group_name.return_value = deployment
+
+    assert (
+        _resolve_provider_from_deployment(router, "claude-sonnet-4.6") == "bedrock"
+    )
+
+
+def test_resolve_provider_from_deployment_no_match():
+    """No deployment for the model group -> None."""
+    router = MagicMock()
+    router.get_deployment_by_model_group_name.return_value = None
+    assert _resolve_provider_from_deployment(router, "unknown-model") is None
+
+
+def test_resolve_provider_from_deployment_router_raises():
+    """Router exceptions must not propagate — fall back to None."""
+    router = MagicMock()
+    router.get_deployment_by_model_group_name.side_effect = RuntimeError("boom")
+    assert _resolve_provider_from_deployment(router, "claude-sonnet-4.6") is None
+
+
+def test_resolve_provider_from_deployment_falls_back_to_pre_alias():
+    """If post-alias lookup fails, the pre-alias name is also tried."""
+    router = MagicMock()
+    deployment = MagicMock()
+    deployment.litellm_params.model = "bedrock/anthropic.claude-sonnet-4-6"
+    deployment.litellm_params.custom_llm_provider = None
+
+    def lookup(model_group_name):
+        if model_group_name == "pre-alias-name":
+            return deployment
+        return None
+
+    router.get_deployment_by_model_group_name.side_effect = lookup
+
+    result = _resolve_provider_from_deployment(
+        router, "post-alias-name", pre_alias_model_name="pre-alias-name"
+    )
+    assert result == "bedrock"
+
+
+def test_apply_overrides_multi_provider_default_picks_correct_provider(
+    setup_test_credentials,
+):
+    """
+    Regression for #27516: when defaultconfig has multiple providers and the
+    request model has no '/' prefix, the deployment's custom_llm_provider must
+    drive provider matching instead of falling through to dict insertion order.
+    """
+    litellm.credential_list.append(
+        CredentialItem(
+            credential_name="bedrock-team-1",
+            credential_info={},
+            credential_values={"api_key": "ABSK-bedrock-key-for-team-1"},
+        )
+    )
+    litellm.credential_list.append(
+        CredentialItem(
+            credential_name="gemini-team-1",
+            credential_info={},
+            credential_values={"api_key": "gemini-key-for-team-1"},
+        )
+    )
+
+    data = {"model": "claude-sonnet-4.6"}
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key="test-key",
+        team_metadata={
+            "model_config": {
+                "defaultconfig": {
+                    # gemini comes first in insertion order — the bug picked it.
+                    "gemini": {"litellm_credentials": "gemini-team-1"},
+                    "bedrock": {"litellm_credentials": "bedrock-team-1"},
+                }
+            }
+        },
+    )
+
+    router = MagicMock()
+    deployment = MagicMock()
+    deployment.litellm_params.model = "us.anthropic.claude-sonnet-4-6"
+    deployment.litellm_params.custom_llm_provider = "bedrock"
+    router.get_deployment_by_model_group_name.return_value = deployment
+
+    _apply_credential_overrides_from_model_config(
+        data=data,
+        user_api_key_dict=user_api_key_dict,
+        llm_router=router,
+    )
+    assert data["api_key"] == "ABSK-bedrock-key-for-team-1"
+
+
+def test_apply_overrides_no_router_keeps_legacy_behaviour(setup_test_credentials):
+    """
+    Without a router, the function still works for the single-provider case
+    (the historical behaviour). Multi-provider configs with no '/' prefix
+    keep the legacy first-entry behaviour because there is no way to
+    disambiguate — this preserves backwards compatibility.
+    """
+    data = {"model": "gpt-4"}
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key="test-key",
+        team_metadata={
+            "model_config": {
+                "defaultconfig": {
+                    "azure": {"litellm_credentials": "hotel-azure-eastus"}
+                }
+            }
+        },
+    )
+    _apply_credential_overrides_from_model_config(
+        data=data, user_api_key_dict=user_api_key_dict, llm_router=None
+    )
+    assert data["api_base"] == "https://hotel-eastus.openai.azure.com/"
+    assert data["api_key"] == "key-hotel-eastus"
+
+
+def test_apply_overrides_provider_prefix_in_model_skips_router_lookup(
+    setup_test_credentials,
+):
+    """
+    When the request model already has a 'provider/...' prefix, the router
+    lookup must be skipped — the explicit prefix is authoritative.
+    """
+    data = {"model": "azure/gpt-4"}
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key="test-key",
+        team_metadata={
+            "model_config": {
+                "defaultconfig": {
+                    "azure": {"litellm_credentials": "hotel-azure-eastus"},
+                    "bedrock": {"litellm_credentials": "hotel-rec-azure"},
+                }
+            }
+        },
+    )
+
+    router = MagicMock()
+    _apply_credential_overrides_from_model_config(
+        data=data, user_api_key_dict=user_api_key_dict, llm_router=router
+    )
+    assert data["api_base"] == "https://hotel-eastus.openai.azure.com/"
+    assert data["api_key"] == "key-hotel-eastus"
+    router.get_deployment_by_model_group_name.assert_not_called()

From f8b078b749f342a9e803a68af6d6e4b16e6c2ece Mon Sep 17 00:00:00 2001
From: Tai An <antai12232931@outlook.com>
Date: Sat, 9 May 2026 13:26:37 -0700
Subject: [PATCH 25/33] fix(bedrock/messages): preserve compact_20260112
 context_management on /v1/messages (#27534)

Squash-merged by litellm-agent from Anai-Guo's PR.
---
 .../anthropic_claude3_transformation.py       | 51 +++++++++++-
 litellm/types/llms/bedrock.py                 |  7 ++
 .../test_anthropic_claude3_transformation.py  | 79 ++++++++++++++++++-
 3 files changed, 132 insertions(+), 5 deletions(-)

diff --git a/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py b/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py
index aae2bc5e289..151e0e404a0 100644
--- a/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py
+++ b/litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py
@@ -408,6 +408,47 @@ class AmazonAnthropicClaudeMessagesConfig(
             if self._supports_tool_search_on_bedrock(model):
                 beta_set.add("tool-search-tool-2025-10-19")
 
+    @staticmethod
+    def _filter_context_management_for_bedrock_invoke(
+        anthropic_messages_request: Dict,
+        beta_set: set,
+    ) -> None:
+        """
+        Bedrock InvokeModel accepts ``context_management`` only when it carries
+        ``compact_20260112`` edits paired with the ``compact-2026-01-12``
+        anthropic-beta header. Other edit types (notably ``clear_thinking_20251015``,
+        which Claude Code sends on every request) are LiteLLM-internal and would
+        cause Bedrock to 400 with ``"context_management: Extra inputs are not
+        permitted"``.
+
+        Filter the edits list to the supported subset, add the beta header when
+        compact edits remain, and drop ``context_management`` entirely when no
+        supported edits are left so the safety-net allowlist can pass it through.
+
+        Ref: https://github.com/BerriAI/litellm/issues/27532
+        """
+        cm = anthropic_messages_request.get("context_management")
+        if not isinstance(cm, dict):
+            return
+        edits = cm.get("edits")
+        if not isinstance(edits, list):
+            anthropic_messages_request.pop("context_management", None)
+            return
+
+        compact_edits = [
+            e
+            for e in edits
+            if isinstance(e, dict) and e.get("type") == "compact_20260112"
+        ]
+        if compact_edits:
+            beta_set.add("compact-2026-01-12")
+            anthropic_messages_request["context_management"] = {
+                **cm,
+                "edits": compact_edits,
+            }
+        else:
+            anthropic_messages_request.pop("context_management", None)
+
     def _convert_output_format_to_inline_schema(
         self,
         output_format: Dict,
@@ -551,6 +592,11 @@ class AmazonAnthropicClaudeMessagesConfig(
         if injected_thinking_for_clear_thinking:
             beta_set.add("interleaved-thinking-2025-05-14")
 
+        self._filter_context_management_for_bedrock_invoke(
+            anthropic_messages_request=anthropic_messages_request,
+            beta_set=beta_set,
+        )
+
         self._get_tool_search_beta_header_for_bedrock(
             model=model,
             tool_search_used=tool_search_used,
@@ -597,8 +643,9 @@ class AmazonAnthropicClaudeMessagesConfig(
             anthropic_messages_request.pop("output_config", None)
 
         # 7. Final safety net: filter top-level fields to the Bedrock Invoke allowlist.
-        # Catches Anthropic-only extensions (context_management, output_config, speed,
-        # mcp_servers, ...) and any future additions Claude Code may start sending.
+        # Catches Anthropic-only extensions (output_config, speed, mcp_servers, ...)
+        # and any future additions Claude Code may start sending. ``context_management``
+        # has already been pre-filtered to its Bedrock-supported subset above.
         allowed = self.BEDROCK_INVOKE_ALLOWED_TOP_LEVEL_FIELDS
         stripped = sorted(k for k in anthropic_messages_request if k not in allowed)
         if stripped:
diff --git a/litellm/types/llms/bedrock.py b/litellm/types/llms/bedrock.py
index 64827db13f6..5db2a45054a 100644
--- a/litellm/types/llms/bedrock.py
+++ b/litellm/types/llms/bedrock.py
@@ -1042,3 +1042,10 @@ class BedrockInvokeAnthropicMessagesRequest(TypedDict, total=False):
     thinking: dict
     metadata: dict
     output_config: dict
+
+    # `context_management` is allowed for Bedrock InvokeModel only when it
+    # carries `compact_20260112` edits paired with the `compact-2026-01-12`
+    # anthropic-beta header. The Invoke transformation filters edits to the
+    # supported subset and strips the field entirely when nothing remains, so
+    # other edit types (e.g. `clear_thinking_20251015`) never reach Bedrock.
+    context_management: dict
diff --git a/tests/test_litellm/llms/bedrock/messages/invoke_transformations/test_anthropic_claude3_transformation.py b/tests/test_litellm/llms/bedrock/messages/invoke_transformations/test_anthropic_claude3_transformation.py
index c98f7840343..9ecdad1fcff 100644
--- a/tests/test_litellm/llms/bedrock/messages/invoke_transformations/test_anthropic_claude3_transformation.py
+++ b/tests/test_litellm/llms/bedrock/messages/invoke_transformations/test_anthropic_claude3_transformation.py
@@ -867,10 +867,12 @@ def test_bedrock_messages_explicit_output_config_wins_over_reasoning_effort():
 def test_bedrock_messages_strips_context_management():
     """
     Ensure context_management is stripped from the request before sending to
-    Bedrock Invoke, which doesn't support this Anthropic-specific parameter.
+    Bedrock Invoke when it carries only LiteLLM-internal edits (e.g.
+    clear_thinking_20251015, which is consumed via thinking injection).
 
-    Claude Code sends context_management on every request; leaving it in the body
-    causes a 400 "context_management: Extra inputs are not permitted" from Bedrock.
+    Claude Code sends context_management on every request; leaving such edits
+    in the body causes a 400 "context_management: Extra inputs are not
+    permitted" from Bedrock.
     """
     from litellm.types.router import GenericLiteLLMParams
 
@@ -897,6 +899,77 @@ def test_bedrock_messages_strips_context_management():
     assert result.get("max_tokens") == 4096
 
 
+def test_bedrock_messages_preserves_compact_context_management_and_adds_beta():
+    """
+    Bedrock InvokeModel supports compaction when paired with the
+    ``compact-2026-01-12`` anthropic-beta header, even though the Converse API
+    does not. The transformation should:
+      1. Keep ``context_management`` with compact_20260112 edits in the body
+         (Bedrock rejects unknown top-level fields, but accepts this one with
+         the right beta).
+      2. Auto-inject ``compact-2026-01-12`` into ``anthropic_beta``.
+
+    Ref: https://github.com/BerriAI/litellm/issues/27532
+    """
+    from litellm.types.router import GenericLiteLLMParams
+
+    cfg = AmazonAnthropicClaudeMessagesConfig()
+    messages = [{"role": "user", "content": [{"type": "text", "text": "Hi"}]}]
+    optional_params = {
+        "max_tokens": 4096,
+        "context_management": {
+            "edits": [{"type": "compact_20260112"}]
+        },
+    }
+
+    result = cfg.transform_anthropic_messages_request(
+        model="anthropic.claude-sonnet-4-6-20250929-v1:0",
+        messages=messages,
+        anthropic_messages_optional_request_params=optional_params,
+        litellm_params=GenericLiteLLMParams(),
+        headers={},
+    )
+
+    assert result.get("context_management") == {
+        "edits": [{"type": "compact_20260112"}]
+    }
+    assert "compact-2026-01-12" in result.get("anthropic_beta", [])
+    assert result["max_tokens"] == 4096
+
+
+def test_bedrock_messages_filters_unsupported_context_management_edits():
+    """
+    Mixed edit lists must drop the LiteLLM-internal ``clear_thinking_20251015``
+    entries while keeping ``compact_20260112`` and adding the compact beta.
+    """
+    from litellm.types.router import GenericLiteLLMParams
+
+    cfg = AmazonAnthropicClaudeMessagesConfig()
+    messages = [{"role": "user", "content": [{"type": "text", "text": "Hi"}]}]
+    optional_params = {
+        "max_tokens": 4096,
+        "context_management": {
+            "edits": [
+                {"type": "clear_thinking_20251015", "keep": "all"},
+                {"type": "compact_20260112"},
+            ]
+        },
+    }
+
+    result = cfg.transform_anthropic_messages_request(
+        model="anthropic.claude-sonnet-4-6-20250929-v1:0",
+        messages=messages,
+        anthropic_messages_optional_request_params=optional_params,
+        litellm_params=GenericLiteLLMParams(),
+        headers={},
+    )
+
+    assert result.get("context_management") == {
+        "edits": [{"type": "compact_20260112"}]
+    }
+    assert "compact-2026-01-12" in result.get("anthropic_beta", [])
+
+
 def test_bedrock_messages_allowlist_filters_anthropic_only_fields():
     """
     Bedrock Invoke rejects any top-level body field it doesn't recognize with

From d1d240086239c9d639758bcba81e7514825e52ad Mon Sep 17 00:00:00 2001
From: Kris Xia <xiajiayi0506@gmail.com>
Date: Sun, 10 May 2026 04:30:18 +0800
Subject: [PATCH 26/33] fix(router): register model info under
 responses/-stripped variant (#27531)

Squash-merged by litellm-agent from krisxia0506's PR.
---
 litellm/router.py                             | 44 ++++++++++----
 .../test_router_model_cost_isolation.py       | 57 +++++++++++++++++++
 2 files changed, 91 insertions(+), 10 deletions(-)

diff --git a/litellm/router.py b/litellm/router.py
index 7512ee387dc..37295f1a7d2 100644
--- a/litellm/router.py
+++ b/litellm/router.py
@@ -7076,11 +7076,11 @@ class Router:
             _shared_model_info = {
                 k: v for k, v in _model_info.items() if k not in _custom_pricing_fields
             }
-            litellm.register_model(
-                model_cost={
-                    _model_name: _shared_model_info,
-                }
-            )
+            _backend_alias_cost = {_model_name: _shared_model_info}
+            if "responses/" in _model_name:
+                _stripped_model_name = _model_name.replace("responses/", "")
+                _backend_alias_cost[_stripped_model_name] = _shared_model_info
+            litellm.register_model(model_cost=_backend_alias_cost)
 
             ## Check if LLM Deployment is allowed for this deployment
             if (
@@ -7752,6 +7752,12 @@ class Router:
         # initialize client
         self._add_deployment(deployment=deployment)
 
+        _model_info_dict: dict = deployment.model_info.model_dump(exclude_none=True)
+        for field in CustomPricingLiteLLMParams.model_fields.keys():
+            field_value = deployment.litellm_params.get(field)
+            if field_value is not None:
+                _model_info_dict[field] = field_value
+
         # Register custom pricing in litellm.model_cost.
         # Mirrors _create_deployment() logic to ensure dynamically-added deployments
         # (e.g., loaded from DB) also have their custom pricing registered.
@@ -7759,13 +7765,31 @@ class Router:
         # zero-cost models, causing budget checks to block free models.
         _model_id = deployment.model_info.id
         if _model_id is not None:
-            _model_info_dict: dict = deployment.model_info.model_dump(exclude_none=True)
-            for field in CustomPricingLiteLLMParams.model_fields.keys():
-                field_value = deployment.litellm_params.get(field)
-                if field_value is not None:
-                    _model_info_dict[field] = field_value
             litellm.register_model(model_cost={_model_id: _model_info_dict})
 
+        ## REGISTER MODEL INFO IN LITELLM MODEL COST MAP
+        ## OLD MODEL REGISTRATION ## Kept to prevent breaking changes
+        _model_name = deployment.litellm_params.model
+        if deployment.litellm_params.custom_llm_provider is not None:
+            _model_name = (
+                deployment.litellm_params.custom_llm_provider + "/" + _model_name
+            )
+
+        # For the shared backend key, strip custom pricing fields so that
+        # one deployment's pricing overrides don't pollute another
+        # deployment sharing the same backend model name.
+        # Each deployment's full pricing is already stored under its
+        # unique model_id above (when present).
+        _custom_pricing_fields = CustomPricingLiteLLMParams.model_fields.keys()
+        _shared_model_info = {
+            k: v for k, v in _model_info_dict.items() if k not in _custom_pricing_fields
+        }
+        _backend_alias_cost = {_model_name: _shared_model_info}
+        if "responses/" in _model_name:
+            _stripped_model_name = _model_name.replace("responses/", "")
+            _backend_alias_cost[_stripped_model_name] = _shared_model_info
+        litellm.register_model(model_cost=_backend_alias_cost)
+
         # add to model names
         self._add_model_to_list_and_index_map(
             model=_deployment, model_id=deployment.model_info.id
diff --git a/tests/test_litellm/test_router_model_cost_isolation.py b/tests/test_litellm/test_router_model_cost_isolation.py
index 7a9d5acaa27..c3f93078557 100644
--- a/tests/test_litellm/test_router_model_cost_isolation.py
+++ b/tests/test_litellm/test_router_model_cost_isolation.py
@@ -18,6 +18,7 @@ sys.path.insert(
 
 import litellm
 from litellm import Router
+from litellm.types.router import Deployment, LiteLLM_Params, ModelInfo
 
 
 def test_should_not_pollute_shared_key_with_zero_cost_pricing():
@@ -266,3 +267,59 @@ def test_should_preserve_builtin_pricing_regardless_of_deployment_order():
         f"Order should not matter. Expected {builtin_output_cost}, "
         f"got {info_std_2['output_cost_per_token']}"
     )
+
+
+def test_responses_prefix_stripped_alias_registered_for_model_list():
+    """
+    Register ``litellm.model_cost`` under the backend key with ``responses/`` and
+    under the stripped key (``responses_api_bridge_check`` removes that segment).
+    """
+    uid = "responses-strip-alias-test-a1b2c3d4"
+    Router(
+        model_list=[
+            {
+                "model_name": "azure-responses-strip-test",
+                "litellm_params": {
+                    "model": "responses/gpt-strip-test-a1b2c3d4",
+                    "custom_llm_provider": "azure",
+                    "api_key": "fake-key-strip",
+                },
+                "model_info": {
+                    "id": uid,
+                    "supports_native_streaming": True,
+                },
+            }
+        ],
+    )
+    assert "azure/responses/gpt-strip-test-a1b2c3d4" in litellm.model_cost
+    assert "azure/gpt-strip-test-a1b2c3d4" in litellm.model_cost
+    assert (
+        litellm.model_cost["azure/gpt-strip-test-a1b2c3d4"].get(
+            "supports_native_streaming"
+        )
+        is True
+    )
+
+
+def test_responses_prefix_stripped_alias_registered_for_add_deployment():
+    """Dynamic ``add_deployment`` must mirror ``_create_deployment`` registration."""
+    uid = "add-dep-responses-strip-e5f6a7b8"
+    router = Router(model_list=[])
+    deployment = Deployment(
+        model_name="dyn-responses-strip",
+        litellm_params=LiteLLM_Params(
+            model="responses/gpt-add-strip-e5f6a7b8",
+            custom_llm_provider="azure",
+            api_key="fake-key-add",
+        ),
+        model_info=ModelInfo(id=uid, supports_native_streaming=True),
+    )
+    router.add_deployment(deployment=deployment)
+    assert "azure/responses/gpt-add-strip-e5f6a7b8" in litellm.model_cost
+    assert "azure/gpt-add-strip-e5f6a7b8" in litellm.model_cost
+    assert (
+        litellm.model_cost["azure/gpt-add-strip-e5f6a7b8"].get(
+            "supports_native_streaming"
+        )
+        is True
+    )

From b799f94080bcc0b17cd5644c8fa7a78aaf32bd24 Mon Sep 17 00:00:00 2001
From: Rick <26716961+Bytechoreographer@users.noreply.github.com>
Date: Sun, 10 May 2026 04:30:36 +0800
Subject: [PATCH 27/33] fix(ui): remove blank leading entry from access group
 model dropdown (#27521)

Squash-merged by litellm-agent from Bytechoreographer's PR.
---
 .../ModelSelect/ModelSelect.test.tsx          | 15 +++++
 .../components/ModelSelect/ModelSelect.tsx    | 62 ++++++++++---------
 2 files changed, 47 insertions(+), 30 deletions(-)

diff --git a/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.test.tsx b/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.test.tsx
index 6da2f82a2f1..a57b7e2095a 100644
--- a/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.test.tsx
+++ b/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.test.tsx
@@ -535,6 +535,21 @@ describe("ModelSelect", () => {
     });
   });
 
+  it("should not render an empty optgroup when includeSpecialOptions is omitted", async () => {
+    renderWithProviders(<ModelSelect onChange={mockOnChange} context="global" />);
+
+    await waitFor(() => {
+      expect(screen.getByTestId("model-select")).toBeInTheDocument();
+    });
+
+    const optgroups = document.querySelectorAll("optgroup");
+    // Wildcard Options + Models — no blank leading group
+    expect(optgroups.length).toBe(2);
+    optgroups.forEach((g) => {
+      expect(g.getAttribute("label")).toBeTruthy();
+    });
+  });
+
   it("should render maxTagPlaceholder when many items are selected", async () => {
     // Create many models to trigger maxTagCount responsive behavior
     const manyModels: ProxyModel[] = Array.from({ length: 20 }, (_, i) => ({
diff --git a/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx b/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx
index 74b2619f7f3..800fa86b165 100644
--- a/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx
+++ b/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx
@@ -141,36 +141,38 @@ export const ModelSelect = (props: ModelSelectProps) => {
       onChange={handleChange}
       style={style}
       options={[
-        includeSpecialOptions
-          ? {
-            label: <span>Special Options</span>,
-            title: "Special Options",
-            options: [
-              ...(shouldShowAllProxyModels
-                ? [
-                  {
-                    label: <span>All Proxy Models</span>,
-                    value: MODEL_SELECT_ALL_PROXY_MODELS_SPECIAL_VALUE.value,
-                    disabled:
-                      value.length > 0 &&
-                      value.some(
-                        (v) => isSpecialOption(v) && v !== MODEL_SELECT_ALL_PROXY_MODELS_SPECIAL_VALUE.value,
-                      ),
-                    key: MODEL_SELECT_ALL_PROXY_MODELS_SPECIAL_VALUE.value,
-                  },
-                ]
-                : []),
-              {
-                label: <span>No Default Models</span>,
-                value: MODEL_SELECT_NO_DEFAULT_MODELS_SPECIAL_VALUE.value,
-                disabled:
-                  value.length > 0 &&
-                  value.some((v) => isSpecialOption(v) && v !== MODEL_SELECT_NO_DEFAULT_MODELS_SPECIAL_VALUE.value),
-                key: MODEL_SELECT_NO_DEFAULT_MODELS_SPECIAL_VALUE.value,
-              },
-            ],
-          }
-          : [],
+        ...(includeSpecialOptions
+          ? [
+            {
+              label: <span>Special Options</span>,
+              title: "Special Options",
+              options: [
+                ...(shouldShowAllProxyModels
+                  ? [
+                    {
+                      label: <span>All Proxy Models</span>,
+                      value: MODEL_SELECT_ALL_PROXY_MODELS_SPECIAL_VALUE.value,
+                      disabled:
+                        value.length > 0 &&
+                        value.some(
+                          (v) => isSpecialOption(v) && v !== MODEL_SELECT_ALL_PROXY_MODELS_SPECIAL_VALUE.value,
+                        ),
+                      key: MODEL_SELECT_ALL_PROXY_MODELS_SPECIAL_VALUE.value,
+                    },
+                  ]
+                  : []),
+                {
+                  label: <span>No Default Models</span>,
+                  value: MODEL_SELECT_NO_DEFAULT_MODELS_SPECIAL_VALUE.value,
+                  disabled:
+                    value.length > 0 &&
+                    value.some((v) => isSpecialOption(v) && v !== MODEL_SELECT_NO_DEFAULT_MODELS_SPECIAL_VALUE.value),
+                  key: MODEL_SELECT_NO_DEFAULT_MODELS_SPECIAL_VALUE.value,
+                },
+              ],
+            },
+          ]
+          : []),
         ...(wildcard.length > 0
           ? [
             {

From 80445299b884ff0a20f5866da680d61d4340e4c8 Mon Sep 17 00:00:00 2001
From: Tai An <antai12232931@outlook.com>
Date: Sat, 9 May 2026 13:32:31 -0700
Subject: [PATCH 28/33] fix(proxy): coerce non-str x-litellm-* header values to
 avoid httpx TypeError (#27458) (#27504)

Squash-merged by litellm-agent from Anai-Guo's PR.
---
 litellm/proxy/litellm_pre_call_utils.py    | 12 +++++++++++-
 tests/proxy_unit_tests/test_proxy_utils.py | 13 +++++++++++--
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/litellm/proxy/litellm_pre_call_utils.py b/litellm/proxy/litellm_pre_call_utils.py
index 9d7d6f476ac..b97e7c5e693 100644
--- a/litellm/proxy/litellm_pre_call_utils.py
+++ b/litellm/proxy/litellm_pre_call_utils.py
@@ -1,5 +1,6 @@
 import asyncio
 import copy
+import json
 import re
 import time
 from collections import OrderedDict
@@ -794,8 +795,17 @@ class LiteLLMProxyRequestSetup:
                 )
             )
             for k, v in litellm_logging_metadata_headers.items():
-                if v is not None:
+                if v is None:
+                    continue
+                # httpx requires header values to be str or bytes; coerce numbers/bools
+                # to str and JSON-encode dict/list (e.g. user_api_key_spend is float,
+                # user_api_key_auth_metadata is dict). See #27458.
+                if isinstance(v, (dict, list)):
+                    returned_headers["x-litellm-{}".format(k)] = json.dumps(v)
+                elif isinstance(v, (str, bytes)):
                     returned_headers["x-litellm-{}".format(k)] = v
+                else:
+                    returned_headers["x-litellm-{}".format(k)] = str(v)
 
         return returned_headers
 
diff --git a/tests/proxy_unit_tests/test_proxy_utils.py b/tests/proxy_unit_tests/test_proxy_utils.py
index 70232f25c37..68aff36038b 100644
--- a/tests/proxy_unit_tests/test_proxy_utils.py
+++ b/tests/proxy_unit_tests/test_proxy_utils.py
@@ -587,12 +587,21 @@ def test_foward_litellm_user_info_to_backend_llm_call():
         user_api_key_dict=user_api_key_dict,
     )
 
+    # All header values must be str/bytes so httpx won't reject them when the
+    # downstream client builds the request (regression: #27458).
+    for k, v in data.items():
+        assert isinstance(v, (str, bytes)), (
+            f"header {k!r} has non-str value {v!r} ({type(v).__name__}); "
+            "httpx will raise 'Header value must be str or bytes' when the LLM "
+            "request is built."
+        )
+
     expected_data = {
         "x-litellm-user_api_key_user_id": "test_user_id",
         "x-litellm-user_api_key_org_id": "test_org_id",
         "x-litellm-user_api_key_hash": "test_api_key",
-        "x-litellm-user_api_key_spend": 0.0,
-        "x-litellm-user_api_key_auth_metadata": {},
+        "x-litellm-user_api_key_spend": "0.0",
+        "x-litellm-user_api_key_auth_metadata": "{}",
     }
 
     assert json.dumps(data, sort_keys=True) == json.dumps(expected_data, sort_keys=True)

From c7739c9ed55c4d58b9191e1d1f1429091349d46d Mon Sep 17 00:00:00 2001
From: Shivam Rawat <shivam@berri.ai>
Date: Sat, 9 May 2026 15:34:09 -0700
Subject: [PATCH 29/33] feat: add ability to auth to azure with token (#27556)

Squash-merged by litellm-agent from shivamrawat1's PR.
---
 litellm/__init__.py                           |   1 +
 litellm/_redis.py                             | 219 +++++++++++++++++-
 litellm/_redis_credential_provider.py         |  35 ++-
 .../chat/guardrail_translation/handler.py     |  12 +-
 .../base_llm/guardrail_translation/utils.py   |  15 ++
 .../chat/guardrail_translation/handler.py     |  24 +-
 .../proxy/guardrails/guardrail_registry.py    |   5 +
 litellm/types/guardrails.py                   |  10 +
 .../test_unified_guardrail.py                 | 132 +++++++++++
 tests/test_litellm/test_utils.py              | 122 ++++++++++
 .../guardrails/add_guardrail_form.tsx         |  20 ++
 .../guardrails/edit_guardrail_form.tsx        |  23 ++
 .../components/guardrails/guardrail_info.tsx  |  36 +++
 .../guardrail_info_helpers.test.tsx           |  16 ++
 .../guardrails/guardrail_info_helpers.tsx     |  16 ++
 .../components/guardrails/guardrail_table.tsx |  10 +-
 16 files changed, 685 insertions(+), 11 deletions(-)

diff --git a/litellm/__init__.py b/litellm/__init__.py
index cf05fc4c980..fd3d47ec154 100644
--- a/litellm/__init__.py
+++ b/litellm/__init__.py
@@ -206,6 +206,7 @@ add_user_information_to_llm_headers: Optional[bool] = (
 )
 store_audit_logs = False  # Enterprise feature, allow users to see audit logs
 skip_system_message_in_guardrail: bool = False
+skip_tool_message_in_guardrail: bool = False
 ### end of callbacks #############
 
 email: Optional[str] = (
diff --git a/litellm/_redis.py b/litellm/_redis.py
index f12afbac297..1c11ea829ba 100644
--- a/litellm/_redis.py
+++ b/litellm/_redis.py
@@ -19,6 +19,7 @@ import redis.asyncio as async_redis  # type: ignore
 
 from litellm import get_secret, get_secret_str
 from litellm._redis_credential_provider import (
+    AzureADCredentialProvider,
     GCPIAMCredentialProvider,
     _generate_gcp_iam_access_token,
 )
@@ -27,6 +28,8 @@ from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker
 
 from ._logging import verbose_logger
 
+AZURE_REDIS_SCOPE = "https://redis.azure.com/.default"
+
 
 def _get_redis_kwargs():
     arg_spec = inspect.getfullargspec(redis.Redis)
@@ -43,6 +46,10 @@ def _get_redis_kwargs():
         "redis_connect_func",
         "gcp_service_account",
         "gcp_ssl_ca_certs",
+        "azure_redis_ad_token",
+        "azure_client_id",
+        "azure_tenant_id",
+        "azure_client_secret",
     ]
 
     available_args = [x for x in arg_spec.args if x not in exclude_args] + include_args
@@ -89,6 +96,10 @@ def _get_redis_cluster_kwargs(client=None):
     )  # Needed for sync clusters and IAM detection
     available_args.append("gcp_service_account")
     available_args.append("gcp_ssl_ca_certs")
+    available_args.append("azure_redis_ad_token")
+    available_args.append("azure_client_id")
+    available_args.append("azure_tenant_id")
+    available_args.append("azure_client_secret")
     available_args.append("max_connections")
 
     return available_args
@@ -155,6 +166,125 @@ def create_gcp_iam_redis_connect_func(
     return iam_connect
 
 
+def _build_azure_credential(
+    azure_client_id: Optional[str] = None,
+    azure_tenant_id: Optional[str] = None,
+    azure_client_secret: Optional[str] = None,
+):
+    """
+    Build a long-lived Azure credential object.
+
+    Azure SDK credentials cache tokens internally and handle expiry/refresh
+    transparently, so this should be called once and the result reused.
+    """
+    try:
+        from azure.identity import (
+            ClientSecretCredential,
+            DefaultAzureCredential,
+            ManagedIdentityCredential,
+        )
+    except ImportError:
+        raise ImportError(
+            "azure-identity is required for Azure AD Redis authentication. "
+            "Install it with: pip install azure-identity"
+        )
+
+    _client_id = azure_client_id or os.environ.get("AZURE_CLIENT_ID")
+    _tenant_id = azure_tenant_id or os.environ.get("AZURE_TENANT_ID")
+    _client_secret = azure_client_secret or os.environ.get("AZURE_CLIENT_SECRET")
+
+    if _client_id and _tenant_id and _client_secret:
+        return ClientSecretCredential(
+            client_id=_client_id,
+            tenant_id=_tenant_id,
+            client_secret=_client_secret,
+        )
+    elif _client_id:
+        return ManagedIdentityCredential(client_id=_client_id)
+    else:
+        return DefaultAzureCredential()
+
+
+def _generate_azure_ad_redis_token(
+    azure_client_id: Optional[str] = None,
+    azure_tenant_id: Optional[str] = None,
+    azure_client_secret: Optional[str] = None,
+) -> str:
+    """
+    One-shot helper that builds a credential and fetches a single Azure AD
+    access token for Redis. Each call rebuilds the credential and performs a
+    network round-trip, so it should not be used in steady-state Redis flows
+    — the sync (``create_azure_ad_redis_connect_func``) and async paths
+    (``AzureADCredentialProvider``) keep the credential alive across
+    connections so the Azure SDK's internal cache + silent refresh apply.
+    """
+    credential = _build_azure_credential(
+        azure_client_id=azure_client_id,
+        azure_tenant_id=azure_tenant_id,
+        azure_client_secret=azure_client_secret,
+    )
+    token = credential.get_token(AZURE_REDIS_SCOPE)
+    return token.token
+
+
+def create_azure_ad_redis_connect_func(
+    azure_client_id: Optional[str] = None,
+    azure_tenant_id: Optional[str] = None,
+    azure_client_secret: Optional[str] = None,
+) -> Callable:
+    """
+    Creates a custom Redis connection function for Azure AD authentication.
+
+    Used for sync Redis clients. The credential is created once (captured by the
+    closure) and reused across connections — the Azure SDK handles token caching
+    and silent renewal internally. Only ``get_token`` is called per connection.
+    """
+    credential = _build_azure_credential(
+        azure_client_id=azure_client_id,
+        azure_tenant_id=azure_tenant_id,
+        azure_client_secret=azure_client_secret,
+    )
+
+    def ad_connect(self):
+        """Initialize the connection and authenticate using Azure AD"""
+        from redis.exceptions import (
+            AuthenticationError,
+            AuthenticationWrongNumberOfArgsError,
+        )
+        from redis.utils import str_if_bytes
+
+        self._parser.on_connect(self)
+
+        access_token = credential.get_token(AZURE_REDIS_SCOPE).token
+
+        # Only include username when explicitly set — sending AUTH "" <token>
+        # is invalid for most ACL-configured Azure Redis instances.
+        username = os.environ.get("REDIS_USERNAME", "")
+        if username:
+            auth_args = (username, access_token)
+        else:
+            auth_args = (access_token,)
+
+        self.send_command("AUTH", *auth_args, check_health=False)
+
+        try:
+            auth_response = self.read_response()
+        except AuthenticationWrongNumberOfArgsError:
+            # Fallback: try with just the token (Redis < 6 / no ACL)
+            self.send_command("AUTH", access_token, check_health=False)
+            auth_response = self.read_response()
+
+        if str_if_bytes(auth_response) != "OK":
+            raise AuthenticationError("Azure AD authentication failed for Redis")
+
+    # Attach the live credential object so async paths can wrap it in
+    # AzureADCredentialProvider for refresh-aware token retrieval. The raw
+    # client_id/tenant_id/secret are intentionally NOT exposed here — the
+    # credential closure already holds them.
+    ad_connect._azure_credential = credential  # type: ignore[attr-defined]
+    return ad_connect
+
+
 def get_redis_url_from_environment():
     if "REDIS_URL" in os.environ:
         return os.environ["REDIS_URL"]
@@ -179,7 +309,7 @@ def get_redis_url_from_environment():
     return f"{redis_protocol}://{auth_part}{os.environ['REDIS_HOST']}:{os.environ['REDIS_PORT']}"
 
 
-def _get_redis_client_logic(**env_overrides):
+def _get_redis_client_logic(**env_overrides):  # noqa: PLR0915
     """
     Common functionality across sync + async redis client implementations
     """
@@ -253,6 +383,52 @@ def _get_redis_client_logic(**env_overrides):
         if _gcp_ssl_ca_certs and redis_kwargs.get("ssl", False):
             redis_kwargs["ssl_ca_certs"] = _gcp_ssl_ca_certs
 
+    # Handle Azure AD authentication (after GCP IAM block)
+    _azure_redis_ad_token = redis_kwargs.get("azure_redis_ad_token") or get_secret(
+        "REDIS_AZURE_AD_TOKEN"
+    )
+
+    _azure_ad_enabled = (
+        _azure_redis_ad_token is not None
+        and str(_azure_redis_ad_token).lower() == "true"
+    )
+
+    if _azure_ad_enabled and _gcp_service_account is not None:
+        verbose_logger.warning(
+            "Both GCP IAM (gcp_service_account) and Azure AD (azure_redis_ad_token) are configured for Redis. "
+            "Using GCP IAM. Remove one to avoid misconfiguration."
+        )
+
+    if _azure_ad_enabled and _gcp_service_account is None:
+        _azure_client_id = redis_kwargs.get("azure_client_id") or get_secret_str(
+            "AZURE_CLIENT_ID"
+        )
+        _azure_tenant_id = redis_kwargs.get("azure_tenant_id") or get_secret_str(
+            "AZURE_TENANT_ID"
+        )
+        _azure_client_secret = redis_kwargs.get(
+            "azure_client_secret"
+        ) or get_secret_str("AZURE_CLIENT_SECRET")
+
+        verbose_logger.debug("Setting up Azure AD authentication for Redis.")
+        redis_kwargs["redis_connect_func"] = create_azure_ad_redis_connect_func(
+            azure_client_id=_azure_client_id,
+            azure_tenant_id=_azure_tenant_id,
+            azure_client_secret=_azure_client_secret,
+        )
+        # Marker for async paths to detect Azure AD auth. The live credential
+        # object is attached separately as `_azure_credential` by
+        # `create_azure_ad_redis_connect_func`; the raw client_id/tenant_id/secret
+        # are intentionally NOT exposed on the function to avoid leaking
+        # credentials via inspection or logging.
+        redis_kwargs["redis_connect_func"]._azure_redis_ad_token = True  # type: ignore[attr-defined]
+
+    # Always remove Azure-specific kwargs that shouldn't be passed to Redis client
+    redis_kwargs.pop("azure_redis_ad_token", None)
+    redis_kwargs.pop("azure_client_id", None)
+    redis_kwargs.pop("azure_tenant_id", None)
+    redis_kwargs.pop("azure_client_secret", None)
+
     if "url" in redis_kwargs and redis_kwargs["url"] is not None:
         # Only strip host/port/db/password when not routing to a cluster.
         # When startup_nodes is also present the cluster path takes priority and
@@ -373,7 +549,7 @@ def get_redis_client(**env_overrides):
     return redis.Redis(**redis_kwargs)
 
 
-def get_redis_async_client(
+def get_redis_async_client(  # noqa: PLR0915
     connection_pool: Optional[async_redis.BlockingConnectionPool] = None,
     **env_overrides,
 ) -> Union[async_redis.Redis, async_redis.RedisCluster]:
@@ -398,6 +574,14 @@ def get_redis_async_client(
             cluster_kwargs["credential_provider"] = GCPIAMCredentialProvider(
                 redis_connect_func._gcp_service_account
             )
+        # Handle Azure AD authentication for async clusters via CredentialProvider
+        # so the credential's internal cache + silent refresh runs per connection
+        # (mirrors GCP IAM above; avoids static-token-baked-in-pool expiry).
+        elif redis_connect_func and hasattr(redis_connect_func, "_azure_credential"):
+            cluster_kwargs["credential_provider"] = AzureADCredentialProvider(
+                redis_connect_func._azure_credential,
+                username=os.environ.get("REDIS_USERNAME") or None,
+            )
 
         new_startup_nodes: List[ClusterNode] = []
 
@@ -431,6 +615,22 @@ def get_redis_async_client(
     # Check for Redis Sentinel
     if "sentinel_nodes" in redis_kwargs and "service_name" in redis_kwargs:
         return _init_async_redis_sentinel(redis_kwargs)
+
+    # Wrap GCP / Azure AD auth in a CredentialProvider for the standard async
+    # Redis client. The async client doesn't support redis_connect_func, but it
+    # does honour credential_provider — which is called per connection, so the
+    # underlying SDK can refresh tokens silently before they expire.
+    redis_connect_func = redis_kwargs.pop("redis_connect_func", None)
+    if redis_connect_func and hasattr(redis_connect_func, "_azure_credential"):
+        redis_kwargs["credential_provider"] = AzureADCredentialProvider(
+            redis_connect_func._azure_credential,
+            username=os.environ.get("REDIS_USERNAME") or None,
+        )
+    elif redis_connect_func and hasattr(redis_connect_func, "_gcp_service_account"):
+        redis_kwargs["credential_provider"] = GCPIAMCredentialProvider(
+            redis_connect_func._gcp_service_account
+        )
+
     _pretty_print_redis_config(redis_kwargs=redis_kwargs)
 
     if connection_pool is not None:
@@ -464,6 +664,21 @@ def get_redis_connection_pool(
                     redis_kwargs["max_connections"],
                 )
         return async_redis.BlockingConnectionPool.from_url(**pool_kwargs)
+
+    # Wrap GCP / Azure AD auth in a CredentialProvider so pool-managed
+    # connections re-fetch tokens via the SDK's internal cache + silent refresh
+    # rather than reusing a single token captured at pool creation.
+    redis_connect_func = redis_kwargs.pop("redis_connect_func", None)
+    if redis_connect_func and hasattr(redis_connect_func, "_azure_credential"):
+        redis_kwargs["credential_provider"] = AzureADCredentialProvider(
+            redis_connect_func._azure_credential,
+            username=os.environ.get("REDIS_USERNAME") or None,
+        )
+    elif redis_connect_func and hasattr(redis_connect_func, "_gcp_service_account"):
+        redis_kwargs["credential_provider"] = GCPIAMCredentialProvider(
+            redis_connect_func._gcp_service_account
+        )
+
     connection_class = async_redis.Connection
     if "ssl" in redis_kwargs:
         connection_class = async_redis.SSLConnection
diff --git a/litellm/_redis_credential_provider.py b/litellm/_redis_credential_provider.py
index 70725fe12c4..586b1c7716c 100644
--- a/litellm/_redis_credential_provider.py
+++ b/litellm/_redis_credential_provider.py
@@ -1,10 +1,13 @@
 import asyncio
 import threading
 import time
-from typing import Dict, Tuple
+from typing import Any, Dict, Optional, Tuple, Union
 
 from redis.credentials import CredentialProvider  # type: ignore[attr-defined]
 
+# Azure AD scope for Redis Cache for Azure.
+AZURE_REDIS_SCOPE = "https://redis.azure.com/.default"
+
 # GCP IAM tokens are valid for 1 hour. Cache for 55 minutes to refresh before expiry.
 _GCP_IAM_TOKEN_TTL_SECONDS = 3300
 
@@ -101,3 +104,33 @@ class GCPIAMCredentialProvider(CredentialProvider):
             _get_cached_gcp_iam_token, self._gcp_service_account
         )
         return (token,)
+
+
+class AzureADCredentialProvider(CredentialProvider):
+    """
+    redis.credentials.CredentialProvider implementation that supplies Azure AD
+    tokens for Redis authentication.
+
+    Wraps an azure-identity credential object so the Azure SDK's internal token
+    cache and silent refresh are honoured on every Redis connection. This avoids
+    the static-token-baked-in-pool issue where pool-managed connections would
+    fail authentication after the initial token expired (~1 hour TTL).
+    """
+
+    def __init__(self, credential: Any, username: Optional[str] = None) -> None:
+        self._credential = credential
+        self._username = username
+
+    def get_credentials(self) -> Union[Tuple[str], Tuple[str, str]]:
+        token = self._credential.get_token(AZURE_REDIS_SCOPE).token
+        if self._username:
+            return (self._username, token)
+        return (token,)
+
+    async def get_credentials_async(self) -> Union[Tuple[str], Tuple[str, str]]:
+        token_obj = await asyncio.to_thread(
+            self._credential.get_token, AZURE_REDIS_SCOPE
+        )
+        if self._username:
+            return (self._username, token_obj.token)
+        return (token_obj.token,)
diff --git a/litellm/llms/anthropic/chat/guardrail_translation/handler.py b/litellm/llms/anthropic/chat/guardrail_translation/handler.py
index 2bb82f227bb..74dadee5ecb 100644
--- a/litellm/llms/anthropic/chat/guardrail_translation/handler.py
+++ b/litellm/llms/anthropic/chat/guardrail_translation/handler.py
@@ -23,7 +23,9 @@ from litellm.llms.anthropic.experimental_pass_through.adapters.transformation im
 from litellm.llms.base_llm.guardrail_translation.base_translation import BaseTranslation
 from litellm.llms.base_llm.guardrail_translation.utils import (
     effective_skip_system_message_for_guardrail,
+    effective_skip_tool_message_for_guardrail,
     openai_messages_without_system,
+    openai_messages_without_tool,
 )
 from litellm.proxy.pass_through_endpoints.llm_provider_handlers.anthropic_passthrough_logging_handler import (
     AnthropicPassthroughLoggingHandler,
@@ -108,6 +110,7 @@ class AnthropicMessagesHandler(BaseTranslation):
             return data
 
         skip_system = effective_skip_system_message_for_guardrail(guardrail_to_apply)
+        skip_tool = effective_skip_tool_message_for_guardrail(guardrail_to_apply)
 
         chat_completion_compatible_request = self._translate_to_openai(data)
 
@@ -117,6 +120,8 @@ class AnthropicMessagesHandler(BaseTranslation):
         )
         if skip_system:
             structured_messages = openai_messages_without_system(structured_messages)
+        if skip_tool:
+            structured_messages = openai_messages_without_tool(structured_messages)
 
         texts_to_check: List[str] = []
         images_to_check: List[str] = []
@@ -134,6 +139,7 @@ class AnthropicMessagesHandler(BaseTranslation):
                 images_to_check=images_to_check,
                 task_mappings=task_mappings,
                 skip_system_message=skip_system,
+                skip_tool_message=skip_tool,
             )
 
         # Step 2: Apply guardrail to all texts in batch
@@ -198,13 +204,17 @@ class AnthropicMessagesHandler(BaseTranslation):
         images_to_check: List[str],
         task_mappings: List[Tuple[int, Optional[int]]],
         skip_system_message: bool = False,
+        skip_tool_message: bool = False,
     ) -> None:
         """
         Extract text content and images from a message.
 
         Override this method to customize text/image extraction logic.
         """
-        if skip_system_message and str(message.get("role") or "").lower() == "system":
+        role = str(message.get("role") or "").lower()
+        if skip_system_message and role == "system":
+            return
+        if skip_tool_message and role == "tool":
             return
 
         content = message.get("content", None)
diff --git a/litellm/llms/base_llm/guardrail_translation/utils.py b/litellm/llms/base_llm/guardrail_translation/utils.py
index cdd2d775371..97ece6b5eab 100644
--- a/litellm/llms/base_llm/guardrail_translation/utils.py
+++ b/litellm/llms/base_llm/guardrail_translation/utils.py
@@ -14,7 +14,22 @@ def effective_skip_system_message_for_guardrail(guardrail_to_apply: Any) -> bool
     return bool(getattr(litellm, "skip_system_message_in_guardrail", False))
 
 
+def effective_skip_tool_message_for_guardrail(guardrail_to_apply: Any) -> bool:
+    per = getattr(guardrail_to_apply, "skip_tool_message_in_guardrail", None)
+    if per is not None:
+        return bool(per)
+    import litellm
+
+    return bool(getattr(litellm, "skip_tool_message_in_guardrail", False))
+
+
 def openai_messages_without_system(
     messages: List[AllMessageValues],
 ) -> List[AllMessageValues]:
     return [m for m in messages if str((m or {}).get("role") or "").lower() != "system"]
+
+
+def openai_messages_without_tool(
+    messages: List[AllMessageValues],
+) -> List[AllMessageValues]:
+    return [m for m in messages if str((m or {}).get("role") or "").lower() != "tool"]
diff --git a/litellm/llms/openai/chat/guardrail_translation/handler.py b/litellm/llms/openai/chat/guardrail_translation/handler.py
index 86ca6625629..d413a244539 100644
--- a/litellm/llms/openai/chat/guardrail_translation/handler.py
+++ b/litellm/llms/openai/chat/guardrail_translation/handler.py
@@ -21,7 +21,9 @@ from litellm._logging import verbose_proxy_logger
 from litellm.llms.base_llm.guardrail_translation.base_translation import BaseTranslation
 from litellm.llms.base_llm.guardrail_translation.utils import (
     effective_skip_system_message_for_guardrail,
+    effective_skip_tool_message_for_guardrail,
     openai_messages_without_system,
+    openai_messages_without_tool,
 )
 from litellm.main import stream_chunk_builder
 from litellm.types.llms.openai import AllMessageValues, ChatCompletionToolParam
@@ -73,6 +75,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation):
             return data
 
         skip_system = effective_skip_system_message_for_guardrail(guardrail_to_apply)
+        skip_tool = effective_skip_tool_message_for_guardrail(guardrail_to_apply)
 
         texts_to_check: List[str] = []
         images_to_check: List[str] = []
@@ -91,6 +94,7 @@ class OpenAIChatCompletionsHandler(BaseTranslation):
                 text_task_mappings=text_task_mappings,
                 tool_call_task_mappings=tool_call_task_mappings,
                 skip_system_message=skip_system,
+                skip_tool_message=skip_tool,
             )
 
         # Step 2: Apply guardrail to all texts and tool calls in batch
@@ -102,11 +106,15 @@ class OpenAIChatCompletionsHandler(BaseTranslation):
                 inputs["tool_calls"] = tool_calls_to_check  # type: ignore
             structured_messages = self.get_structured_messages(data)
             if structured_messages:
-                inputs["structured_messages"] = (
-                    openai_messages_without_system(structured_messages)
-                    if skip_system
-                    else structured_messages
-                )
+                if skip_system:
+                    structured_messages = openai_messages_without_system(
+                        structured_messages
+                    )
+                if skip_tool:
+                    structured_messages = openai_messages_without_tool(
+                        structured_messages
+                    )
+                inputs["structured_messages"] = structured_messages
             # Pass tools (function definitions) to the guardrail
             tools = data.get("tools")
             if tools:
@@ -176,13 +184,17 @@ class OpenAIChatCompletionsHandler(BaseTranslation):
         text_task_mappings: List[Tuple[int, Optional[int]]],
         tool_call_task_mappings: List[Tuple[int, int]],
         skip_system_message: bool = False,
+        skip_tool_message: bool = False,
     ) -> None:
         """
         Extract text content, images, and tool calls from a message.
 
         Override this method to customize text/image/tool call extraction logic.
         """
-        if skip_system_message and str(message.get("role") or "").lower() == "system":
+        role = str(message.get("role") or "").lower()
+        if skip_system_message and role == "system":
+            return
+        if skip_tool_message and role == "tool":
             return
 
         content = message.get("content", None)
diff --git a/litellm/proxy/guardrails/guardrail_registry.py b/litellm/proxy/guardrails/guardrail_registry.py
index 868b23756d2..838fb2e01ad 100644
--- a/litellm/proxy/guardrails/guardrail_registry.py
+++ b/litellm/proxy/guardrails/guardrail_registry.py
@@ -482,6 +482,11 @@ class InMemoryGuardrailHandler:
                 "skip_system_message_in_guardrail",
                 getattr(litellm_params, "skip_system_message_in_guardrail", None),
             )
+            setattr(
+                custom_guardrail_callback,
+                "skip_tool_message_in_guardrail",
+                getattr(litellm_params, "skip_tool_message_in_guardrail", None),
+            )
 
         parsed_guardrail = Guardrail(
             guardrail_id=guardrail.get("guardrail_id"),
diff --git a/litellm/types/guardrails.py b/litellm/types/guardrails.py
index 04347aebe3b..751113400d3 100644
--- a/litellm/types/guardrails.py
+++ b/litellm/types/guardrails.py
@@ -633,6 +633,16 @@ class BaseLitellmParams(
         ),
     )
 
+    skip_tool_message_in_guardrail: Optional[bool] = Field(
+        default=None,
+        description=(
+            "When True, unified guardrails skip tool-role messages when building "
+            "evaluation inputs (texts and structured_messages). When False, tool "
+            "messages are included even if litellm_settings sets a global skip. When "
+            "None, use the global litellm.skip_tool_message_in_guardrail setting."
+        ),
+    )
+
     # Lakera specific params
     category_thresholds: Optional[LakeraCategoryThresholds] = Field(
         default=None,
diff --git a/tests/test_litellm/proxy/guardrails/guardrail_hooks/unified_guardrails/test_unified_guardrail.py b/tests/test_litellm/proxy/guardrails/guardrail_hooks/unified_guardrails/test_unified_guardrail.py
index 2418d7af04b..6e027fa4941 100644
--- a/tests/test_litellm/proxy/guardrails/guardrail_hooks/unified_guardrails/test_unified_guardrail.py
+++ b/tests/test_litellm/proxy/guardrails/guardrail_hooks/unified_guardrails/test_unified_guardrail.py
@@ -8,7 +8,9 @@ from litellm.integrations.custom_guardrail import CustomGuardrail
 from litellm.llms.base_llm.guardrail_translation.base_translation import BaseTranslation
 from litellm.llms.base_llm.guardrail_translation.utils import (
     effective_skip_system_message_for_guardrail,
+    effective_skip_tool_message_for_guardrail,
     openai_messages_without_system,
+    openai_messages_without_tool,
 )
 from litellm.llms.openai.chat.guardrail_translation.handler import (
     OpenAIChatCompletionsHandler,
@@ -180,6 +182,136 @@ class TestUnifiedLLMGuardrails:
             }
             assert "system" in roles
 
+    class TestSkipToolMessageForChatCompletions:
+        def test_openai_messages_without_tool(self):
+            msgs = [
+                {"role": "user", "content": "hi"},
+                {
+                    "role": "assistant",
+                    "content": None,
+                    "tool_calls": [
+                        {
+                            "id": "call_1",
+                            "type": "function",
+                            "function": {"name": "f", "arguments": "{}"},
+                        }
+                    ],
+                },
+                {"role": "tool", "content": "tool result", "tool_call_id": "call_1"},
+            ]
+            out = openai_messages_without_tool(msgs)
+            assert len(out) == 2
+            assert all(m["role"] != "tool" for m in out)
+            assert msgs[2]["content"] == "tool result"
+
+        def test_effective_skip_tool_respects_per_guardrail_over_global(
+            self, monkeypatch
+        ):
+            monkeypatch.setattr(
+                litellm, "skip_tool_message_in_guardrail", True, raising=False
+            )
+
+            class G:
+                skip_tool_message_in_guardrail = False
+
+            assert effective_skip_tool_message_for_guardrail(G()) is False
+
+            class G2:
+                skip_tool_message_in_guardrail = None
+
+            assert effective_skip_tool_message_for_guardrail(G2()) is True
+
+        @pytest.mark.asyncio
+        async def test_openai_handler_skips_tool_in_guardrail_inputs(self, monkeypatch):
+            monkeypatch.setattr(
+                litellm, "skip_tool_message_in_guardrail", True, raising=False
+            )
+
+            captured = {}
+
+            class MockGuardrail:
+                skip_tool_message_in_guardrail = None
+
+                async def apply_guardrail(
+                    self, inputs, request_data, input_type, logging_obj=None
+                ):
+                    captured["inputs"] = inputs
+                    return inputs
+
+            data = {
+                "messages": [
+                    {"role": "user", "content": "hello"},
+                    {
+                        "role": "assistant",
+                        "content": None,
+                        "tool_calls": [
+                            {
+                                "id": "call_1",
+                                "type": "function",
+                                "function": {"name": "f", "arguments": "{}"},
+                            }
+                        ],
+                    },
+                    {
+                        "role": "tool",
+                        "content": "secret tool result",
+                        "tool_call_id": "call_1",
+                    },
+                ],
+                "model": "gpt-4o",
+            }
+
+            handler = OpenAIChatCompletionsHandler()
+            await handler.process_input_messages(
+                data=data,
+                guardrail_to_apply=MockGuardrail(),
+                litellm_logging_obj=None,
+            )
+
+            assert "secret tool result" not in captured["inputs"]["texts"]
+            sm = captured["inputs"].get("structured_messages") or []
+            assert all(m.get("role") != "tool" for m in sm)
+            assert data["messages"][2]["content"] == "secret tool result"
+
+        @pytest.mark.asyncio
+        async def test_openai_handler_per_guardrail_skip_tool_false_overrides_global(
+            self, monkeypatch
+        ):
+            monkeypatch.setattr(
+                litellm, "skip_tool_message_in_guardrail", True, raising=False
+            )
+
+            captured = {}
+
+            class MockGuardrail:
+                skip_tool_message_in_guardrail = False
+
+                async def apply_guardrail(
+                    self, inputs, request_data, input_type, logging_obj=None
+                ):
+                    captured["inputs"] = inputs
+                    return inputs
+
+            data = {
+                "messages": [
+                    {"role": "user", "content": "u"},
+                    {"role": "tool", "content": "tr", "tool_call_id": "call_1"},
+                ],
+            }
+
+            await OpenAIChatCompletionsHandler().process_input_messages(
+                data=data,
+                guardrail_to_apply=MockGuardrail(),
+                litellm_logging_obj=None,
+            )
+
+            assert "tr" in captured["inputs"]["texts"]
+            roles = {
+                m.get("role")
+                for m in (captured["inputs"].get("structured_messages") or [])
+            }
+            assert "tool" in roles
+
     class TestAsyncPreCallHook:
         @pytest.mark.asyncio
         async def test_uses_mcp_event_type(self):
diff --git a/tests/test_litellm/test_utils.py b/tests/test_litellm/test_utils.py
index 65305e1a81e..d07af922ea6 100644
--- a/tests/test_litellm/test_utils.py
+++ b/tests/test_litellm/test_utils.py
@@ -2817,6 +2817,128 @@ def test_generate_gcp_iam_access_token_import_error():
         assert "pip install google-cloud-iam" in str(exc_info.value)
 
 
+def test_generate_azure_ad_redis_token():
+    """Test _generate_azure_ad_redis_token with mocked Azure credential."""
+    from unittest.mock import Mock, patch
+
+    expected_token = "azure-access-token-12345"
+
+    mock_token = Mock()
+    mock_token.token = expected_token
+
+    mock_credential = Mock()
+    mock_credential.get_token.return_value = mock_token
+
+    mock_azure_identity = Mock()
+    mock_azure_identity.DefaultAzureCredential = Mock(return_value=mock_credential)
+    mock_azure_identity.ClientSecretCredential = Mock()
+    mock_azure_identity.ManagedIdentityCredential = Mock()
+
+    with patch.dict(
+        "sys.modules", {"azure.identity": mock_azure_identity, "azure": Mock()}
+    ):
+        from litellm._redis import _generate_azure_ad_redis_token
+
+        result = _generate_azure_ad_redis_token()
+
+        assert result == expected_token
+        mock_credential.get_token.assert_called_once_with(
+            "https://redis.azure.com/.default"
+        )
+
+
+def test_generate_azure_ad_redis_token_service_principal():
+    """Test _generate_azure_ad_redis_token with service principal credentials."""
+    from unittest.mock import Mock, patch
+
+    expected_token = "sp-access-token-67890"
+
+    mock_token = Mock()
+    mock_token.token = expected_token
+
+    mock_credential = Mock()
+    mock_credential.get_token.return_value = mock_token
+
+    mock_client_secret_credential = Mock(return_value=mock_credential)
+
+    mock_azure_identity = Mock()
+    mock_azure_identity.DefaultAzureCredential = Mock()
+    mock_azure_identity.ClientSecretCredential = mock_client_secret_credential
+    mock_azure_identity.ManagedIdentityCredential = Mock()
+
+    with patch.dict(
+        "sys.modules", {"azure.identity": mock_azure_identity, "azure": Mock()}
+    ):
+        from litellm._redis import _generate_azure_ad_redis_token
+
+        result = _generate_azure_ad_redis_token(
+            azure_client_id="test-client-id",
+            azure_tenant_id="test-tenant-id",
+            azure_client_secret="test-secret",
+        )
+
+        assert result == expected_token
+        mock_client_secret_credential.assert_called_once_with(
+            client_id="test-client-id",
+            tenant_id="test-tenant-id",
+            client_secret="test-secret",
+        )
+
+
+def test_generate_azure_ad_redis_token_import_error():
+    """Test that _generate_azure_ad_redis_token raises ImportError when azure-identity is missing."""
+    from unittest.mock import patch
+    from litellm._redis import _generate_azure_ad_redis_token
+
+    with patch.dict("sys.modules", {"azure.identity": None}):
+        with pytest.raises(ImportError) as exc_info:
+            _generate_azure_ad_redis_token()
+
+        assert "azure-identity is required" in str(exc_info.value)
+
+
+def test_redis_client_logic_azure_ad_auth():
+    """Test that _get_redis_client_logic sets up Azure AD auth when REDIS_AZURE_AD_TOKEN=true.
+
+    Mocks ``azure.identity`` via ``sys.modules`` so the test does not require
+    the real ``azure-identity`` package to be installed in the CI environment.
+    """
+    from unittest.mock import Mock, patch
+
+    mock_credential = Mock()
+    mock_azure_identity = Mock()
+    mock_azure_identity.DefaultAzureCredential = Mock(return_value=mock_credential)
+    mock_azure_identity.ClientSecretCredential = Mock(return_value=mock_credential)
+    mock_azure_identity.ManagedIdentityCredential = Mock(return_value=mock_credential)
+
+    with patch.dict(
+        "sys.modules", {"azure.identity": mock_azure_identity, "azure": Mock()}
+    ):
+        from litellm._redis import _get_redis_client_logic
+
+        redis_kwargs = _get_redis_client_logic(
+            host="myredis.redis.cache.windows.net",
+            port="6380",
+            azure_redis_ad_token="true",
+            ssl=True,
+        )
+
+        assert "redis_connect_func" in redis_kwargs
+        # Marker for async paths to detect Azure AD auth
+        assert hasattr(redis_kwargs["redis_connect_func"], "_azure_redis_ad_token")
+        assert redis_kwargs["redis_connect_func"]._azure_redis_ad_token is True
+        # Live credential object (not raw secret) is exposed for async paths
+        assert hasattr(redis_kwargs["redis_connect_func"], "_azure_credential")
+        # Raw credentials must NOT be exposed on the function
+        assert not hasattr(redis_kwargs["redis_connect_func"], "_azure_client_secret")
+        assert not hasattr(redis_kwargs["redis_connect_func"], "_azure_client_id")
+        assert not hasattr(redis_kwargs["redis_connect_func"], "_azure_tenant_id")
+
+        # Azure-specific kwargs should be removed from the dict passed to Redis
+        assert "azure_redis_ad_token" not in redis_kwargs
+        assert "azure_client_id" not in redis_kwargs
+
+
 if __name__ == "__main__":
     # Allow running this test file directly for debugging
     pytest.main([__file__, "-v"])
diff --git a/ui/litellm-dashboard/src/components/guardrails/add_guardrail_form.tsx b/ui/litellm-dashboard/src/components/guardrails/add_guardrail_form.tsx
index c91a6e85cdd..16c1c6efecd 100644
--- a/ui/litellm-dashboard/src/components/guardrails/add_guardrail_form.tsx
+++ b/ui/litellm-dashboard/src/components/guardrails/add_guardrail_form.tsx
@@ -5,6 +5,7 @@ import { createGuardrailCall, getGuardrailProviderSpecificParams, getGuardrailUI
 import ContentFilterConfiguration from "./content_filter/ContentFilterConfiguration";
 import {
   choiceToSkipSystemForCreate,
+  choiceToSkipToolForCreate,
   getGuardrailProviders,
   guardrail_provider_map,
   guardrailLogoMap,
@@ -188,6 +189,7 @@ const AddGuardrailForm: React.FC<AddGuardrailFormProps> = ({ visible, onClose, a
       mode: preset.mode,
       default_on: preset.defaultOn,
       skip_system_message_choice: "inherit",
+      skip_tool_message_choice: "inherit",
     };
     if (preset.provider === "BlockCodeExecution") {
       baseValues.confidence_threshold = 0.5;
@@ -433,6 +435,11 @@ const AddGuardrailForm: React.FC<AddGuardrailFormProps> = ({ visible, onClose, a
         guardrailData.litellm_params.skip_system_message_in_guardrail = skipForCreate;
       }
 
+      const skipToolForCreate = choiceToSkipToolForCreate(values.skip_tool_message_choice);
+      if (skipToolForCreate !== undefined) {
+        guardrailData.litellm_params.skip_tool_message_in_guardrail = skipToolForCreate;
+      }
+
       // For Presidio PII, add the entity and action configurations
       if (values.provider === "PresidioPII" && selectedEntities.length > 0) {
         const piiEntitiesConfig: { [key: string]: string } = {};
@@ -804,6 +811,18 @@ const AddGuardrailForm: React.FC<AddGuardrailFormProps> = ({ visible, onClose, a
           </Select>
         </Form.Item>
 
+        <Form.Item
+          name="skip_tool_message_choice"
+          label="Skip tool messages in guardrail"
+          tooltip="Unified guardrails only: omit role: tool from guardrail evaluation input (OpenAI chat + Anthropic messages). The model still receives full messages. Use global default follows litellm_settings.skip_tool_message_in_guardrail."
+        >
+          <Select>
+            <Select.Option value="inherit">Use global default</Select.Option>
+            <Select.Option value="yes">Yes — exclude from guardrail scan</Select.Option>
+            <Select.Option value="no">No — always include in scan</Select.Option>
+          </Select>
+        </Form.Item>
+
         {/* Use the GuardrailProviderFields component to render provider-specific fields */}
         {!isToolPermissionProvider && !shouldRenderContentFilterConfigSettings(selectedProvider) && !shouldRenderLLMJudgeFields(selectedProvider) && (
           <GuardrailProviderFields
@@ -1155,6 +1174,7 @@ const AddGuardrailForm: React.FC<AddGuardrailFormProps> = ({ visible, onClose, a
               mode: "pre_call",
               default_on: false,
               skip_system_message_choice: "inherit",
+              skip_tool_message_choice: "inherit",
             }}
           >
             {stepConfigs.map((step, index) => {
diff --git a/ui/litellm-dashboard/src/components/guardrails/edit_guardrail_form.tsx b/ui/litellm-dashboard/src/components/guardrails/edit_guardrail_form.tsx
index ad823df53fc..8ba9b0b312f 100644
--- a/ui/litellm-dashboard/src/components/guardrails/edit_guardrail_form.tsx
+++ b/ui/litellm-dashboard/src/components/guardrails/edit_guardrail_form.tsx
@@ -6,6 +6,7 @@ import {
   guardrailLogoMap,
   getGuardrailProviders,
   type SkipSystemMessageChoice,
+  type SkipToolMessageChoice,
 } from "./guardrail_info_helpers";
 import { getGuardrailUISettings, getGlobalLitellmHeaderName } from "../networking";
 import PiiConfiguration from "./pii_configuration";
@@ -29,6 +30,7 @@ interface EditGuardrailFormProps {
     default_on: boolean;
     pii_entities_config?: { [key: string]: string };
     skip_system_message_choice?: SkipSystemMessageChoice;
+    skip_tool_message_choice?: SkipToolMessageChoice;
     [key: string]: any;
   };
 }
@@ -138,6 +140,15 @@ const EditGuardrailForm: React.FC<EditGuardrailFormProps> = ({
         delete litellm_params.skip_system_message_in_guardrail;
       }
 
+      const skipToolChoice = values.skip_tool_message_choice as SkipToolMessageChoice | undefined;
+      if (skipToolChoice === "yes") {
+        litellm_params.skip_tool_message_in_guardrail = true;
+      } else if (skipToolChoice === "no") {
+        litellm_params.skip_tool_message_in_guardrail = false;
+      } else {
+        delete litellm_params.skip_tool_message_in_guardrail;
+      }
+
       let guardrail_info: any = {};
 
       // For Presidio PII, add the entity and action configurations
@@ -432,6 +443,18 @@ const EditGuardrailForm: React.FC<EditGuardrailFormProps> = ({
           </Select>
         </Form.Item>
 
+        <Form.Item
+          name="skip_tool_message_choice"
+          label="Skip tool messages in guardrail"
+          tooltip="Unified guardrails only: whether role: tool content is omitted from guardrail input (LLM still receives full messages). Use global default follows litellm_settings.skip_tool_message_in_guardrail."
+        >
+          <Select>
+            <Option value="inherit">Use global default</Option>
+            <Option value="yes">Yes — exclude from guardrail scan</Option>
+            <Option value="no">No — always include in scan</Option>
+          </Select>
+        </Form.Item>
+
         {renderProviderSpecificFields()}
 
         <div className="flex justify-end space-x-2 mt-4">
diff --git a/ui/litellm-dashboard/src/components/guardrails/guardrail_info.tsx b/ui/litellm-dashboard/src/components/guardrails/guardrail_info.tsx
index 60400443d5c..53aebcff0de 100644
--- a/ui/litellm-dashboard/src/components/guardrails/guardrail_info.tsx
+++ b/ui/litellm-dashboard/src/components/guardrails/guardrail_info.tsx
@@ -29,7 +29,9 @@ import {
   getGuardrailLogoAndName,
   guardrail_provider_map,
   skipSystemMessageToChoice,
+  skipToolMessageToChoice,
   type SkipSystemMessageChoice,
+  type SkipToolMessageChoice,
 } from "./guardrail_info_helpers";
 import GuardrailOptionalParams from "./guardrail_optional_params";
 import GuardrailProviderFields from "./guardrail_provider_fields";
@@ -214,12 +216,16 @@ const GuardrailInfoView: React.FC<GuardrailInfoProps> = ({ guardrailId, onClose,
     if (guardrailData && form) {
       const lp = { ...(guardrailData.litellm_params || {}) };
       delete lp.skip_system_message_in_guardrail;
+      delete lp.skip_tool_message_in_guardrail;
       form.setFieldsValue({
         guardrail_name: guardrailData.guardrail_name,
         ...lp,
         skip_system_message_choice: skipSystemMessageToChoice(
           guardrailData.litellm_params?.skip_system_message_in_guardrail,
         ),
+        skip_tool_message_choice: skipToolMessageToChoice(
+          guardrailData.litellm_params?.skip_tool_message_in_guardrail,
+        ),
         guardrail_info: guardrailData.guardrail_info ? JSON.stringify(guardrailData.guardrail_info, null, 2) : "",
         // Include any optional_params if they exist
         ...(guardrailData.litellm_params?.optional_params && {
@@ -302,6 +308,20 @@ const GuardrailInfoView: React.FC<GuardrailInfoProps> = ({ guardrailId, onClose,
         }
       }
 
+      const prevSkipToolChoice = skipToolMessageToChoice(
+        guardrailData.litellm_params?.skip_tool_message_in_guardrail,
+      );
+      const nextSkipToolChoice = values.skip_tool_message_choice as SkipToolMessageChoice | undefined;
+      if (nextSkipToolChoice !== undefined && nextSkipToolChoice !== prevSkipToolChoice) {
+        if (nextSkipToolChoice === "inherit") {
+          updateData.litellm_params.skip_tool_message_in_guardrail = null;
+        } else if (nextSkipToolChoice === "yes") {
+          updateData.litellm_params.skip_tool_message_in_guardrail = true;
+        } else {
+          updateData.litellm_params.skip_tool_message_in_guardrail = false;
+        }
+      }
+
       // Only include guardrail_info if it has changed
       const originalGuardrailInfo = guardrailData.guardrail_info;
       const newGuardrailInfo = values.guardrail_info ? JSON.parse(values.guardrail_info) : undefined;
@@ -674,11 +694,15 @@ const GuardrailInfoView: React.FC<GuardrailInfoProps> = ({ guardrailId, onClose,
                       ...(() => {
                         const lp = { ...(guardrailData.litellm_params || {}) };
                         delete lp.skip_system_message_in_guardrail;
+                        delete lp.skip_tool_message_in_guardrail;
                         return lp;
                       })(),
                       skip_system_message_choice: skipSystemMessageToChoice(
                         guardrailData.litellm_params?.skip_system_message_in_guardrail,
                       ),
+                      skip_tool_message_choice: skipToolMessageToChoice(
+                        guardrailData.litellm_params?.skip_tool_message_in_guardrail,
+                      ),
                       guardrail_info: guardrailData.guardrail_info
                         ? JSON.stringify(guardrailData.guardrail_info, null, 2)
                         : "",
@@ -716,6 +740,18 @@ const GuardrailInfoView: React.FC<GuardrailInfoProps> = ({ guardrailId, onClose,
                       </Select>
                     </Form.Item>
 
+                    <Form.Item
+                      label="Skip tool messages in guardrail"
+                      name="skip_tool_message_choice"
+                      tooltip="Unified guardrails: omit role: tool from guardrail input (LLM still gets full messages). Use global default follows litellm_settings.skip_tool_message_in_guardrail."
+                    >
+                      <Select>
+                        <Select.Option value="inherit">Use global default</Select.Option>
+                        <Select.Option value="yes">Yes — exclude from guardrail scan</Select.Option>
+                        <Select.Option value="no">No — always include in scan</Select.Option>
+                      </Select>
+                    </Form.Item>
+
                     {guardrailData.litellm_params?.guardrail === "presidio" && (
                       <>
                         <Divider orientation="left">PII Protection</Divider>
diff --git a/ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.test.tsx b/ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.test.tsx
index dfda86c1e4a..1fc62f94cf1 100644
--- a/ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.test.tsx
+++ b/ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.test.tsx
@@ -12,6 +12,8 @@ import {
   GuardrailProviders,
   skipSystemMessageToChoice,
   choiceToSkipSystemForCreate,
+  skipToolMessageToChoice,
+  choiceToSkipToolForCreate,
 } from "./guardrail_info_helpers";
 
 describe("guardrail_info_helpers", () => {
@@ -215,4 +217,18 @@ describe("guardrail_info_helpers", () => {
       expect(choiceToSkipSystemForCreate("no")).toBe(false);
     });
   });
+
+  describe("skipToolMessageToChoice / choiceToSkipToolForCreate", () => {
+    it("maps API values to form choices and back for create", () => {
+      expect(skipToolMessageToChoice(undefined)).toBe("inherit");
+      expect(skipToolMessageToChoice(null)).toBe("inherit");
+      expect(skipToolMessageToChoice(true)).toBe("yes");
+      expect(skipToolMessageToChoice(false)).toBe("no");
+
+      expect(choiceToSkipToolForCreate("inherit")).toBeUndefined();
+      expect(choiceToSkipToolForCreate(undefined)).toBeUndefined();
+      expect(choiceToSkipToolForCreate("yes")).toBe(true);
+      expect(choiceToSkipToolForCreate("no")).toBe(false);
+    });
+  });
 });
diff --git a/ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.tsx b/ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.tsx
index ac4b787e96a..54b16b81765 100644
--- a/ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.tsx
+++ b/ui/litellm-dashboard/src/components/guardrails/guardrail_info_helpers.tsx
@@ -179,3 +179,19 @@ export function choiceToSkipSystemForCreate(choice: SkipSystemMessageChoice | un
   if (choice === "no") return false;
   return undefined;
 }
+
+/** Tri-state UI value for `litellm_params.skip_tool_message_in_guardrail` (inherit = use global). */
+export type SkipToolMessageChoice = "inherit" | "yes" | "no";
+
+export function skipToolMessageToChoice(v: boolean | null | undefined): SkipToolMessageChoice {
+  if (v === true) return "yes";
+  if (v === false) return "no";
+  return "inherit";
+}
+
+/** Create flow: omit key when inheriting global default. */
+export function choiceToSkipToolForCreate(choice: SkipToolMessageChoice | undefined): boolean | undefined {
+  if (choice === "yes") return true;
+  if (choice === "no") return false;
+  return undefined;
+}
diff --git a/ui/litellm-dashboard/src/components/guardrails/guardrail_table.tsx b/ui/litellm-dashboard/src/components/guardrails/guardrail_table.tsx
index 5bb2da78fa2..ecf6ce48fde 100644
--- a/ui/litellm-dashboard/src/components/guardrails/guardrail_table.tsx
+++ b/ui/litellm-dashboard/src/components/guardrails/guardrail_table.tsx
@@ -11,7 +11,12 @@ import {
   SortingState,
   useReactTable,
 } from "@tanstack/react-table";
-import { getGuardrailLogoAndName, guardrail_provider_map, skipSystemMessageToChoice } from "./guardrail_info_helpers";
+import {
+  getGuardrailLogoAndName,
+  guardrail_provider_map,
+  skipSystemMessageToChoice,
+  skipToolMessageToChoice,
+} from "./guardrail_info_helpers";
 import EditGuardrailForm from "./edit_guardrail_form";
 import { Guardrail, GuardrailDefinitionLocation } from "./types";
 
@@ -304,6 +309,9 @@ const GuardrailTable: React.FC<GuardrailTableProps> = ({
             skip_system_message_choice: skipSystemMessageToChoice(
               selectedGuardrail.litellm_params?.skip_system_message_in_guardrail,
             ),
+            skip_tool_message_choice: skipToolMessageToChoice(
+              selectedGuardrail.litellm_params?.skip_tool_message_in_guardrail,
+            ),
             ...selectedGuardrail.guardrail_info,
           }}
         />

From 9f68d2bb774b1d68696ae15460f3bd1ec74167bb Mon Sep 17 00:00:00 2001
From: oss-agent-shin <ext-agent-shin@berri.ai>
Date: Sat, 9 May 2026 17:18:55 -0700
Subject: [PATCH 30/33] Fix: tag budget reset must drop stale management-cache
 entry (#27568)

Squash-merged by litellm-agent from oss-agent-shin's PR.
---
 AGENTS.md                                     |   21 +-
 CLAUDE.md                                     |    2 +-
 deploy/Dockerfile.ghcr_base                   |   18 -
 deploy/kubernetes/kub.yaml                    |   56 -
 deploy/kubernetes/service.yaml                |   12 -
 dev_config.yaml                               |   13 -
 docker/Dockerfile.alpine                      |   68 -
 docker/Dockerfile.custom_ui                   |   86 -
 docker/Dockerfile.dev                         |  121 -
 docker/Dockerfile.health_check                |   30 -
 index.yaml                                    |  108 -
 litellm-js/proxy/.npmrc                       |    5 -
 litellm-js/proxy/README.md                    |    8 -
 litellm-js/proxy/package-lock.json            | 2054 -----------------
 litellm-js/proxy/package.json                 |   14 -
 litellm-js/proxy/src/index.ts                 |   59 -
 litellm-js/proxy/tsconfig.json                |   17 -
 litellm-js/proxy/wrangler.toml                |   18 -
 litellm-js/spend-logs/.npmrc                  |    5 -
 litellm-js/spend-logs/Dockerfile              |   26 -
 litellm-js/spend-logs/README.md               |    8 -
 litellm-js/spend-logs/package-lock.json       |  597 -----
 litellm-js/spend-logs/package.json            |   13 -
 litellm-js/spend-logs/schema.prisma           |   29 -
 litellm-js/spend-logs/src/_types.ts           |   32 -
 litellm-js/spend-logs/src/index.ts            |   84 -
 litellm-js/spend-logs/tsconfig.json           |   13 -
 litellm/proxy/auth/auth_checks.py             |    6 +-
 litellm/proxy/auth/auth_exception_handler.py  |    2 +-
 litellm/proxy/auth/user_api_key_auth.py       |    6 +-
 .../proxy/common_utils/reset_budget_job.py    |  194 +-
 litellm/proxy/proxy_server.py                 |   74 +-
 pyproject.toml                                |    2 +-
 .../test_proxy_budget_reset.py                |   28 +
 tests/otel_tests/test_e2e_budgeting.py        |    4 +-
 tests/otel_tests/test_e2e_model_access.py     |    4 +-
 .../proxy/auth/test_auth_checks.py            |   49 +
 .../proxy/auth/test_auth_exception_handler.py |    1 +
 .../proxy/auth/test_user_api_key_auth.py      |   23 +
 .../common_utils/test_reset_budget_job.py     |  350 ++-
 tests/test_litellm/proxy/test_proxy_server.py |   61 +
 tests/test_openai_endpoints.py                |    2 +-
 tests/test_users.py                           |    4 +-
 uv.lock                                       |    2 +-
 44 files changed, 727 insertions(+), 3602 deletions(-)
 delete mode 100644 deploy/Dockerfile.ghcr_base
 delete mode 100644 deploy/kubernetes/kub.yaml
 delete mode 100644 deploy/kubernetes/service.yaml
 delete mode 100644 dev_config.yaml
 delete mode 100644 docker/Dockerfile.alpine
 delete mode 100644 docker/Dockerfile.custom_ui
 delete mode 100644 docker/Dockerfile.dev
 delete mode 100644 docker/Dockerfile.health_check
 delete mode 100644 index.yaml
 delete mode 100644 litellm-js/proxy/.npmrc
 delete mode 100644 litellm-js/proxy/README.md
 delete mode 100644 litellm-js/proxy/package-lock.json
 delete mode 100644 litellm-js/proxy/package.json
 delete mode 100644 litellm-js/proxy/src/index.ts
 delete mode 100644 litellm-js/proxy/tsconfig.json
 delete mode 100644 litellm-js/proxy/wrangler.toml
 delete mode 100644 litellm-js/spend-logs/.npmrc
 delete mode 100644 litellm-js/spend-logs/Dockerfile
 delete mode 100644 litellm-js/spend-logs/README.md
 delete mode 100644 litellm-js/spend-logs/package-lock.json
 delete mode 100644 litellm-js/spend-logs/package.json
 delete mode 100644 litellm-js/spend-logs/schema.prisma
 delete mode 100644 litellm-js/spend-logs/src/_types.ts
 delete mode 100644 litellm-js/spend-logs/src/index.ts
 delete mode 100644 litellm-js/spend-logs/tsconfig.json

diff --git a/AGENTS.md b/AGENTS.md
index 4bdbf26ae9d..e99bf79d783 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -241,10 +241,27 @@ When opening issues or pull requests, follow these templates:
 
 ### Running the proxy server
 
-Start the proxy with a config file:
+Create a minimal config file and start the proxy:
+
+```yaml
+# config.yaml
+model_list:
+  - model_name: fake-openai-endpoint
+    litellm_params:
+      model: openai/fake-model
+      api_key: fake-key
+      api_base: https://fake-api.example.com
+
+general_settings:
+  master_key: sk-1234
+
+litellm_settings:
+  drop_params: True
+  telemetry: False
+```
 
 ```bash
-uv run litellm --config dev_config.yaml --port 4000
+uv run litellm --config config.yaml --port 4000
 ```
 
 The proxy takes ~15-20 seconds to fully start (it runs Prisma migrations on boot). Wait for `/health` to return before sending requests. Without a PostgreSQL `DATABASE_URL`, the proxy connects to a default Neon dev database embedded in the `litellm-proxy-extras` package.
diff --git a/CLAUDE.md b/CLAUDE.md
index 71e5af28ee7..938801df7c7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -146,7 +146,7 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 - **Bound large result sets.** Prisma materializes full results in memory. For results over ~10 MB, paginate with `take`/`skip` or `cursor`/`take`, always with an explicit `order`. Prefer cursor-based pagination (`skip` is O(n)). Don't paginate naturally small result sets.
 - **Limit fetched columns on wide tables.** Use `select` to fetch only needed fields — returns a partial object, so downstream code must not access unselected fields.
 - **Check index coverage.** For new or modified queries, check `schema.prisma` for a supporting index. Prefer extending an existing index (e.g. `@@index([a])` → `@@index([a, b])`) over adding a new one, unless it's a `@@unique`. Only add indexes for large/frequent queries.
-- **Keep schema files in sync.** Apply schema changes to all `schema.prisma` copies (`schema.prisma`, `litellm/proxy/`, `litellm-proxy-extras/`, `litellm-js/spend-logs/` for SpendLogs) with a migration under `litellm-proxy-extras/litellm_proxy_extras/migrations/`.
+- **Keep schema files in sync.** Apply schema changes to all `schema.prisma` copies (`schema.prisma`, `litellm/proxy/`, `litellm-proxy-extras/`) with a migration under `litellm-proxy-extras/litellm_proxy_extras/migrations/`.
 
 ### Setup Wizard (`litellm/setup_wizard.py`)
 - The wizard is implemented as a single `SetupWizard` class with `@staticmethod` methods — keep it that way. No module-level functions except `run_setup_wizard()` (the public entrypoint) and pure helpers (color, ANSI).
diff --git a/deploy/Dockerfile.ghcr_base b/deploy/Dockerfile.ghcr_base
deleted file mode 100644
index 66e64e5b774..00000000000
--- a/deploy/Dockerfile.ghcr_base
+++ /dev/null
@@ -1,18 +0,0 @@
-# Use the provided base image
-FROM ghcr.io/berriai/litellm:main-latest@sha256:7c311546c25e7bb6e8cafede9fcd3d0d622ac636b5c9418befaa32e85dfb0186
-
-# Set the working directory to /app
-WORKDIR /app
-
-# Copy the configuration file into the container at /app
-COPY config.yaml .
-
-# Make sure your docker/entrypoint.sh is executable
-# Convert Windows line endings to Unix
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
-
-# Expose the necessary port
-EXPOSE 4000/tcp
-
-# Override the CMD instruction with your desired command and arguments
-CMD ["--port", "4000", "--config", "config.yaml", "--detailed_debug", "--run_gunicorn"]
diff --git a/deploy/kubernetes/kub.yaml b/deploy/kubernetes/kub.yaml
deleted file mode 100644
index d5ba500d8f0..00000000000
--- a/deploy/kubernetes/kub.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: litellm-deployment
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: litellm
-  template:
-    metadata:
-      labels:
-        app: litellm
-    spec:
-      containers:
-        - name: litellm-container
-          image: ghcr.io/berriai/litellm:main-latest
-          imagePullPolicy: Always
-          env:
-            - name: AZURE_API_KEY
-              value: "d6f****"
-            - name: AZURE_API_BASE
-              value: "https://openai"
-            - name: LITELLM_MASTER_KEY
-              value: "sk-1234"
-            - name: DATABASE_URL
-              value: "postgresql://ishaan*********"
-          args:
-            - "--config"
-            - "/app/proxy_config.yaml"  # Update the path to mount the config file
-          volumeMounts:                 # Define volume mount for proxy_config.yaml
-            - name: config-volume
-              mountPath: /app
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /health/liveliness
-              port: 4000
-            initialDelaySeconds: 120
-            periodSeconds: 15
-            successThreshold: 1
-            failureThreshold: 3
-            timeoutSeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /health/readiness
-              port: 4000
-            initialDelaySeconds: 120
-            periodSeconds: 15
-            successThreshold: 1
-            failureThreshold: 3
-            timeoutSeconds: 10
-      volumes:  # Define volume to mount proxy_config.yaml
-        - name: config-volume
-          configMap:
-            name: litellm-config  
diff --git a/deploy/kubernetes/service.yaml b/deploy/kubernetes/service.yaml
deleted file mode 100644
index 4751c837254..00000000000
--- a/deploy/kubernetes/service.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: litellm-service
-spec:
-  selector:
-    app: litellm
-  ports:
-    - protocol: TCP
-      port: 4000
-      targetPort: 4000
-  type: LoadBalancer
\ No newline at end of file
diff --git a/dev_config.yaml b/dev_config.yaml
deleted file mode 100644
index 64e3c14703e..00000000000
--- a/dev_config.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-model_list:
-  - model_name: fake-openai-endpoint
-    litellm_params:
-      model: openai/fake-model
-      api_key: fake-key
-      api_base: https://exampleopenaiendpoint-production.up.railway.app/
-
-general_settings:
-  master_key: sk-1234
-
-litellm_settings:
-  drop_params: True
-  telemetry: False
diff --git a/docker/Dockerfile.alpine b/docker/Dockerfile.alpine
deleted file mode 100644
index 5de588cf4e4..00000000000
--- a/docker/Dockerfile.alpine
+++ /dev/null
@@ -1,68 +0,0 @@
-# Base image for building
-ARG LITELLM_BUILD_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856
-
-# Runtime image
-ARG LITELLM_RUNTIME_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
-
-FROM $UV_IMAGE AS uvbin
-
-FROM $LITELLM_BUILD_IMAGE AS builder
-
-WORKDIR /app
-
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
-
-RUN apk add --no-cache gcc python3-dev musl-dev nodejs npm libsndfile
-
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
-
-# Copy dependency metadata first for layer caching
-COPY pyproject.toml uv.lock ./
-COPY enterprise/pyproject.toml enterprise/
-COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
-
-# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
-RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
-
-# Copy full source tree
-COPY . .
-
-# Install project and workspace packages (fast - deps already cached)
-RUN uv sync --frozen --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
-
-RUN prisma generate --schema=./schema.prisma
-
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
-
-FROM $LITELLM_RUNTIME_IMAGE AS runtime
-
-RUN apk upgrade --no-cache && apk add --no-cache libsndfile nodejs npm
-
-WORKDIR /app
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
-
-COPY --from=builder /app /app
-
-EXPOSE 4000/tcp
-
-ENTRYPOINT ["docker/prod_entrypoint.sh"]
-CMD ["--port", "4000"]
diff --git a/docker/Dockerfile.custom_ui b/docker/Dockerfile.custom_ui
deleted file mode 100644
index cc44893bf92..00000000000
--- a/docker/Dockerfile.custom_ui
+++ /dev/null
@@ -1,86 +0,0 @@
-# Use the provided base image
-# NOTE: This is a dev/branch-specific tag. Update digest when the base image is rebuilt.
-FROM ghcr.io/berriai/litellm:litellm_fwd_server_root_path-dev
-
-# Set the working directory to /app
-WORKDIR /app
-
-# Install Node.js and npm (adjust version as needed)
-RUN apt-get update && apt-get upgrade -y \
-        libxml2 \
-        libexpat1 \
-        openssl \
-        libssl3 \
-        git \
-        libkrb5-3 \
-        libglib2.0-0 \
-        wget \
-        libaom3 \
-        libxslt1.1 \
-        libgnutls30 \
-        libc6 && \
-    apt-get install -y --no-install-recommends nodejs npm && \
-    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
-    GLOBAL="$(npm root -g)" && \
-    find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
-    done && \
-    find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
-    done && \
-    find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
-    done && \
-    find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
-    done && \
-    find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
-    done && \
-    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
-        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
-    npm cache clean --force && \
-    apt-get purge -y npm
-
-# Copy the UI source into the container
-COPY ./ui/litellm-dashboard /app/ui/litellm-dashboard
-
-# Set an environment variable for UI_BASE_PATH
-# This can be overridden at build time
-# set UI_BASE_PATH to "<your server root path>/ui"
-ENV UI_BASE_PATH="/prod/ui"
-
-# Build the UI with the specified UI_BASE_PATH
-WORKDIR /app/ui/litellm-dashboard
-RUN npm ci
-RUN UI_BASE_PATH=$UI_BASE_PATH npm run build
-
-# Create the destination directory
-RUN mkdir -p /app/litellm/proxy/_experimental/out
-
-# Move the built files to the appropriate location
-# Assuming the build output is in ./out directory
-RUN rm -rf /app/litellm/proxy/_experimental/out/* && \
-    mv ./out/* /app/litellm/proxy/_experimental/out/
-
-# Switch back to the main app directory
-WORKDIR /app
-
-# Make sure your docker/entrypoint.sh is executable
-# Convert Windows line endings to Unix for entrypoint scripts
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
-RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
-
-# Run as non-root user
-RUN groupadd --gid 1000 appuser && useradd --uid 1000 --gid 1000 --no-create-home appuser \
-    && chown -R appuser:appuser /app
-USER appuser
-
-# Expose the necessary port
-EXPOSE 4000/tcp
-
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/health')"]
-
-# Override the CMD instruction with your desired command and arguments
-CMD ["--port", "4000", "--config", "config.yaml", "--detailed_debug"]
\ No newline at end of file
diff --git a/docker/Dockerfile.dev b/docker/Dockerfile.dev
deleted file mode 100644
index ebc92a22d50..00000000000
--- a/docker/Dockerfile.dev
+++ /dev/null
@@ -1,121 +0,0 @@
-# Base image for building
-ARG LITELLM_BUILD_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
-
-# Runtime image
-ARG LITELLM_RUNTIME_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
-
-FROM $UV_IMAGE AS uvbin
-
-FROM $LITELLM_BUILD_IMAGE AS builder
-
-WORKDIR /app
-USER root
-
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    gcc \
-    g++ \
-    python3-dev \
-    libssl-dev \
-    pkg-config \
-    nodejs \
-    npm \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
-
-# Copy dependency metadata first for layer caching
-COPY pyproject.toml uv.lock ./
-COPY enterprise/pyproject.toml enterprise/
-COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
-
-# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
-RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python
-
-# Copy full source tree
-COPY . .
-
-# Build Admin UI before final sync
-RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
-
-# Install project and workspace packages (fast - deps already cached)
-RUN uv sync --frozen --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python
-
-RUN prisma generate --schema=./schema.prisma
-
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
-
-FROM $LITELLM_RUNTIME_IMAGE AS runtime
-
-USER root
-
-RUN apt-get update && apt-get upgrade -y \
-        libxml2 \
-        libexpat1 \
-        openssl \
-        libssl3 \
-        git \
-        libkrb5-3 \
-        libglib2.0-0 \
-        wget \
-        libaom3 \
-        libxslt1.1 \
-        libgnutls30 \
-        libc6 \
-    && apt-get install -y --no-install-recommends \
-        libssl3 \
-        libatomic1 \
-        nodejs \
-        npm \
-    && rm -rf /var/lib/apt/lists/* \
-    && npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
-    && GLOBAL="$(npm root -g)" \
-    && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
-          rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
-       done \
-    && find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
-          rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
-       done \
-    && find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
-          rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
-       done \
-    && find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
-          rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
-       done \
-    && find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
-          rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
-       done \
-    && find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
-        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \
-    && npm cache clean --force \
-    && apt-get purge -y npm
-
-WORKDIR /app
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
-
-COPY --from=builder /app /app
-
-EXPOSE 4000/tcp
-
-ENTRYPOINT ["docker/prod_entrypoint.sh"]
-CMD ["--port", "4000"]
diff --git a/docker/Dockerfile.health_check b/docker/Dockerfile.health_check
deleted file mode 100644
index a2e5cb9f71f..00000000000
--- a/docker/Dockerfile.health_check
+++ /dev/null
@@ -1,30 +0,0 @@
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.7@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a
-FROM $UV_IMAGE AS uvbin
-
-FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
-
-WORKDIR /app
-
-# Copy the uv binary and the health check script.
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY pyproject.toml uv.lock /app/
-COPY scripts/health_check/health_check_client.py /app/health_check_client.py
-
-# Resolve and install the health-check dependencies from the project lockfile
-# so the runtime image stays self-contained and reproducible.
-RUN uv export --frozen --no-default-groups --only-group healthcheck --no-emit-project --no-hashes --output-file /tmp/health-check-requirements.txt \
-  && uv pip install --system -r /tmp/health-check-requirements.txt \
-  && rm /tmp/health-check-requirements.txt \
-  && rm /app/pyproject.toml /app/uv.lock \
-  && chmod +x /app/health_check_client.py
-
-# Run as non-root user
-RUN groupadd --gid 1000 appuser && useradd --uid 1000 --gid 1000 --no-create-home appuser
-USER appuser
-
-# Health check
-HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
-  CMD ["python", "/app/health_check_client.py", "--help"]
-
-# Set entrypoint
-ENTRYPOINT ["python", "/app/health_check_client.py"]
diff --git a/index.yaml b/index.yaml
deleted file mode 100644
index 9b2461c36b5..00000000000
--- a/index.yaml
+++ /dev/null
@@ -1,108 +0,0 @@
-apiVersion: v1
-entries:
-  litellm-helm:
-  - apiVersion: v2
-    appVersion: v1.43.18
-    created: "2024-08-19T23:58:25.331689+08:00"
-    dependencies:
-    - condition: db.deployStandalone
-      name: postgresql
-      repository: oci://registry-1.docker.io/bitnamicharts
-      version: '>=13.3.0'
-    - condition: redis.enabled
-      name: redis
-      repository: oci://registry-1.docker.io/bitnamicharts
-      version: '>=18.0.0'
-    description: Call all LLM APIs using the OpenAI format
-    digest: 0411df3dc42868be8af3ad3e00cb252790e6bd7ad15f5b77f1ca5214573a8531
-    name: litellm-helm
-    type: application
-    urls:
-    - https://berriai.github.io/litellm/litellm-helm-0.2.3.tgz
-    version: 0.2.3
-  postgresql:
-  - annotations:
-      category: Database
-      images: |
-        - name: os-shell
-          image: docker.io/bitnami/os-shell:12-debian-12-r16
-        - name: postgres-exporter
-          image: docker.io/bitnami/postgres-exporter:0.15.0-debian-12-r14
-        - name: postgresql
-          image: docker.io/bitnami/postgresql:16.2.0-debian-12-r6
-      licenses: Apache-2.0
-    apiVersion: v2
-    appVersion: 16.2.0
-    created: "2024-08-19T23:58:25.335716+08:00"
-    dependencies:
-    - name: common
-      repository: oci://registry-1.docker.io/bitnamicharts
-      tags:
-      - bitnami-common
-      version: 2.x.x
-    description: PostgreSQL (Postgres) is an open source object-relational database
-      known for reliability and data integrity. ACID-compliant, it supports foreign
-      keys, joins, views, triggers and stored procedures.
-    digest: 3c8125526b06833df32e2f626db34aeaedb29d38f03d15349db6604027d4a167
-    home: https://bitnami.com
-    icon: https://bitnami.com/assets/stacks/postgresql/img/postgresql-stack-220x234.png
-    keywords:
-    - postgresql
-    - postgres
-    - database
-    - sql
-    - replication
-    - cluster
-    maintainers:
-    - name: VMware, Inc.
-      url: https://github.com/bitnami/charts
-    name: postgresql
-    sources:
-    - https://github.com/bitnami/charts/tree/main/bitnami/postgresql
-    urls:
-    - https://berriai.github.io/litellm/charts/postgresql-14.3.1.tgz
-    version: 14.3.1
-  redis:
-  - annotations:
-      category: Database
-      images: |
-        - name: kubectl
-          image: docker.io/bitnami/kubectl:1.29.2-debian-12-r3
-        - name: os-shell
-          image: docker.io/bitnami/os-shell:12-debian-12-r16
-        - name: redis
-          image: docker.io/bitnami/redis:7.2.4-debian-12-r9
-        - name: redis-exporter
-          image: docker.io/bitnami/redis-exporter:1.58.0-debian-12-r4
-        - name: redis-sentinel
-          image: docker.io/bitnami/redis-sentinel:7.2.4-debian-12-r7
-      licenses: Apache-2.0
-    apiVersion: v2
-    appVersion: 7.2.4
-    created: "2024-08-19T23:58:25.339392+08:00"
-    dependencies:
-    - name: common
-      repository: oci://registry-1.docker.io/bitnamicharts
-      tags:
-      - bitnami-common
-      version: 2.x.x
-    description: Redis(R) is an open source, advanced key-value store. It is often
-      referred to as a data structure server since keys can contain strings, hashes,
-      lists, sets and sorted sets.
-    digest: b2fa1835f673a18002ca864c54fadac3c33789b26f6c5e58e2851b0b14a8f984
-    home: https://bitnami.com
-    icon: https://bitnami.com/assets/stacks/redis/img/redis-stack-220x234.png
-    keywords:
-    - redis
-    - keyvalue
-    - database
-    maintainers:
-    - name: VMware, Inc.
-      url: https://github.com/bitnami/charts
-    name: redis
-    sources:
-    - https://github.com/bitnami/charts/tree/main/bitnami/redis
-    urls:
-    - https://berriai.github.io/litellm/charts/redis-18.19.1.tgz
-    version: 18.19.1
-generated: "2024-08-19T23:58:25.322532+08:00"
diff --git a/litellm-js/proxy/.npmrc b/litellm-js/proxy/.npmrc
deleted file mode 100644
index 7999681cc35..00000000000
--- a/litellm-js/proxy/.npmrc
+++ /dev/null
@@ -1,5 +0,0 @@
-# Supply-chain hardening
-# Packages needing lifecycle scripts: npm rebuild <pkg>
-ignore-scripts=true
-# Protects local npm install only — npm ci (used in CI) ignores this
-min-release-age=3
diff --git a/litellm-js/proxy/README.md b/litellm-js/proxy/README.md
deleted file mode 100644
index cc58e962d8f..00000000000
--- a/litellm-js/proxy/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-```
-npm install
-npm run dev
-```
-
-```
-npm run deploy
-```
diff --git a/litellm-js/proxy/package-lock.json b/litellm-js/proxy/package-lock.json
deleted file mode 100644
index 0d09fa1a6c4..00000000000
--- a/litellm-js/proxy/package-lock.json
+++ /dev/null
@@ -1,2054 +0,0 @@
-{
-  "name": "proxy",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "dependencies": {
-        "hono": "4.12.16",
-        "openai": "4.29.2"
-      },
-      "devDependencies": {
-        "@cloudflare/workers-types": "4.20260501.1",
-        "wrangler": "4.87.0"
-      }
-    },
-    "node_modules/@cloudflare/kv-asset-handler": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/@cloudflare/kv-asset-handler/-/kv-asset-handler-0.5.0.tgz",
-      "integrity": "sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg==",
-      "dev": true,
-      "license": "MIT OR Apache-2.0",
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@cloudflare/unenv-preset": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/unenv-preset/-/unenv-preset-2.16.1.tgz",
-      "integrity": "sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw==",
-      "dev": true,
-      "license": "MIT OR Apache-2.0",
-      "peerDependencies": {
-        "unenv": "2.0.0-rc.24",
-        "workerd": ">1.20260305.0 <2.0.0-0"
-      },
-      "peerDependenciesMeta": {
-        "workerd": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@cloudflare/workerd-darwin-64": {
-      "version": "1.20260430.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260430.1.tgz",
-      "integrity": "sha512-ADohZUHf7NBvPp2PdZig2Opxx+hDkk3ve7jrTne3JRx9kDSB73zc4LzcEeEN8LKkbAcqZmvfRJfpChSlusu0lA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@cloudflare/workerd-darwin-arm64": {
-      "version": "1.20260430.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260430.1.tgz",
-      "integrity": "sha512-/DoYC/1wHs+YRZzzqSQg1/EHB4hiv1yV5U8FnmapRRIzVaPtnt+ApeOXeMrIdKidgKOI8TqQzgBU8xbIM7Cl4Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@cloudflare/workerd-linux-64": {
-      "version": "1.20260430.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260430.1.tgz",
-      "integrity": "sha512-koJhBWvEVZPKCVFtMLp2iMHlYr+lFCF47wGbnlKdHVlemV0zTxJEyHI8aLlrhPLhBmOmYLp46rXw09/qJkRIhQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@cloudflare/workerd-linux-arm64": {
-      "version": "1.20260430.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260430.1.tgz",
-      "integrity": "sha512-hMdapNAzNQZDXGGkg4Slydc3fRJP5FUZLJVVcZCW/+imhhJro9Z1rv5n/wfR+txKoSWhTYR8eOp8Pyi2bzLzlw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@cloudflare/workerd-windows-64": {
-      "version": "1.20260430.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260430.1.tgz",
-      "integrity": "sha512-jS3ffixjb5USOwz4frw4WzCz0HrjVxkgyU3WiYb06N7hBAfN6eOrveAJ4QRef0+suK4V1vQFoB1oKdRBsXe9Dw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@cloudflare/workers-types": {
-      "version": "4.20260501.1",
-      "resolved": "https://registry.npmjs.org/@cloudflare/workers-types/-/workers-types-4.20260501.1.tgz",
-      "integrity": "sha512-B/VX2w3my/sCqxKyWOX7SxUpFC1uD8Gh7I2zbI1d3zA8p7Tx03AFsnuEx8lYLmcd8yONAA93YsAZb1wAaLK83w==",
-      "dev": true,
-      "license": "MIT OR Apache-2.0"
-    },
-    "node_modules/@cspotcode/source-map-support": {
-      "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz",
-      "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/trace-mapping": "0.3.9"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
-      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
-      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
-      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
-      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
-      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
-      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
-      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
-      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
-      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
-      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
-      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
-      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
-      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
-      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
-      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
-      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
-      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
-      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
-      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
-      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
-      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@img/colour": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
-      "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@img/sharp-darwin-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz",
-      "integrity": "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-darwin-arm64": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-darwin-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz",
-      "integrity": "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-darwin-x64": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-libvips-darwin-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz",
-      "integrity": "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-darwin-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz",
-      "integrity": "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-linux-arm": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz",
-      "integrity": "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-linux-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz",
-      "integrity": "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-linux-ppc64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz",
-      "integrity": "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-linux-riscv64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz",
-      "integrity": "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-linux-s390x": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz",
-      "integrity": "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-linux-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz",
-      "integrity": "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz",
-      "integrity": "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "libc": [
-        "musl"
-      ],
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-libvips-linuxmusl-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz",
-      "integrity": "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "libc": [
-        "musl"
-      ],
-      "license": "LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-linux-arm": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz",
-      "integrity": "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-linux-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz",
-      "integrity": "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm64": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-linux-ppc64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz",
-      "integrity": "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-linux-ppc64": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-linux-riscv64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz",
-      "integrity": "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-linux-riscv64": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-linux-s390x": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz",
-      "integrity": "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-linux-s390x": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-linux-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz",
-      "integrity": "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "libc": [
-        "glibc"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-linux-x64": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-linuxmusl-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz",
-      "integrity": "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "libc": [
-        "musl"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-linuxmusl-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz",
-      "integrity": "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "libc": [
-        "musl"
-      ],
-      "license": "Apache-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-x64": "1.2.4"
-      }
-    },
-    "node_modules/@img/sharp-wasm32": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz",
-      "integrity": "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==",
-      "cpu": [
-        "wasm32"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/runtime": "^1.7.0"
-      },
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-win32-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz",
-      "integrity": "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 AND LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-win32-ia32": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz",
-      "integrity": "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 AND LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@img/sharp-win32-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz",
-      "integrity": "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "Apache-2.0 AND LGPL-3.0-or-later",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      }
-    },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.9",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.9.tgz",
-      "integrity": "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/resolve-uri": "^3.0.3",
-        "@jridgewell/sourcemap-codec": "^1.4.10"
-      }
-    },
-    "node_modules/@poppinss/colors": {
-      "version": "4.1.6",
-      "resolved": "https://registry.npmjs.org/@poppinss/colors/-/colors-4.1.6.tgz",
-      "integrity": "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "kleur": "^4.1.5"
-      }
-    },
-    "node_modules/@poppinss/dumper": {
-      "version": "0.6.5",
-      "resolved": "https://registry.npmjs.org/@poppinss/dumper/-/dumper-0.6.5.tgz",
-      "integrity": "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@poppinss/colors": "^4.1.5",
-        "@sindresorhus/is": "^7.0.2",
-        "supports-color": "^10.0.0"
-      }
-    },
-    "node_modules/@poppinss/exception": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/@poppinss/exception/-/exception-1.2.3.tgz",
-      "integrity": "sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@sindresorhus/is": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-7.2.0.tgz",
-      "integrity": "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/is?sponsor=1"
-      }
-    },
-    "node_modules/@speed-highlight/core": {
-      "version": "1.2.15",
-      "resolved": "https://registry.npmjs.org/@speed-highlight/core/-/core-1.2.15.tgz",
-      "integrity": "sha512-BMq1K3DsElxDWawkX6eLg9+CKJrTVGCBAWVuHXVUV2u0s2711qiChLSId6ikYPfxhdYocLNt3wWwSvDiTvFabw==",
-      "dev": true,
-      "license": "CC0-1.0"
-    },
-    "node_modules/@types/node": {
-      "version": "18.19.130",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.130.tgz",
-      "integrity": "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==",
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~5.26.4"
-      }
-    },
-    "node_modules/@types/node-fetch": {
-      "version": "2.6.13",
-      "resolved": "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.13.tgz",
-      "integrity": "sha512-QGpRVpzSaUs30JBSGPjOg4Uveu384erbHBoT1zeONvyCfwQxIkUshLAOqN/k9EjGviPRmWTTe6aH2qySWKTVSw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*",
-        "form-data": "^4.0.4"
-      }
-    },
-    "node_modules/abort-controller": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
-      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
-      "license": "MIT",
-      "dependencies": {
-        "event-target-shim": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=6.5"
-      }
-    },
-    "node_modules/agentkeepalive": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz",
-      "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==",
-      "license": "MIT",
-      "dependencies": {
-        "humanize-ms": "^1.2.1"
-      },
-      "engines": {
-        "node": ">= 8.0.0"
-      }
-    },
-    "node_modules/asynckit": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
-      "license": "MIT"
-    },
-    "node_modules/base-64": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/base-64/-/base-64-0.1.0.tgz",
-      "integrity": "sha512-Y5gU45svrR5tI2Vt/X9GPd3L0HNIKzGu202EjxrXMpuc2V2CiKgemAbUUsqYmZJvPtCXoUKjNZwBJzsNScUbXA=="
-    },
-    "node_modules/blake3-wasm": {
-      "version": "2.1.5",
-      "resolved": "https://registry.npmjs.org/blake3-wasm/-/blake3-wasm-2.1.5.tgz",
-      "integrity": "sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/call-bind-apply-helpers": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/charenc": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/charenc/-/charenc-0.0.2.tgz",
-      "integrity": "sha512-yrLQ/yVUFXkzg7EDQsPieE/53+0RlaWTs+wBrvW36cyilJ2SaDWfl4Yj7MtLTXleV9uEKefbAGUPv2/iWSooRA==",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/combined-stream": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
-      "license": "MIT",
-      "dependencies": {
-        "delayed-stream": "~1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/cookie": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
-      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/crypt": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/crypt/-/crypt-0.0.2.tgz",
-      "integrity": "sha512-mCxBlsHFYh9C+HVpiEacem8FEBnMXgU9gy4zmNC+SXAZNB/1idgp/aulFJ4FgCi7GPEVbfyng092GqL2k2rmow==",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/delayed-stream": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/digest-fetch": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/digest-fetch/-/digest-fetch-1.3.0.tgz",
-      "integrity": "sha512-CGJuv6iKNM7QyZlM2T3sPAdZWd/p9zQiRNS9G+9COUCwzWFTs0Xp8NF5iePx7wtvhDykReiRRrSeNb4oMmB8lA==",
-      "license": "ISC",
-      "dependencies": {
-        "base-64": "^0.1.0",
-        "md5": "^2.3.0"
-      }
-    },
-    "node_modules/dunder-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "gopd": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/error-stack-parser-es": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/error-stack-parser-es/-/error-stack-parser-es-1.0.5.tgz",
-      "integrity": "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/antfu"
-      }
-    },
-    "node_modules/es-define-property": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-errors": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-set-tostringtag": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
-      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.6",
-        "has-tostringtag": "^1.0.2",
-        "hasown": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/esbuild": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
-      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.3",
-        "@esbuild/android-arm": "0.27.3",
-        "@esbuild/android-arm64": "0.27.3",
-        "@esbuild/android-x64": "0.27.3",
-        "@esbuild/darwin-arm64": "0.27.3",
-        "@esbuild/darwin-x64": "0.27.3",
-        "@esbuild/freebsd-arm64": "0.27.3",
-        "@esbuild/freebsd-x64": "0.27.3",
-        "@esbuild/linux-arm": "0.27.3",
-        "@esbuild/linux-arm64": "0.27.3",
-        "@esbuild/linux-ia32": "0.27.3",
-        "@esbuild/linux-loong64": "0.27.3",
-        "@esbuild/linux-mips64el": "0.27.3",
-        "@esbuild/linux-ppc64": "0.27.3",
-        "@esbuild/linux-riscv64": "0.27.3",
-        "@esbuild/linux-s390x": "0.27.3",
-        "@esbuild/linux-x64": "0.27.3",
-        "@esbuild/netbsd-arm64": "0.27.3",
-        "@esbuild/netbsd-x64": "0.27.3",
-        "@esbuild/openbsd-arm64": "0.27.3",
-        "@esbuild/openbsd-x64": "0.27.3",
-        "@esbuild/openharmony-arm64": "0.27.3",
-        "@esbuild/sunos-x64": "0.27.3",
-        "@esbuild/win32-arm64": "0.27.3",
-        "@esbuild/win32-ia32": "0.27.3",
-        "@esbuild/win32-x64": "0.27.3"
-      }
-    },
-    "node_modules/event-target-shim": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
-      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
-      "license": "MIT",
-      "dependencies": {
-        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.8",
-        "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/form-data-encoder": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/form-data-encoder/-/form-data-encoder-1.7.2.tgz",
-      "integrity": "sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==",
-      "license": "MIT"
-    },
-    "node_modules/formdata-node": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/formdata-node/-/formdata-node-4.4.1.tgz",
-      "integrity": "sha512-0iirZp3uVDjVGt9p49aTaqjk84TrglENEDuqfdlZQ1roC9CWlPk6Avf8EEnZNcAqPonwkG35x4n3ww/1THYAeQ==",
-      "license": "MIT",
-      "dependencies": {
-        "node-domexception": "1.0.0",
-        "web-streams-polyfill": "4.0.0-beta.3"
-      },
-      "engines": {
-        "node": ">= 12.20"
-      }
-    },
-    "node_modules/formdata-node/node_modules/web-streams-polyfill": {
-      "version": "4.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-4.0.0-beta.3.tgz",
-      "integrity": "sha512-QW95TCTaHmsYfHDybGMwO5IJIM93I/6vTRk+daHTWFPhwh+C8Cg7j7XyKrwrj8Ib6vYXe0ocYNrmzY4xAAN6ug==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/function-bind": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-intrinsic": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "es-define-property": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "es-object-atoms": "^1.1.1",
-        "function-bind": "^1.1.2",
-        "get-proto": "^1.0.1",
-        "gopd": "^1.2.0",
-        "has-symbols": "^1.1.0",
-        "hasown": "^2.0.2",
-        "math-intrinsics": "^1.1.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
-      "license": "MIT",
-      "dependencies": {
-        "dunder-proto": "^1.0.1",
-        "es-object-atoms": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/gopd": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-symbols": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-tostringtag": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
-      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
-      "license": "MIT",
-      "dependencies": {
-        "has-symbols": "^1.0.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/hasown": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
-      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
-      "license": "MIT",
-      "dependencies": {
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/hono": {
-      "version": "4.12.16",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.16.tgz",
-      "integrity": "sha512-jN0ZewiNAWSe5khM3EyCmBb250+b40wWbwNILNfEvq84VREWwOIkuUsFONk/3i3nqkz7Oe1PcpM2mwQEK2L9Kg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.9.0"
-      }
-    },
-    "node_modules/humanize-ms": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
-      "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.0.0"
-      }
-    },
-    "node_modules/is-buffer": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "license": "MIT"
-    },
-    "node_modules/kleur": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
-      "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/math-intrinsics": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/md5": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/md5/-/md5-2.3.0.tgz",
-      "integrity": "sha512-T1GITYmFaKuO91vxyoQMFETst+O71VUPEU3ze5GNzDm0OWdP8v1ziTaAEPUr/3kLsY3Sftgz242A1SetQiDL7g==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "charenc": "0.0.2",
-        "crypt": "0.0.2",
-        "is-buffer": "~1.1.6"
-      }
-    },
-    "node_modules/mime-db": {
-      "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/mime-types": {
-      "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "1.52.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/miniflare": {
-      "version": "4.20260430.0",
-      "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-4.20260430.0.tgz",
-      "integrity": "sha512-MWvMm3Siho9Yj7lbJZidLs8hbrRvIcOrif2mnsHQZdvoKfedpea+GaN8XJxbpRcq0B2WzNI1BB1ihdnqes3/ZA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@cspotcode/source-map-support": "0.8.1",
-        "sharp": "^0.34.5",
-        "undici": "7.24.8",
-        "workerd": "1.20260430.1",
-        "ws": "8.18.0",
-        "youch": "4.1.0-beta.10"
-      },
-      "bin": {
-        "miniflare": "bootstrap.js"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
-    "node_modules/node-domexception": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
-      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
-      "deprecated": "Use your platform's native DOMException instead",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/jimmywarting"
-        },
-        {
-          "type": "github",
-          "url": "https://paypal.me/jimmywarting"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.5.0"
-      }
-    },
-    "node_modules/node-fetch": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
-      "license": "MIT",
-      "dependencies": {
-        "whatwg-url": "^5.0.0"
-      },
-      "engines": {
-        "node": "4.x || >=6.0.0"
-      },
-      "peerDependencies": {
-        "encoding": "^0.1.0"
-      },
-      "peerDependenciesMeta": {
-        "encoding": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/openai": {
-      "version": "4.29.2",
-      "resolved": "https://registry.npmjs.org/openai/-/openai-4.29.2.tgz",
-      "integrity": "sha512-cPkT6zjEcE4qU5OW/SoDDuXEsdOLrXlAORhzmaguj5xZSPlgKvLhi27sFWhLKj07Y6WKNWxcwIbzm512FzTBNQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/node": "^18.11.18",
-        "@types/node-fetch": "^2.6.4",
-        "abort-controller": "^3.0.0",
-        "agentkeepalive": "^4.2.1",
-        "digest-fetch": "^1.3.0",
-        "form-data-encoder": "1.7.2",
-        "formdata-node": "^4.3.2",
-        "node-fetch": "^2.6.7",
-        "web-streams-polyfill": "^3.2.1"
-      },
-      "bin": {
-        "openai": "bin/cli"
-      }
-    },
-    "node_modules/path-to-regexp": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
-      "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/pathe": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
-      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/sharp": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
-      "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@img/colour": "^1.0.0",
-        "detect-libc": "^2.1.2",
-        "semver": "^7.7.3"
-      },
-      "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/libvips"
-      },
-      "optionalDependencies": {
-        "@img/sharp-darwin-arm64": "0.34.5",
-        "@img/sharp-darwin-x64": "0.34.5",
-        "@img/sharp-libvips-darwin-arm64": "1.2.4",
-        "@img/sharp-libvips-darwin-x64": "1.2.4",
-        "@img/sharp-libvips-linux-arm": "1.2.4",
-        "@img/sharp-libvips-linux-arm64": "1.2.4",
-        "@img/sharp-libvips-linux-ppc64": "1.2.4",
-        "@img/sharp-libvips-linux-riscv64": "1.2.4",
-        "@img/sharp-libvips-linux-s390x": "1.2.4",
-        "@img/sharp-libvips-linux-x64": "1.2.4",
-        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4",
-        "@img/sharp-libvips-linuxmusl-x64": "1.2.4",
-        "@img/sharp-linux-arm": "0.34.5",
-        "@img/sharp-linux-arm64": "0.34.5",
-        "@img/sharp-linux-ppc64": "0.34.5",
-        "@img/sharp-linux-riscv64": "0.34.5",
-        "@img/sharp-linux-s390x": "0.34.5",
-        "@img/sharp-linux-x64": "0.34.5",
-        "@img/sharp-linuxmusl-arm64": "0.34.5",
-        "@img/sharp-linuxmusl-x64": "0.34.5",
-        "@img/sharp-wasm32": "0.34.5",
-        "@img/sharp-win32-arm64": "0.34.5",
-        "@img/sharp-win32-ia32": "0.34.5",
-        "@img/sharp-win32-x64": "0.34.5"
-      }
-    },
-    "node_modules/supports-color": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-10.2.2.tgz",
-      "integrity": "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/supports-color?sponsor=1"
-      }
-    },
-    "node_modules/tr46": {
-      "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
-      "license": "MIT"
-    },
-    "node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "dev": true,
-      "license": "0BSD",
-      "optional": true
-    },
-    "node_modules/undici": {
-      "version": "7.24.8",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.8.tgz",
-      "integrity": "sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.1"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
-      "license": "MIT"
-    },
-    "node_modules/unenv": {
-      "version": "2.0.0-rc.24",
-      "resolved": "https://registry.npmjs.org/unenv/-/unenv-2.0.0-rc.24.tgz",
-      "integrity": "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "pathe": "^2.0.3"
-      }
-    },
-    "node_modules/web-streams-polyfill": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz",
-      "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/webidl-conversions": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
-      "license": "BSD-2-Clause"
-    },
-    "node_modules/whatwg-url": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
-      "license": "MIT",
-      "dependencies": {
-        "tr46": "~0.0.3",
-        "webidl-conversions": "^3.0.0"
-      }
-    },
-    "node_modules/workerd": {
-      "version": "1.20260430.1",
-      "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260430.1.tgz",
-      "integrity": "sha512-KEgIWyiw3Jmn+DCd/L3ePo5fmiiYb/UcwKvDWPf/nLLOiwShDFzDSsegU5NY/JcwgvO/QsLHVi2FYrbkcXNY5Q==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "workerd": "bin/workerd"
-      },
-      "engines": {
-        "node": ">=16"
-      },
-      "optionalDependencies": {
-        "@cloudflare/workerd-darwin-64": "1.20260430.1",
-        "@cloudflare/workerd-darwin-arm64": "1.20260430.1",
-        "@cloudflare/workerd-linux-64": "1.20260430.1",
-        "@cloudflare/workerd-linux-arm64": "1.20260430.1",
-        "@cloudflare/workerd-windows-64": "1.20260430.1"
-      }
-    },
-    "node_modules/wrangler": {
-      "version": "4.87.0",
-      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.87.0.tgz",
-      "integrity": "sha512-lfhfKwLfQlowwgV0xhlYgE9fU3n0I30d4ccGY/rTCEm/n42Mjvlr0Ng3ZPNqlsrsKBcDR531V7dsPkgELvrk/Q==",
-      "dev": true,
-      "license": "MIT OR Apache-2.0",
-      "dependencies": {
-        "@cloudflare/kv-asset-handler": "0.5.0",
-        "@cloudflare/unenv-preset": "2.16.1",
-        "blake3-wasm": "2.1.5",
-        "esbuild": "0.27.3",
-        "miniflare": "4.20260430.0",
-        "path-to-regexp": "6.3.0",
-        "unenv": "2.0.0-rc.24",
-        "workerd": "1.20260430.1"
-      },
-      "bin": {
-        "wrangler": "bin/wrangler.js",
-        "wrangler2": "bin/wrangler.js"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.2"
-      },
-      "peerDependencies": {
-        "@cloudflare/workers-types": "^4.20260430.1"
-      },
-      "peerDependenciesMeta": {
-        "@cloudflare/workers-types": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/ws": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.0.tgz",
-      "integrity": "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": ">=5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/youch": {
-      "version": "4.1.0-beta.10",
-      "resolved": "https://registry.npmjs.org/youch/-/youch-4.1.0-beta.10.tgz",
-      "integrity": "sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@poppinss/colors": "^4.1.5",
-        "@poppinss/dumper": "^0.6.4",
-        "@speed-highlight/core": "^1.2.7",
-        "cookie": "^1.0.2",
-        "youch-core": "^0.3.3"
-      }
-    },
-    "node_modules/youch-core": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/youch-core/-/youch-core-0.3.3.tgz",
-      "integrity": "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@poppinss/exception": "^1.2.2",
-        "error-stack-parser-es": "^1.0.5"
-      }
-    }
-  }
-}
diff --git a/litellm-js/proxy/package.json b/litellm-js/proxy/package.json
deleted file mode 100644
index 9fd94cd882f..00000000000
--- a/litellm-js/proxy/package.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "scripts": {
-    "dev": "wrangler dev src/index.ts",
-    "deploy": "wrangler deploy --minify src/index.ts"
-  },
-  "dependencies": {
-    "hono": "4.12.16",
-    "openai": "4.29.2"
-  },
-  "devDependencies": {
-    "@cloudflare/workers-types": "4.20260501.1",
-    "wrangler": "4.87.0"
-  }
-}
diff --git a/litellm-js/proxy/src/index.ts b/litellm-js/proxy/src/index.ts
deleted file mode 100644
index dc5dc9c689e..00000000000
--- a/litellm-js/proxy/src/index.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { Hono } from 'hono'
-import { Context } from 'hono';
-import { bearerAuth } from 'hono/bearer-auth'
-import OpenAI from "openai";
-
-const openai = new OpenAI({
-  apiKey: "sk-1234",
-  baseURL: "https://openai-endpoint.ishaanjaffer0324.workers.dev"
-});
-
-async function call_proxy() {
-  const completion = await openai.chat.completions.create({
-    messages: [{ role: "system", content: "You are a helpful assistant." }],
-    model: "gpt-3.5-turbo",
-  });
-
-  return completion
-}
-
-const app = new Hono()
-
-// Middleware for API Key Authentication
-const apiKeyAuth = async (c: Context, next: Function) => {
-  const apiKey = c.req.header('Authorization');
-  if (!apiKey || apiKey !== 'Bearer sk-1234') {
-    return c.text('Unauthorized', 401);
-  }
-  await next();
-};
-
-
-app.use('/*', apiKeyAuth)
-
-
-app.get('/', (c) => {
-  return c.text('Hello Hono!')
-})
-
-
-
-
-// Handler for chat completions
-const chatCompletionHandler = async (c: Context) => {
-  // Assuming your logic for handling chat completion goes here
-  // For demonstration, just returning a simple JSON response
-  const response = await call_proxy()
-  return c.json(response);
-};
-
-// Register the above handler for different POST routes with the apiKeyAuth middleware
-app.post('/v1/chat/completions', chatCompletionHandler);
-app.post('/chat/completions', chatCompletionHandler);
-
-// Example showing how you might handle dynamic segments within the URL
-// Here, using ':model*' to capture the rest of the path as a parameter 'model'
-app.post('/openai/deployments/:model*/chat/completions', chatCompletionHandler);
-
-
-export default app
diff --git a/litellm-js/proxy/tsconfig.json b/litellm-js/proxy/tsconfig.json
deleted file mode 100644
index 28fcfb58246..00000000000
--- a/litellm-js/proxy/tsconfig.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
-    "moduleResolution": "Bundler",
-    "strict": true,
-    "lib": [
-      "ESNext"
-    ],
-    "types": [
-      "@cloudflare/workers-types"
-    ],
-    "jsx": "react-jsx",
-    "jsxImportSource": "hono/jsx",
-    "skipLibCheck": true
-  },
-}
\ No newline at end of file
diff --git a/litellm-js/proxy/wrangler.toml b/litellm-js/proxy/wrangler.toml
deleted file mode 100644
index e7c323dff97..00000000000
--- a/litellm-js/proxy/wrangler.toml
+++ /dev/null
@@ -1,18 +0,0 @@
-name = "my-app"
-compatibility_date = "2023-12-01"
-
-# [vars]
-# MY_VAR = "my-variable"
-
-# [[kv_namespaces]]
-# binding = "MY_KV_NAMESPACE"
-# id = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-
-# [[r2_buckets]]
-# binding = "MY_BUCKET"
-# bucket_name = "my-bucket"
-
-# [[d1_databases]]
-# binding = "DB"
-# database_name = "my-database"
-# database_id = ""
diff --git a/litellm-js/spend-logs/.npmrc b/litellm-js/spend-logs/.npmrc
deleted file mode 100644
index 7999681cc35..00000000000
--- a/litellm-js/spend-logs/.npmrc
+++ /dev/null
@@ -1,5 +0,0 @@
-# Supply-chain hardening
-# Packages needing lifecycle scripts: npm rebuild <pkg>
-ignore-scripts=true
-# Protects local npm install only — npm ci (used in CI) ignores this
-min-release-age=3
diff --git a/litellm-js/spend-logs/Dockerfile b/litellm-js/spend-logs/Dockerfile
deleted file mode 100644
index 5040dc74bf6..00000000000
--- a/litellm-js/spend-logs/Dockerfile
+++ /dev/null
@@ -1,26 +0,0 @@
-# Use the specific Node.js v20.11.0 image
-FROM node:20.18.1-alpine3.20
-
-# Set the working directory inside the container
-WORKDIR /app
-
-# Copy package.json and package-lock.json to the working directory
-COPY ./litellm-js/spend-logs/package*.json ./
-
-# Install dependencies
-RUN npm ci
-
-# Install Prisma globally
-RUN npm install -g prisma
-
-# Copy the rest of the application code
-COPY ./litellm-js/spend-logs .
-
-# Generate Prisma client
-RUN npx prisma generate
-
-# Expose the port that the Node.js server will run on
-EXPOSE 3000
-
-# Command to run the Node.js app with npm run dev
-CMD ["npm", "run", "dev"]
diff --git a/litellm-js/spend-logs/README.md b/litellm-js/spend-logs/README.md
deleted file mode 100644
index e12b31db70a..00000000000
--- a/litellm-js/spend-logs/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-```
-npm install
-npm run dev
-```
-
-```
-open http://localhost:3000
-```
diff --git a/litellm-js/spend-logs/package-lock.json b/litellm-js/spend-logs/package-lock.json
deleted file mode 100644
index e33079766c9..00000000000
--- a/litellm-js/spend-logs/package-lock.json
+++ /dev/null
@@ -1,597 +0,0 @@
-{
-  "name": "spend-logs",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "dependencies": {
-        "@hono/node-server": "1.19.13",
-        "hono": "4.12.16"
-      },
-      "devDependencies": {
-        "@types/node": "20.19.25",
-        "tsx": "4.20.6"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
-      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
-      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
-      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
-      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
-      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
-      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
-      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
-      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
-      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
-      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
-      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
-      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
-      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
-      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
-      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
-      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
-      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
-      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
-      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
-      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
-      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@hono/node-server": {
-      "version": "1.19.13",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz",
-      "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "20.19.25",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.25.tgz",
-      "integrity": "sha512-ZsJzA5thDQMSQO788d7IocwwQbI8B5OPzmqNvpf3NY/+MHDAS759Wo0gd2WQeXYt5AAAQjzcrTVC6SKCuYgoCQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~6.21.0"
-      }
-    },
-    "node_modules/esbuild": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
-      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.25.12",
-        "@esbuild/android-arm": "0.25.12",
-        "@esbuild/android-arm64": "0.25.12",
-        "@esbuild/android-x64": "0.25.12",
-        "@esbuild/darwin-arm64": "0.25.12",
-        "@esbuild/darwin-x64": "0.25.12",
-        "@esbuild/freebsd-arm64": "0.25.12",
-        "@esbuild/freebsd-x64": "0.25.12",
-        "@esbuild/linux-arm": "0.25.12",
-        "@esbuild/linux-arm64": "0.25.12",
-        "@esbuild/linux-ia32": "0.25.12",
-        "@esbuild/linux-loong64": "0.25.12",
-        "@esbuild/linux-mips64el": "0.25.12",
-        "@esbuild/linux-ppc64": "0.25.12",
-        "@esbuild/linux-riscv64": "0.25.12",
-        "@esbuild/linux-s390x": "0.25.12",
-        "@esbuild/linux-x64": "0.25.12",
-        "@esbuild/netbsd-arm64": "0.25.12",
-        "@esbuild/netbsd-x64": "0.25.12",
-        "@esbuild/openbsd-arm64": "0.25.12",
-        "@esbuild/openbsd-x64": "0.25.12",
-        "@esbuild/openharmony-arm64": "0.25.12",
-        "@esbuild/sunos-x64": "0.25.12",
-        "@esbuild/win32-arm64": "0.25.12",
-        "@esbuild/win32-ia32": "0.25.12",
-        "@esbuild/win32-x64": "0.25.12"
-      }
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/get-tsconfig": {
-      "version": "4.14.0",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.0.tgz",
-      "integrity": "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "resolve-pkg-maps": "^1.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
-      }
-    },
-    "node_modules/hono": {
-      "version": "4.12.16",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.16.tgz",
-      "integrity": "sha512-jN0ZewiNAWSe5khM3EyCmBb250+b40wWbwNILNfEvq84VREWwOIkuUsFONk/3i3nqkz7Oe1PcpM2mwQEK2L9Kg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.9.0"
-      }
-    },
-    "node_modules/resolve-pkg-maps": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
-      "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
-      }
-    },
-    "node_modules/tsx": {
-      "version": "4.20.6",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.20.6.tgz",
-      "integrity": "sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "esbuild": "~0.25.0",
-        "get-tsconfig": "^4.7.5"
-      },
-      "bin": {
-        "tsx": "dist/cli.mjs"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.3"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "6.21.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
-      "dev": true,
-      "license": "MIT"
-    }
-  }
-}
diff --git a/litellm-js/spend-logs/package.json b/litellm-js/spend-logs/package.json
deleted file mode 100644
index 5a7a95c5de1..00000000000
--- a/litellm-js/spend-logs/package.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "scripts": {
-    "dev": "tsx watch src/index.ts"
-  },
-  "dependencies": {
-    "@hono/node-server": "1.19.13",
-    "hono": "4.12.16"
-  },
-  "devDependencies": {
-    "@types/node": "20.19.25",
-    "tsx": "4.20.6"
-  }
-}
diff --git a/litellm-js/spend-logs/schema.prisma b/litellm-js/spend-logs/schema.prisma
deleted file mode 100644
index b0403f277aa..00000000000
--- a/litellm-js/spend-logs/schema.prisma
+++ /dev/null
@@ -1,29 +0,0 @@
-generator client {
-  provider        = "prisma-client-js"
-}
-
-datasource client {
-  provider = "postgresql"
-  url      = env("DATABASE_URL")
-}
-
-model LiteLLM_SpendLogs {
-  request_id        String   @id
-  call_type         String
-  api_key           String   @default("")
-  spend             Float    @default(0.0)
-  total_tokens      Int      @default(0)
-  prompt_tokens     Int      @default(0)
-  completion_tokens Int      @default(0)
-  startTime         DateTime
-  endTime           DateTime
-  model             String   @default("")
-  api_base          String   @default("")
-  user              String   @default("")
-  metadata          Json     @default("{}")
-  cache_hit         String   @default("")
-  cache_key         String   @default("")
-  request_tags      Json     @default("[]")
-  team_id           String?
-  end_user          String?
-}
\ No newline at end of file
diff --git a/litellm-js/spend-logs/src/_types.ts b/litellm-js/spend-logs/src/_types.ts
deleted file mode 100644
index 6a9b499171e..00000000000
--- a/litellm-js/spend-logs/src/_types.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-export type LiteLLM_IncrementSpend = {
-    key_transactions: Array<LiteLLM_IncrementObject>, // [{"key": spend},..]
-    user_transactions: Array<LiteLLM_IncrementObject>, 
-    team_transactions: Array<LiteLLM_IncrementObject>,
-    spend_logs_transactions: Array<LiteLLM_SpendLogs>
-}
-
-export type LiteLLM_IncrementObject = {
-    key: string,
-    spend: number
-}
-
-export type LiteLLM_SpendLogs = {
-    request_id: string; // @id means it's a unique identifier
-    call_type: string;
-    api_key: string; // @default("") means it defaults to an empty string if not provided
-    spend: number; // Float in Prisma corresponds to number in TypeScript
-    total_tokens: number; // Int in Prisma corresponds to number in TypeScript
-    prompt_tokens: number;
-    completion_tokens: number;
-    startTime: Date; // DateTime in Prisma corresponds to Date in TypeScript
-    endTime: Date;
-    model: string; // @default("") means it defaults to an empty string if not provided
-    api_base: string;
-    user: string;
-    metadata: any; // Json type in Prisma is represented by any in TypeScript; could also use a more specific type if the structure of JSON is known
-    cache_hit: string;
-    cache_key: string;
-    request_tags: any; // Similarly, this could be an array or a more specific type depending on the expected structure
-    team_id?: string | null; // ? indicates it's optional and can be undefined, but could also be null if not provided
-    end_user?: string | null;
-};
\ No newline at end of file
diff --git a/litellm-js/spend-logs/src/index.ts b/litellm-js/spend-logs/src/index.ts
deleted file mode 100644
index 3581d95c830..00000000000
--- a/litellm-js/spend-logs/src/index.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-import { serve } from '@hono/node-server'
-import { Hono } from 'hono'
-import { PrismaClient } from '@prisma/client'
-import {LiteLLM_SpendLogs, LiteLLM_IncrementSpend, LiteLLM_IncrementObject} from './_types'
-
-const app = new Hono()
-const prisma = new PrismaClient()
-// In-memory storage for logs
-let spend_logs: LiteLLM_SpendLogs[] = [];
-const key_logs: LiteLLM_IncrementObject[] = [];
-const user_logs: LiteLLM_IncrementObject[] = [];
-const transaction_logs: LiteLLM_IncrementObject[] = [];
-
-
-app.get('/', (c) => {
-  return c.text('Hello Hono!')
-})
-
-const MIN_LOGS = 1; // Minimum number of logs needed to initiate a flush
-const FLUSH_INTERVAL = 5000; // Time in ms to wait before trying to flush again
-const BATCH_SIZE = 100; // Preferred size of each batch to write to the database
-const MAX_LOGS_PER_INTERVAL = 1000; // Maximum number of logs to flush in a single interval
-
-const flushLogsToDb = async () => {
-  if (spend_logs.length >= MIN_LOGS) {
-    // Limit the logs to process in this interval to MAX_LOGS_PER_INTERVAL or less
-    const logsToProcess = spend_logs.slice(0, MAX_LOGS_PER_INTERVAL);
-  
-    for (let i = 0; i < logsToProcess.length; i += BATCH_SIZE) {
-      // Create subarray for current batch, ensuring it doesn't exceed the BATCH_SIZE
-      const batch = logsToProcess.slice(i, i + BATCH_SIZE);
-
-      // Convert datetime strings to Date objects
-      const batchWithDates = batch.map(entry => ({
-        ...entry,
-        startTime: new Date(entry.startTime),
-        endTime: new Date(entry.endTime),
-        // Repeat for any other DateTime fields you may have
-      }));
-
-      await prisma.liteLLM_SpendLogs.createMany({
-        data: batchWithDates,
-      });
-
-      console.log(`Flushed ${batch.length} logs to the DB.`);
-    }
-
-    // Remove the processed logs from spend_logs
-    spend_logs = spend_logs.slice(logsToProcess.length);
-    
-    console.log(`${logsToProcess.length} logs processed. Remaining in queue: ${spend_logs.length}`);
-  } else {
-    // This will ensure it doesn't falsely claim "No logs to flush." when it's merely below the MIN_LOGS threshold.
-    if(spend_logs.length > 0) {
-      console.log(`Accumulating logs. Currently at ${spend_logs.length}, waiting for at least ${MIN_LOGS}.`);
-    } else {
-      console.log("No logs to flush.");
-    }
-  }
-};
-
-// Setup interval for attempting to flush the logs
-setInterval(flushLogsToDb, FLUSH_INTERVAL);
-
-// Route to receive log messages
-app.post('/spend/update', async (c) => {
-  const incomingLogs = await c.req.json<LiteLLM_SpendLogs[]>();
-  
-  spend_logs.push(...incomingLogs);
-
-  console.log(`Received and stored ${incomingLogs.length} logs. Total logs in memory: ${spend_logs.length}`);
-  
-  return c.json({ message: `Successfully stored ${incomingLogs.length} logs` });
-});
-
-
-
-const port = 3000
-console.log(`Server is running on port ${port}`)
-
-serve({
-  fetch: app.fetch,
-  port
-})
diff --git a/litellm-js/spend-logs/tsconfig.json b/litellm-js/spend-logs/tsconfig.json
deleted file mode 100644
index 028c03b6a81..00000000000
--- a/litellm-js/spend-logs/tsconfig.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
-    "moduleResolution": "Bundler",
-    "strict": true,
-    "types": [
-      "node"
-    ],
-    "jsx": "react-jsx",
-    "jsxImportSource": "hono/jsx",
-  }
-}
\ No newline at end of file
diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py
index f6f99eb62c8..0b30999aa21 100644
--- a/litellm/proxy/auth/auth_checks.py
+++ b/litellm/proxy/auth/auth_checks.py
@@ -2849,7 +2849,7 @@ def _can_object_call_model(
             object_type=object_type
         ),
         param="model",
-        code=status.HTTP_401_UNAUTHORIZED,
+        code=status.HTTP_403_FORBIDDEN,
     )
 
 
@@ -3082,7 +3082,7 @@ async def can_user_call_model(
             message=f"User not allowed to access model. No default model access, only team models allowed. Tried to access {model}",
             type=ProxyErrorTypes.key_model_access_denied,
             param="model",
-            code=status.HTTP_401_UNAUTHORIZED,
+            code=status.HTTP_403_FORBIDDEN,
         )
 
     return _can_object_call_model(
@@ -3625,7 +3625,7 @@ async def _check_team_member_model_access(
             message=f"Team member not allowed to access model. User={valid_token.user_id}, Team={team_object.team_id}, Model={model}. Allowed member models = {member_allowed_models}",
             type=ProxyErrorTypes.team_model_access_denied,
             param="model",
-            code=status.HTTP_401_UNAUTHORIZED,
+            code=status.HTTP_403_FORBIDDEN,
         )
 
 
diff --git a/litellm/proxy/auth/auth_exception_handler.py b/litellm/proxy/auth/auth_exception_handler.py
index 5ded8136ef3..431db4254eb 100644
--- a/litellm/proxy/auth/auth_exception_handler.py
+++ b/litellm/proxy/auth/auth_exception_handler.py
@@ -123,7 +123,7 @@ class UserAPIKeyAuthExceptionHandler:
                     message=e.message,
                     type=ProxyErrorTypes.budget_exceeded,
                     param=None,
-                    code=400,
+                    code=getattr(e, "status_code", status.HTTP_429_TOO_MANY_REQUESTS),
                 )
             if isinstance(e, HTTPException):
                 raise ProxyException(
diff --git a/litellm/proxy/auth/user_api_key_auth.py b/litellm/proxy/auth/user_api_key_auth.py
index 9d3c06e641f..4778549befc 100644
--- a/litellm/proxy/auth/user_api_key_auth.py
+++ b/litellm/proxy/auth/user_api_key_auth.py
@@ -1107,7 +1107,7 @@ async def _user_api_key_auth_builder(  # noqa: PLR0915
                     raise ProxyException(
                         message=f"Authentication Error - Expired Key. Key Expiry time {expiry_time} and current time {current_time}",
                         type=ProxyErrorTypes.expired_key,
-                        code=400,
+                        code=status.HTTP_401_UNAUTHORIZED,
                         param=abbreviate_api_key(api_key=api_key),
                     )
             valid_token = update_valid_token_with_end_user_params(
@@ -1432,7 +1432,7 @@ async def _user_api_key_auth_builder(  # noqa: PLR0915
                     raise ProxyException(
                         message=f"Authentication Error - Expired Key. Key Expiry time {expiry_time} and current time {current_time}",
                         type=ProxyErrorTypes.expired_key,
-                        code=400,
+                        code=status.HTTP_401_UNAUTHORIZED,
                         param=abbreviate_api_key(api_key=api_key),
                     )
 
@@ -2417,7 +2417,7 @@ async def _run_post_custom_auth_checks(
             raise ProxyException(
                 message=f"Authentication Error - Expired Key. Key Expiry time {expiry_time} and current time {current_time}",
                 type=ProxyErrorTypes.expired_key,
-                code=400,
+                code=status.HTTP_401_UNAUTHORIZED,
                 param=(
                     abbreviate_api_key(api_key=valid_token.token)
                     if valid_token.token
diff --git a/litellm/proxy/common_utils/reset_budget_job.py b/litellm/proxy/common_utils/reset_budget_job.py
index 0928ce914da..71537cc62e6 100644
--- a/litellm/proxy/common_utils/reset_budget_job.py
+++ b/litellm/proxy/common_utils/reset_budget_job.py
@@ -2,7 +2,7 @@ import asyncio
 import json
 import time
 from datetime import datetime, timezone
-from typing import Any, List, Literal, Optional, Union
+from typing import Any, Callable, List, Literal, Optional, Union
 
 import litellm
 from litellm._logging import verbose_proxy_logger
@@ -83,93 +83,139 @@ class ResetBudgetJob:
                 "Failed to reset spend counter %s: %s", counter_key, e
             )
 
+    @staticmethod
+    async def _invalidate_user_api_key_cache_entry(cache_key: str) -> None:
+        """Drop a stale management-cache entry so the next read fetches from DB.
+
+        Some entity types (notably tags and end-users) are not handled by
+        SpendCounterReseed.from_db, so when a spend counter expires the
+        budget check falls back to ``cached_obj.spend``. If that cached
+        object lingers in ``user_api_key_cache`` past a budget reset, the
+        stale ``.spend`` keeps the entity blocked indefinitely. Deleting
+        the cache entry forces the next auth-time fetch to reload the
+        zeroed row from Postgres.
+        """
+        try:
+            from litellm.proxy.proxy_server import user_api_key_cache
+
+            await user_api_key_cache.async_delete_cache(key=cache_key)
+        except Exception as e:
+            verbose_proxy_logger.warning(
+                "Failed to invalidate user_api_key_cache entry %s: %s",
+                cache_key,
+                e,
+            )
+
+    async def _cascade_reset_spend_for_budget_link(
+        self,
+        budgets_to_reset: List[LiteLLM_BudgetTableFull],
+        table: Any,
+        counter_key_fn: Callable[[Any], str],
+        log_subject: str,
+        extra_where: Optional[dict] = None,
+        cache_key_fn: Optional[Callable[[Any], str]] = None,
+    ):
+        """
+        Generic cascade: zero spend on rows whose budget_id is in the reset set.
+
+        ``cache_key_fn`` is optional: when provided, after the DB update each
+        matching row's entry in ``user_api_key_cache`` is also dropped. This
+        is required for entities whose spend counter is read with the cached
+        object's ``.spend`` as fallback (tags, end-users) — otherwise the
+        stale cached object pins enforcement to the pre-reset spend until
+        its TTL expires.
+        """
+        budget_ids = [b.budget_id for b in budgets_to_reset if b.budget_id is not None]
+        if not budget_ids:
+            return
+
+        where: dict = {"budget_id": {"in": budget_ids}}
+        if extra_where:
+            where.update(extra_where)
+
+        try:
+            rows = await table.find_many(where=where)
+        except Exception as e:
+            rows = []
+            verbose_proxy_logger.warning(
+                "Failed to fetch %s for counter invalidation: %s", log_subject, e
+            )
+
+        update_result = await table.update_many(where=where, data={"spend": 0})
+
+        for row in rows:
+            await self._invalidate_spend_counter(counter_key_fn(row))
+            if cache_key_fn is not None:
+                await self._invalidate_user_api_key_cache_entry(cache_key_fn(row))
+
+        return update_result
+
     async def reset_budget_for_litellm_team_members(
         self, budgets_to_reset: List[LiteLLM_BudgetTableFull]
     ):
         """
         Resets the budget for all LiteLLM Team Members if their budget has expired
         """
-        budget_ids = [
-            budget.budget_id
-            for budget in budgets_to_reset
-            if budget.budget_id is not None
-        ]
-
-        try:
-            memberships = await self.prisma_client.db.litellm_teammembership.find_many(
-                where={"budget_id": {"in": budget_ids}}
-            )
-        except Exception as e:
-            memberships = []
-            verbose_proxy_logger.warning(
-                "Failed to fetch team memberships for counter invalidation: %s", e
-            )
-
-        update_result = await self.prisma_client.db.litellm_teammembership.update_many(
-            where={"budget_id": {"in": budget_ids}},
-            data={
-                "spend": 0,
-            },
+        return await self._cascade_reset_spend_for_budget_link(
+            budgets_to_reset=budgets_to_reset,
+            table=self.prisma_client.db.litellm_teammembership,
+            counter_key_fn=lambda m: f"spend:team_member:{m.user_id}:{m.team_id}",
+            log_subject="team memberships",
         )
 
-        for m in memberships:
-            await self._invalidate_spend_counter(
-                f"spend:team_member:{m.user_id}:{m.team_id}"
-            )
-
-        return update_result
-
     async def reset_budget_for_keys_linked_to_budgets(
         self, budgets_to_reset: List[LiteLLM_BudgetTableFull]
     ):
         """
         Resets the spend for keys linked to budget tiers that are being reset.
 
-        This handles keys that have budget_id but no budget_duration set on the key
-        itself. Keys with budget_id rely on their linked budget tier's reset schedule
-        rather than having their own budget_duration.
-
-        Keys that have their own budget_duration are already handled by
-        reset_budget_for_litellm_keys() and are excluded here to avoid
-        double-resetting.
+        Excludes keys with their own budget_duration; those are reset by
+        reset_budget_for_litellm_keys() to avoid double-resetting.
         """
-        budget_ids = [
-            budget.budget_id
-            for budget in budgets_to_reset
-            if budget.budget_id is not None
-        ]
-        if not budget_ids:
-            return
-
-        where_clause: dict = {
-            "budget_id": {"in": budget_ids},
-            "budget_duration": None,  # only keys without their own reset schedule
-            "spend": {"gt": 0},  # only reset keys that have accumulated spend
-        }
-
-        try:
-            keys = await self.prisma_client.db.litellm_verificationtoken.find_many(
-                where=where_clause
-            )
-        except Exception as e:
-            keys = []
-            verbose_proxy_logger.warning(
-                "Failed to fetch keys for counter invalidation: %s", e
-            )
-
-        update_result = (
-            await self.prisma_client.db.litellm_verificationtoken.update_many(
-                where=where_clause,
-                data={
-                    "spend": 0,
-                },
-            )
+        return await self._cascade_reset_spend_for_budget_link(
+            budgets_to_reset=budgets_to_reset,
+            table=self.prisma_client.db.litellm_verificationtoken,
+            counter_key_fn=lambda k: f"spend:key:{k.token}",
+            log_subject="keys",
+            extra_where={"budget_duration": None, "spend": {"gt": 0}},
         )
 
-        for k in keys:
-            await self._invalidate_spend_counter(f"spend:key:{k.token}")
+    async def reset_budget_for_orgs_linked_to_budgets(
+        self, budgets_to_reset: List[LiteLLM_BudgetTableFull]
+    ):
+        """
+        Resets the spend for orgs linked to budget tiers that are being reset.
+        """
+        return await self._cascade_reset_spend_for_budget_link(
+            budgets_to_reset=budgets_to_reset,
+            table=self.prisma_client.db.litellm_organizationtable,
+            counter_key_fn=lambda o: f"spend:org:{o.organization_id}",
+            log_subject="orgs",
+            extra_where={"spend": {"gt": 0}},
+        )
 
-        return update_result
+    async def reset_budget_for_tags_linked_to_budgets(
+        self, budgets_to_reset: List[LiteLLM_BudgetTableFull]
+    ):
+        """
+        Resets the spend for tags linked to budget tiers that are being reset.
+
+        Also drops each tag's ``user_api_key_cache`` entry so the next
+        ``_tag_max_budget_check`` reloads the zeroed row from the DB.
+        ``SpendCounterReseed.from_db`` intentionally returns ``None`` for
+        tags, so the budget check falls back to the cached
+        ``LiteLLM_TagTable.spend`` once the spend counter expires; without
+        this invalidation, that stale ``.spend`` keeps the tag over-budget
+        indefinitely.
+        """
+        return await self._cascade_reset_spend_for_budget_link(
+            budgets_to_reset=budgets_to_reset,
+            table=self.prisma_client.db.litellm_tagtable,
+            counter_key_fn=lambda t: f"spend:tag:{t.tag_name}",
+            log_subject="tags",
+            extra_where={"spend": {"gt": 0}},
+            cache_key_fn=lambda t: f"tag:{t.tag_name}",
+        )
 
     async def reset_budget_for_litellm_budget_table(self):
         """
@@ -237,6 +283,14 @@ class ResetBudgetJob:
                     budgets_to_reset=budgets_to_reset
                 )
 
+                await self.reset_budget_for_orgs_linked_to_budgets(
+                    budgets_to_reset=budgets_to_reset
+                )
+
+                await self.reset_budget_for_tags_linked_to_budgets(
+                    budgets_to_reset=budgets_to_reset
+                )
+
             if endusers_to_reset is not None and len(endusers_to_reset) > 0:
                 for enduser in endusers_to_reset:
                     try:
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 02f9c9bef2f..493519f2328 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -211,6 +211,7 @@ from litellm import Router
 from litellm._logging import verbose_proxy_logger, verbose_router_logger
 from litellm.caching.caching import DualCache, RedisCache
 from litellm.caching.redis_cluster_cache import RedisClusterCache
+from litellm.proxy.common_utils.timezone_utils import get_budget_reset_time
 from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
 from litellm.constants import (
     _REALTIME_BODY_CACHE_SIZE,
@@ -6750,27 +6751,64 @@ class ProxyStartupEvent:
                 "budget_duration not set on Proxy. budget_duration is required to use max_budget."
             )
 
-        # add proxy budget to db in the user table
         asyncio.create_task(
-            generate_key_helper_fn(  # type: ignore
-                request_type="user",
-                table_name="user",
-                user_id=litellm_proxy_budget_name,
-                duration=None,
-                models=[],
-                aliases={},
-                config={},
-                spend=0,
-                max_budget=litellm.max_budget,
-                budget_duration=litellm.budget_duration,
-                query_type="update_data",
-                update_key_values={
-                    "max_budget": litellm.max_budget,
-                    "budget_duration": litellm.budget_duration,
-                },
-            )
+            cls._upsert_proxy_budget_with_reset_at_backfill(litellm_proxy_budget_name)
         )
 
+    @classmethod
+    async def _upsert_proxy_budget_with_reset_at_backfill(
+        cls, litellm_proxy_budget_name: str
+    ) -> None:
+        """
+        Upsert the proxy admin user row with the configured max_budget /
+        budget_duration, then backfill budget_reset_at if currently NULL.
+
+        The backfill uses `WHERE budget_reset_at IS NULL` so it only fires
+        when the row pre-existed without a reset schedule (e.g. row created
+        via a different path before the proxy budget was configured). On
+        subsequent restarts it no-ops, so an active reset window is never
+        slid forward.
+        """
+        await generate_key_helper_fn(  # type: ignore
+            request_type="user",
+            table_name="user",
+            user_id=litellm_proxy_budget_name,
+            duration=None,
+            models=[],
+            aliases={},
+            config={},
+            spend=0,
+            max_budget=litellm.max_budget,
+            budget_duration=litellm.budget_duration,
+            query_type="update_data",
+            update_key_values={
+                "max_budget": litellm.max_budget,
+                "budget_duration": litellm.budget_duration,
+            },
+        )
+
+        # Without this, the upsert leaves budget_reset_at=NULL on rows that
+        # took the UPDATE path, and reset_budget_for_litellm_users never
+        # matches them (NULL < now() is unknown in SQL) — so the proxy-wide
+        # spend cap blocks forever once it's hit.
+        if prisma_client is not None and litellm.budget_duration is not None:
+            try:
+                await prisma_client.db.litellm_usertable.update_many(
+                    where={
+                        "user_id": litellm_proxy_budget_name,
+                        "budget_reset_at": None,
+                    },
+                    data={
+                        "budget_reset_at": get_budget_reset_time(
+                            budget_duration=litellm.budget_duration
+                        )
+                    },
+                )
+            except Exception as e:
+                verbose_proxy_logger.warning(
+                    "Failed to backfill budget_reset_at on proxy admin row: %s", e
+                )
+
     @classmethod
     async def _warm_global_spend_cache(
         cls,
diff --git a/pyproject.toml b/pyproject.toml
index d194d467913..5cd83148d37 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -22,7 +22,7 @@ dependencies = [
     "importlib-metadata>=8.0.0,<9.0",
     "tokenizers>=0.21.0,<1.0",
     "click>=8.0.0,<9.0",
-    "jinja2>=3.1.0,<4.0",
+    "jinja2>=3.1.6,<4.0",
     "aiohttp>=3.10,<4.0",
     "pydantic>=2.10.0,<3.0.0",
     "jsonschema>=4.0.0,<5.0",
diff --git a/tests/litellm_utils_tests/test_proxy_budget_reset.py b/tests/litellm_utils_tests/test_proxy_budget_reset.py
index a64c6c7aa36..6240bedd3e6 100644
--- a/tests/litellm_utils_tests/test_proxy_budget_reset.py
+++ b/tests/litellm_utils_tests/test_proxy_budget_reset.py
@@ -233,6 +233,12 @@ async def test_reset_budget_endusers_partial_failure():
     prisma_client.db.litellm_verificationtoken.update_many = AsyncMock(
         return_value={"count": 0}
     )
+    # Mock db.litellm_organizationtable.update_many (used by reset_budget_for_orgs_linked_to_budgets)
+    prisma_client.db.litellm_organizationtable.update_many = AsyncMock(
+        return_value={"count": 0}
+    )
+    # Mock db.litellm_tagtable.update_many (used by reset_budget_for_tags_linked_to_budgets)
+    prisma_client.db.litellm_tagtable.update_many = AsyncMock(return_value={"count": 0})
 
     proxy_logging_obj = MagicMock()
     proxy_logging_obj.service_logging_obj = MagicMock()
@@ -400,6 +406,12 @@ async def test_reset_budget_continues_other_categories_on_failure():
     prisma_client.db.litellm_verificationtoken.update_many = AsyncMock(
         return_value={"count": 0}
     )
+    # Mock db.litellm_organizationtable.update_many (used by reset_budget_for_orgs_linked_to_budgets)
+    prisma_client.db.litellm_organizationtable.update_many = AsyncMock(
+        return_value={"count": 0}
+    )
+    # Mock db.litellm_tagtable.update_many (used by reset_budget_for_tags_linked_to_budgets)
+    prisma_client.db.litellm_tagtable.update_many = AsyncMock(return_value={"count": 0})
 
     proxy_logging_obj = MagicMock()
     proxy_logging_obj.service_logging_obj = MagicMock()
@@ -884,6 +896,12 @@ async def test_service_logger_endusers_success():
     prisma_client.db.litellm_verificationtoken.update_many = AsyncMock(
         return_value={"count": 0}
     )
+    # Mock db.litellm_organizationtable.update_many (used by reset_budget_for_orgs_linked_to_budgets)
+    prisma_client.db.litellm_organizationtable.update_many = AsyncMock(
+        return_value={"count": 0}
+    )
+    # Mock db.litellm_tagtable.update_many (used by reset_budget_for_tags_linked_to_budgets)
+    prisma_client.db.litellm_tagtable.update_many = AsyncMock(return_value={"count": 0})
 
     proxy_logging_obj = MagicMock()
     proxy_logging_obj.service_logging_obj = MagicMock()
@@ -966,6 +984,12 @@ async def test_service_logger_endusers_failure():
     prisma_client.db.litellm_verificationtoken.update_many = AsyncMock(
         return_value={"count": 0}
     )
+    # Mock db.litellm_organizationtable.update_many (used by reset_budget_for_orgs_linked_to_budgets)
+    prisma_client.db.litellm_organizationtable.update_many = AsyncMock(
+        return_value={"count": 0}
+    )
+    # Mock db.litellm_tagtable.update_many (used by reset_budget_for_tags_linked_to_budgets)
+    prisma_client.db.litellm_tagtable.update_many = AsyncMock(return_value={"count": 0})
 
     proxy_logging_obj = MagicMock()
     proxy_logging_obj.service_logging_obj = MagicMock()
@@ -1060,6 +1084,10 @@ async def test_reset_budget_for_litellm_team_members_called():
     prisma_client.db.litellm_verificationtoken.update_many = AsyncMock(
         return_value={"count": 0}
     )
+    prisma_client.db.litellm_organizationtable.update_many = AsyncMock(
+        return_value={"count": 0}
+    )
+    prisma_client.db.litellm_tagtable.update_many = AsyncMock(return_value={"count": 0})
 
     proxy_logging_obj = MagicMock()
     proxy_logging_obj.service_logging_obj = MagicMock()
diff --git a/tests/otel_tests/test_e2e_budgeting.py b/tests/otel_tests/test_e2e_budgeting.py
index 62fc8732ebd..f61befac4fb 100644
--- a/tests/otel_tests/test_e2e_budgeting.py
+++ b/tests/otel_tests/test_e2e_budgeting.py
@@ -25,8 +25,8 @@ async def make_calls_until_budget_exceeded(session, key: str, call_function, **k
 
         # Check error structure and values that should be consistent
         assert (
-            error_dict["code"] == "400"
-        ), f"Expected error code 400, got: {error_dict['code']}"
+            error_dict["code"] == "429"
+        ), f"Expected error code 429, got: {error_dict['code']}"
         assert (
             error_dict["type"] == "budget_exceeded"
         ), f"Expected error type budget_exceeded, got: {error_dict['type']}"
diff --git a/tests/otel_tests/test_e2e_model_access.py b/tests/otel_tests/test_e2e_model_access.py
index 7ea75a9d61d..87d85a19603 100644
--- a/tests/otel_tests/test_e2e_model_access.py
+++ b/tests/otel_tests/test_e2e_model_access.py
@@ -99,7 +99,7 @@ async def test_model_access_patterns(key_models, test_model, expect_success):
             # Assert error structure and values
             assert _error_body["type"] == "key_model_access_denied"
             assert _error_body["param"] == "model"
-            assert _error_body["code"] == "401"
+            assert _error_body["code"] == "403"
             assert "key not allowed to access model" in _error_body["message"]
 
 
@@ -297,7 +297,7 @@ def _validate_model_access_exception(
     # Assert error structure and values
     assert _error_body["type"] == expected_type
     assert _error_body["param"] == "model"
-    assert _error_body["code"] == "401"
+    assert _error_body["code"] == "403"
     if expected_type == "key_model_access_denied":
         assert "key not allowed to access model" in _error_body["message"]
     elif expected_type == "team_model_access_denied":
diff --git a/tests/test_litellm/proxy/auth/test_auth_checks.py b/tests/test_litellm/proxy/auth/test_auth_checks.py
index 8a854bcd6a8..26f04a4abcb 100644
--- a/tests/test_litellm/proxy/auth/test_auth_checks.py
+++ b/tests/test_litellm/proxy/auth/test_auth_checks.py
@@ -12,6 +12,7 @@ from datetime import datetime, timedelta
 
 import httpx
 import pytest
+from fastapi import status
 
 import litellm
 from litellm.proxy._types import (
@@ -31,6 +32,7 @@ from litellm.proxy._types import (
 )
 from litellm.proxy.auth.auth_checks import (
     ExperimentalUIJWTToken,
+    _can_object_call_model,
     _can_object_call_vector_stores,
     _check_end_user_budget,
     _check_team_member_budget,
@@ -206,6 +208,52 @@ def test_get_key_object_from_ui_hash_key_invalid():
     assert key_object is None
 
 
+@pytest.mark.parametrize(
+    "object_type,expected_error_type",
+    [
+        ("key", ProxyErrorTypes.key_model_access_denied),
+        ("team", ProxyErrorTypes.team_model_access_denied),
+        ("user", ProxyErrorTypes.user_model_access_denied),
+        ("org", ProxyErrorTypes.org_model_access_denied),
+        ("project", ProxyErrorTypes.project_model_access_denied),
+    ],
+)
+def test_can_object_call_model_denials_return_forbidden(
+    object_type, expected_error_type
+):
+    with pytest.raises(ProxyException) as exc_info:
+        _can_object_call_model(
+            model="restricted-model",
+            llm_router=None,
+            models=["allowed-model"],
+            object_type=object_type,
+        )
+
+    assert exc_info.value.type == expected_error_type
+    assert int(exc_info.value.code) == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.asyncio
+async def test_can_user_call_model_no_default_models_returns_forbidden():
+    from litellm.proxy._types import SpecialModelNames
+    from litellm.proxy.auth.auth_checks import can_user_call_model
+
+    user_object = LiteLLM_UserTable(
+        user_id="test-user",
+        models=[SpecialModelNames.no_default_models.value],
+    )
+
+    with pytest.raises(ProxyException) as exc_info:
+        await can_user_call_model(
+            model="restricted-model",
+            llm_router=None,
+            user_object=user_object,
+        )
+
+    assert exc_info.value.type == ProxyErrorTypes.key_model_access_denied
+    assert int(exc_info.value.code) == status.HTTP_403_FORBIDDEN
+
+
 @pytest.mark.asyncio
 async def test_get_key_object_should_reconnect_once_on_db_connection_error():
     mock_prisma_client = MagicMock()
@@ -1144,6 +1192,7 @@ async def test_check_team_member_model_access_denied_model():
                 proxy_logging_obj=MagicMock(),
             )
         assert exc_info.value.type == ProxyErrorTypes.team_model_access_denied
+        assert int(exc_info.value.code) == status.HTTP_403_FORBIDDEN
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py
index 2d1586f0b17..4ccde85dae2 100644
--- a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py
+++ b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py
@@ -140,6 +140,7 @@ async def test_handle_authentication_error_budget_exceeded():
         )
 
     assert exc_info.value.type == ProxyErrorTypes.budget_exceeded
+    assert int(exc_info.value.code) == status.HTTP_429_TOO_MANY_REQUESTS
 
 
 @pytest.mark.asyncio
diff --git a/tests/test_litellm/proxy/auth/test_user_api_key_auth.py b/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
index 95b3d746c66..50c5f43b218 100644
--- a/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
+++ b/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
@@ -1,6 +1,7 @@
 import json
 import os
 import sys
+from datetime import datetime, timedelta
 from types import SimpleNamespace
 from unittest.mock import ANY, AsyncMock, MagicMock, patch
 
@@ -9,6 +10,7 @@ sys.path.insert(
 )  # Adds the parent directory to the system path
 
 import pytest
+from fastapi import status
 
 import litellm
 import litellm.proxy.proxy_server
@@ -178,6 +180,26 @@ async def test_custom_auth_does_not_enforce_key_model_access_by_default():
         mock_can_key.assert_not_awaited()
 
 
+@pytest.mark.asyncio
+async def test_post_custom_auth_expired_key_returns_unauthorized():
+    expired_token = UserAPIKeyAuth(
+        token="test_token",
+        expires=datetime.now() - timedelta(minutes=1),
+    )
+
+    with pytest.raises(ProxyException) as exc_info:
+        await _run_post_custom_auth_checks(
+            valid_token=expired_token,
+            request=MagicMock(),
+            request_data={},
+            route="/v1/chat/completions",
+            parent_otel_span=None,
+        )
+
+    assert exc_info.value.type == ProxyErrorTypes.expired_key
+    assert int(exc_info.value.code) == status.HTTP_401_UNAUTHORIZED
+
+
 @pytest.mark.asyncio
 async def test_custom_auth_honors_key_level_model_access_restriction_allowed_with_opt_in():
     valid_token = UserAPIKeyAuth(token="test_token", models=["gpt-4o-mini"])
@@ -934,6 +956,7 @@ async def test_proxy_admin_expired_key_from_cache():
             assert (
                 exc_info.value.type == ProxyErrorTypes.expired_key
             ), f"Expected expired_key error type, got {exc_info.value.type}"
+            assert int(exc_info.value.code) == status.HTTP_401_UNAUTHORIZED
             assert "Expired Key" in str(
                 exc_info.value.message
             ), f"Exception message should mention 'Expired Key', got: {exc_info.value.message}"
diff --git a/tests/test_litellm/proxy/common_utils/test_reset_budget_job.py b/tests/test_litellm/proxy/common_utils/test_reset_budget_job.py
index 5c86f9057a1..8b0c76f836c 100644
--- a/tests/test_litellm/proxy/common_utils/test_reset_budget_job.py
+++ b/tests/test_litellm/proxy/common_utils/test_reset_budget_job.py
@@ -39,6 +39,46 @@ class MockLiteLLMVerificationToken:
         return {"count": 1}
 
 
+class MockLiteLLMOrganizationTable:
+    def __init__(self):
+        self.update_many_calls: List[Dict[str, Any]] = []
+        self.find_many_calls: List[Dict[str, Any]] = []
+        self._find_many_results: List[Any] = []
+
+    def set_find_many_results(self, results: List[Any]):
+        self._find_many_results = results
+
+    async def find_many(self, where: Dict[str, Any]) -> List[Any]:
+        self.find_many_calls.append({"where": where})
+        return self._find_many_results
+
+    async def update_many(
+        self, where: Dict[str, Any], data: Dict[str, Any]
+    ) -> Dict[str, Any]:
+        self.update_many_calls.append({"where": where, "data": data})
+        return {"count": 1}
+
+
+class MockLiteLLMTagTable:
+    def __init__(self):
+        self.update_many_calls: List[Dict[str, Any]] = []
+        self.find_many_calls: List[Dict[str, Any]] = []
+        self._find_many_results: List[Any] = []
+
+    def set_find_many_results(self, results: List[Any]):
+        self._find_many_results = results
+
+    async def find_many(self, where: Dict[str, Any]) -> List[Any]:
+        self.find_many_calls.append({"where": where})
+        return self._find_many_results
+
+    async def update_many(
+        self, where: Dict[str, Any], data: Dict[str, Any]
+    ) -> Dict[str, Any]:
+        self.update_many_calls.append({"where": where, "data": data})
+        return {"count": 1}
+
+
 class MockLiteLLMEndUserTable:
     def __init__(self):
         self.find_many_calls: List[Dict[str, Any]] = []
@@ -57,6 +97,8 @@ class MockDB:
         self.litellm_teammembership = MockLiteLLMTeamMembership()
         self.litellm_verificationtoken = MockLiteLLMVerificationToken()
         self.litellm_endusertable = MockLiteLLMEndUserTable()
+        self.litellm_organizationtable = MockLiteLLMOrganizationTable()
+        self.litellm_tagtable = MockLiteLLMTagTable()
 
 
 class MockPrismaClient:
@@ -459,6 +501,100 @@ def test_reset_budget_for_keys_linked_to_budgets_empty(
     assert len(calls) == 0
 
 
+def test_reset_budget_for_orgs_linked_to_budgets(reset_budget_job, mock_prisma_client):
+    """
+    Test that when a budget tier is reset, orgs linked to that budget
+    (via budget_id) also get their spend reset.
+    """
+    now = datetime.now(timezone.utc)
+
+    test_budget = type(
+        "LiteLLM_BudgetTableFull",
+        (),
+        {
+            "max_budget": 100.0,
+            "budget_duration": "30d",
+            "budget_reset_at": now - timedelta(hours=1),
+            "budget_id": "30d-org-budget",
+            "created_at": now - timedelta(days=30),
+        },
+    )
+
+    asyncio.run(
+        reset_budget_job.reset_budget_for_orgs_linked_to_budgets(
+            budgets_to_reset=[test_budget]
+        )
+    )
+
+    calls = mock_prisma_client.db.litellm_organizationtable.update_many_calls
+    assert len(calls) == 1
+    call = calls[0]
+    assert call["where"]["budget_id"] == {"in": ["30d-org-budget"]}
+    assert call["where"]["spend"] == {"gt": 0}
+    assert call["data"]["spend"] == 0
+
+
+def test_reset_budget_for_orgs_linked_to_budgets_empty(
+    reset_budget_job, mock_prisma_client
+):
+    """
+    Test that when there are no budgets to reset, no update is performed
+    on the organization table.
+    """
+    asyncio.run(
+        reset_budget_job.reset_budget_for_orgs_linked_to_budgets(budgets_to_reset=[])
+    )
+    calls = mock_prisma_client.db.litellm_organizationtable.update_many_calls
+    assert len(calls) == 0
+
+
+def test_reset_budget_for_tags_linked_to_budgets(reset_budget_job, mock_prisma_client):
+    """
+    Test that when a budget tier is reset, tags linked to that budget
+    (via budget_id) also get their spend reset.
+    """
+    now = datetime.now(timezone.utc)
+
+    test_budget = type(
+        "LiteLLM_BudgetTableFull",
+        (),
+        {
+            "max_budget": 50.0,
+            "budget_duration": "30d",
+            "budget_reset_at": now - timedelta(hours=1),
+            "budget_id": "30d-tag-budget",
+            "created_at": now - timedelta(days=30),
+        },
+    )
+
+    asyncio.run(
+        reset_budget_job.reset_budget_for_tags_linked_to_budgets(
+            budgets_to_reset=[test_budget]
+        )
+    )
+
+    calls = mock_prisma_client.db.litellm_tagtable.update_many_calls
+    assert len(calls) == 1
+    call = calls[0]
+    assert call["where"]["budget_id"] == {"in": ["30d-tag-budget"]}
+    assert call["where"]["spend"] == {"gt": 0}
+    assert call["data"]["spend"] == 0
+
+
+def test_reset_budget_for_tags_linked_to_budgets_empty(
+    reset_budget_job, mock_prisma_client
+):
+    """
+    Test that when there are no budgets to reset, no update is performed
+    on the tag table.
+    """
+    asyncio.run(
+        reset_budget_job.reset_budget_for_tags_linked_to_budgets(budgets_to_reset=[])
+    )
+    calls = mock_prisma_client.db.litellm_tagtable.update_many_calls
+    assert len(calls) == 0
+
+
 @pytest.mark.parametrize(
     "budget_duration, expected_day, expected_month",
     [
@@ -618,6 +754,75 @@ def test_budget_table_reset_also_resets_linked_keys(
     assert calls[0]["data"]["spend"] == 0
 
 
+def test_budget_table_reset_also_resets_linked_orgs(
+    reset_budget_job, mock_prisma_client
+):
+    """
+    Integration-style test: when reset_budget_for_litellm_budget_table runs,
+    it should also reset spend for orgs linked to the expiring budget tiers
+    (in addition to end-users, team members, and keys).
+    """
+    now = datetime.now(timezone.utc)
+
+    test_budget = type(
+        "LiteLLM_BudgetTableFull",
+        (),
+        {
+            "max_budget": 100.0,
+            "budget_duration": "30d",
+            "budget_reset_at": now - timedelta(hours=1),
+            "budget_id": "30d-org-budget",
+            "created_at": now - timedelta(days=30),
+        },
+    )
+
+    mock_prisma_client.data["budget"] = [test_budget]
+
+    asyncio.run(reset_budget_job.reset_budget_for_litellm_budget_table())
+
+    calls = mock_prisma_client.db.litellm_organizationtable.update_many_calls
+    assert len(calls) == 1, (
+        "Expected reset_budget_for_litellm_budget_table to also reset orgs "
+        f"linked to expiring budgets, but got {len(calls)} update_many calls"
+    )
+    assert calls[0]["where"]["budget_id"] == {"in": ["30d-org-budget"]}
+    assert calls[0]["data"]["spend"] == 0
+
+
+def test_budget_table_reset_also_resets_linked_tags(
+    reset_budget_job, mock_prisma_client
+):
+    """
+    Integration-style test: when reset_budget_for_litellm_budget_table runs,
+    it should also reset spend for tags linked to the expiring budget tiers.
+    """
+    now = datetime.now(timezone.utc)
+
+    test_budget = type(
+        "LiteLLM_BudgetTableFull",
+        (),
+        {
+            "max_budget": 50.0,
+            "budget_duration": "30d",
+            "budget_reset_at": now - timedelta(hours=1),
+            "budget_id": "30d-tag-budget",
+            "created_at": now - timedelta(days=30),
+        },
+    )
+
+    mock_prisma_client.data["budget"] = [test_budget]
+
+    asyncio.run(reset_budget_job.reset_budget_for_litellm_budget_table())
+
+    calls = mock_prisma_client.db.litellm_tagtable.update_many_calls
+    assert len(calls) == 1, (
+        "Expected reset_budget_for_litellm_budget_table to also reset tags "
+        f"linked to expiring budgets, but got {len(calls)} update_many calls"
+    )
+    assert calls[0]["where"]["budget_id"] == {"in": ["30d-tag-budget"]}
+    assert calls[0]["data"]["spend"] == 0
+
+
 def test_reset_budget_resets_endusers_with_null_budget_id(
     reset_budget_job, mock_prisma_client
 ):
@@ -1057,16 +1262,26 @@ def test_reset_budget_windows_query_error_does_not_break_team_path(monkeypatch):
 
 
 def _make_counter_invalidation_job(monkeypatch):
-    """Stub spend_counter_cache so we can observe invalidation calls."""
+    """Stub spend_counter_cache (and user_api_key_cache) so we can observe
+    invalidation calls.
+
+    Both caches are looked up via ``from litellm.proxy.proxy_server import
+    <name>`` inside the reset job, so we publish them on a fake module.
+    """
     spend_counter_cache = MagicMock()
     spend_counter_cache.in_memory_cache.set_cache = MagicMock()
     spend_counter_cache.redis_cache = MagicMock()
     spend_counter_cache.redis_cache.async_set_cache = AsyncMock()
 
+    user_api_key_cache = MagicMock()
+    user_api_key_cache.async_delete_cache = AsyncMock()
+
     fake_module = types.ModuleType("litellm.proxy.proxy_server")
     fake_module.spend_counter_cache = spend_counter_cache
+    fake_module.user_api_key_cache = user_api_key_cache
     monkeypatch.setitem(sys.modules, "litellm.proxy.proxy_server", fake_module)
 
+    spend_counter_cache.user_api_key_cache = user_api_key_cache
     return spend_counter_cache
 
 
@@ -1205,3 +1420,136 @@ def test_reset_budget_for_keys_linked_to_budgets_invalidates_redis_counter(monke
     counter_cache.in_memory_cache.set_cache.assert_any_call(
         key="spend:key:sk-linked", value=0.0, ttl=60
     )
+
+
+def test_reset_budget_for_orgs_linked_to_budgets_invalidates_redis_counter(monkeypatch):
+    """Resetting orgs via budget tier must clear each linked org's counter."""
+    counter_cache = _make_counter_invalidation_job(monkeypatch)
+
+    expired_budget = type("B", (), {"budget_id": "budget-1"})
+    linked_org = type("Org", (), {"organization_id": "org-acme"})
+
+    prisma_client = MagicMock()
+    prisma_client.db.litellm_organizationtable.find_many = AsyncMock(
+        return_value=[linked_org]
+    )
+    prisma_client.db.litellm_organizationtable.update_many = AsyncMock(
+        return_value={"count": 1}
+    )
+
+    job = ResetBudgetJob(proxy_logging_obj=MagicMock(), prisma_client=prisma_client)
+    asyncio.run(job.reset_budget_for_orgs_linked_to_budgets([expired_budget]))
+
+    counter_cache.in_memory_cache.set_cache.assert_any_call(
+        key="spend:org:org-acme", value=0.0, ttl=60
+    )
+    counter_cache.redis_cache.async_set_cache.assert_any_await(
+        key="spend:org:org-acme", value=0.0, ttl=60
+    )
+
+
+def test_reset_budget_for_tags_linked_to_budgets_invalidates_redis_counter(monkeypatch):
+    """Resetting tags via budget tier must clear each linked tag's counter."""
+    counter_cache = _make_counter_invalidation_job(monkeypatch)
+
+    expired_budget = type("B", (), {"budget_id": "budget-1"})
+    linked_tag = type("Tag", (), {"tag_name": "tenant-42"})
+
+    prisma_client = MagicMock()
+    prisma_client.db.litellm_tagtable.find_many = AsyncMock(return_value=[linked_tag])
+    prisma_client.db.litellm_tagtable.update_many = AsyncMock(return_value={"count": 1})
+
+    job = ResetBudgetJob(proxy_logging_obj=MagicMock(), prisma_client=prisma_client)
+    asyncio.run(job.reset_budget_for_tags_linked_to_budgets([expired_budget]))
+
+    counter_cache.in_memory_cache.set_cache.assert_any_call(
+        key="spend:tag:tenant-42", value=0.0, ttl=60
+    )
+    counter_cache.redis_cache.async_set_cache.assert_any_await(
+        key="spend:tag:tenant-42", value=0.0, ttl=60
+    )
+
+
+def test_reset_budget_for_tags_linked_to_budgets_invalidates_management_cache(
+    monkeypatch,
+):
+    """Regression guard for the bug where tag spend stayed frozen across cycles.
+
+    ``SpendCounterReseed.from_db`` returns ``None`` for ``spend:tag:*`` keys,
+    so once the spend counter expires the tag budget check falls back to the
+    cached ``LiteLLM_TagTable.spend``. If we don't drop the management cache
+    entry on reset, that cached object lingers (TTL 60s) with the pre-reset
+    spend, and ``_tag_max_budget_check`` keeps returning HTTP 400 even though
+    the DB row has been zeroed.
+    """
+    counter_cache = _make_counter_invalidation_job(monkeypatch)
+
+    expired_budget = type("B", (), {"budget_id": "budget-1"})
+    linked_tag = type("Tag", (), {"tag_name": "tenant-42"})
+
+    prisma_client = MagicMock()
+    prisma_client.db.litellm_tagtable.find_many = AsyncMock(return_value=[linked_tag])
+    prisma_client.db.litellm_tagtable.update_many = AsyncMock(return_value={"count": 1})
+
+    job = ResetBudgetJob(proxy_logging_obj=MagicMock(), prisma_client=prisma_client)
+    asyncio.run(job.reset_budget_for_tags_linked_to_budgets([expired_budget]))
+
+    counter_cache.user_api_key_cache.async_delete_cache.assert_any_await(
+        key="tag:tenant-42"
+    )
+
+
+def test_reset_budget_for_tags_linked_to_budgets_invalidates_each_tag_management_cache(
+    monkeypatch,
+):
+    """When multiple tags share the expired budget tier, every one of them
+    has its ``user_api_key_cache`` entry dropped — not just the first."""
+    counter_cache = _make_counter_invalidation_job(monkeypatch)
+
+    expired_budget = type("B", (), {"budget_id": "budget-1"})
+    linked_tags = [
+        type("Tag", (), {"tag_name": "tenant-a"}),
+        type("Tag", (), {"tag_name": "tenant-b"}),
+        type("Tag", (), {"tag_name": "tenant-c"}),
+    ]
+
+    prisma_client = MagicMock()
+    prisma_client.db.litellm_tagtable.find_many = AsyncMock(return_value=linked_tags)
+    prisma_client.db.litellm_tagtable.update_many = AsyncMock(return_value={"count": 3})
+
+    job = ResetBudgetJob(proxy_logging_obj=MagicMock(), prisma_client=prisma_client)
+    asyncio.run(job.reset_budget_for_tags_linked_to_budgets([expired_budget]))
+
+    deleted_keys = {
+        call.kwargs.get("key")
+        for call in counter_cache.user_api_key_cache.async_delete_cache.await_args_list
+    }
+    assert deleted_keys == {"tag:tenant-a", "tag:tenant-b", "tag:tenant-c"}
+
+
+def test_reset_budget_for_keys_linked_to_budgets_does_not_touch_management_cache(
+    monkeypatch,
+):
+    """Cache invalidation is opt-in: keys / orgs / team-members rely on
+    ``SpendCounterReseed.from_db`` (which DOES handle their counter keys),
+    so the cache_key_fn hook is intentionally not wired for them. This test
+    locks in that no-op so a future refactor doesn't accidentally start
+    clobbering the key cache (which would cost an extra DB round-trip per
+    reset cycle without fixing anything)."""
+    counter_cache = _make_counter_invalidation_job(monkeypatch)
+
+    expired_budget = type("B", (), {"budget_id": "budget-1"})
+    linked_key = type("Key", (), {"token": "sk-linked"})
+
+    prisma_client = MagicMock()
+    prisma_client.db.litellm_verificationtoken.find_many = AsyncMock(
+        return_value=[linked_key]
+    )
+    prisma_client.db.litellm_verificationtoken.update_many = AsyncMock(
+        return_value={"count": 1}
+    )
+
+    job = ResetBudgetJob(proxy_logging_obj=MagicMock(), prisma_client=prisma_client)
+    asyncio.run(job.reset_budget_for_keys_linked_to_budgets([expired_budget]))
+
+    counter_cache.user_api_key_cache.async_delete_cache.assert_not_awaited()
diff --git a/tests/test_litellm/proxy/test_proxy_server.py b/tests/test_litellm/proxy/test_proxy_server.py
index 6718f52cbf1..859594f7a0b 100644
--- a/tests/test_litellm/proxy/test_proxy_server.py
+++ b/tests/test_litellm/proxy/test_proxy_server.py
@@ -1728,6 +1728,67 @@ async def test_add_proxy_budget_to_db_only_creates_user_no_keys():
         assert call_args.kwargs["query_type"] == "update_data"
 
 
+@pytest.mark.asyncio
+async def test_add_proxy_budget_to_db_backfills_budget_reset_at():
+    """
+    Test that _upsert_proxy_budget_with_reset_at_backfill issues a conditional
+    update_many with `WHERE budget_reset_at IS NULL` to backfill the column on
+    rows that pre-existed without a reset schedule. Without this, the proxy
+    admin row stays at NULL and reset_budget_for_litellm_users never matches
+    it (NULL < now() is unknown in SQL), so the global proxy budget never
+    resets.
+    """
+    from unittest.mock import AsyncMock, MagicMock, patch
+
+    import litellm
+    from litellm.proxy.proxy_server import ProxyStartupEvent
+
+    litellm.budget_duration = "30d"
+    litellm.max_budget = 100.0
+    litellm_proxy_budget_name = "litellm-proxy-budget"
+
+    mock_prisma = MagicMock()
+    mock_prisma.db.litellm_usertable.update_many = AsyncMock(return_value={"count": 1})
+
+    mock_generate_key_helper = AsyncMock(
+        return_value={
+            "user_id": litellm_proxy_budget_name,
+            "max_budget": 100.0,
+            "budget_duration": "30d",
+            "spend": 0,
+            "models": [],
+        }
+    )
+
+    with (
+        patch(
+            "litellm.proxy.proxy_server.generate_key_helper_fn",
+            mock_generate_key_helper,
+        ),
+        patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
+    ):
+        await ProxyStartupEvent._upsert_proxy_budget_with_reset_at_backfill(
+            litellm_proxy_budget_name
+        )
+
+    # Upsert ran with the configured budget
+    mock_generate_key_helper.assert_called_once()
+
+    # Backfill update_many ran with the conditional WHERE
+    mock_prisma.db.litellm_usertable.update_many.assert_called_once()
+    backfill_call = mock_prisma.db.litellm_usertable.update_many.call_args
+    assert backfill_call.kwargs["where"]["user_id"] == litellm_proxy_budget_name
+    assert backfill_call.kwargs["where"]["budget_reset_at"] is None
+
+    # The backfilled value must be a real future datetime — anything else and
+    # reset_budget_for_litellm_users would still skip the row.
+    from datetime import datetime, timezone
+
+    backfilled_reset_at = backfill_call.kwargs["data"]["budget_reset_at"]
+    assert isinstance(backfilled_reset_at, datetime)
+    assert backfilled_reset_at > datetime.now(timezone.utc)
+
+
 @pytest.mark.asyncio
 async def test_custom_ui_sso_sign_in_handler_config_loading():
     """
diff --git a/tests/test_openai_endpoints.py b/tests/test_openai_endpoints.py
index 024d05e1037..8a3f9361ba1 100644
--- a/tests/test_openai_endpoints.py
+++ b/tests/test_openai_endpoints.py
@@ -303,7 +303,7 @@ async def test_chat_completion():
             api_key=key_gen["key"],
             api_version="2024-02-15-preview",
         )
-        with pytest.raises(openai.AuthenticationError) as e:
+        with pytest.raises(openai.PermissionDeniedError) as e:
             response = await azure_client.chat.completions.create(
                 model="gpt-4",
                 messages=[{"role": "user", "content": "Hello!"}],
diff --git a/tests/test_users.py b/tests/test_users.py
index 05253a19aa5..57fbb0483e4 100644
--- a/tests/test_users.py
+++ b/tests/test_users.py
@@ -302,14 +302,14 @@ async def test_user_model_access():
             model="good-model",
         )
 
-        with pytest.raises(openai.AuthenticationError):
+        with pytest.raises(openai.PermissionDeniedError):
             await chat_completion(
                 session=session,
                 key=key,
                 model="bedrock/anthropic.claude-3-sonnet-20240229-v1:0",
             )
 
-        with pytest.raises(openai.AuthenticationError):
+        with pytest.raises(openai.PermissionDeniedError):
             await chat_completion(
                 session=session,
                 key=key,
diff --git a/uv.lock b/uv.lock
index f8d78fe8794..ab9aba1e38f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -3405,7 +3405,7 @@ requires-dist = [
     { name = "gunicorn", marker = "extra == 'proxy'", specifier = "==23.0.0" },
     { name = "httpx", specifier = ">=0.28.0,<1.0" },
     { name = "importlib-metadata", specifier = ">=8.0.0,<9.0" },
-    { name = "jinja2", specifier = ">=3.1.0,<4.0" },
+    { name = "jinja2", specifier = ">=3.1.6,<4.0" },
     { name = "jsonschema", specifier = ">=4.0.0,<5.0" },
     { name = "langfuse", marker = "extra == 'proxy-runtime'", specifier = "==2.59.7" },
     { name = "litellm-enterprise", marker = "extra == 'proxy'", editable = "enterprise" },

From 0af33fbe7004d8d13aaa912373bba2d20e62042b Mon Sep 17 00:00:00 2001
From: ryan-crabbe-berri <ryan@berri.ai>
Date: Sat, 9 May 2026 19:01:58 -0700
Subject: [PATCH 31/33] fix(ui): omit allowed_routes from key edit save when
 unchanged (#27553)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(ui): omit allowed_routes from key edit save when unchanged

When a team admin opens Edit Settings on a key with key_type=AI APIs and
saves without changing anything, the UI re-sends the existing allowed_routes
value, which the backend's _check_allowed_routes_caller_permission gate
rejects for non-proxy-admins (LIT-2681).

Strip allowed_routes from the patch in handleSubmit when it deep-equals the
original keyData.allowed_routes. The backend treats absence as "leave alone,"
so no-op saves now succeed for non-admins. Admins explicitly editing the
field still send the new value.

* fix(ui): order-insensitive allowed_routes diff + cover null-original case

Address Greptile review:

- Switch the "is allowed_routes unchanged" check to a Set-based comparison so
  a server-side reorder of the array doesn't register as a user edit and
  re-trigger LIT-2681.
- Add two regression tests: (1) keyData.allowed_routes is null and the form
  is untouched — patch should strip the field; (2) server returned routes in
  a different order than the user originally entered — patch should still
  recognize the value as unchanged.

* chore(ui): strip ticket refs and tighten comments in key edit fix

- Remove internal-tracker references from in-code comments
- Tighten the WHY comment in handleSubmit to two lines
- Drop redundant test-block comments — test names already describe the case

* fix(ui): annotate Set<string> generic in allowed_routes diff to fix tsc
---
 .../templates/key_edit_view.test.tsx          | 162 ++++++++++++++----
 .../components/templates/key_edit_view.tsx    |  82 +++++----
 2 files changed, 180 insertions(+), 64 deletions(-)

diff --git a/ui/litellm-dashboard/src/components/templates/key_edit_view.test.tsx b/ui/litellm-dashboard/src/components/templates/key_edit_view.test.tsx
index 2e4d0d97e4c..1886075a9d9 100644
--- a/ui/litellm-dashboard/src/components/templates/key_edit_view.test.tsx
+++ b/ui/litellm-dashboard/src/components/templates/key_edit_view.test.tsx
@@ -158,8 +158,8 @@ describe("KeyEditView", () => {
     const { getByText } = renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -176,8 +176,8 @@ describe("KeyEditView", () => {
     const { getByText } = renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -194,8 +194,8 @@ describe("KeyEditView", () => {
     const { getByLabelText } = renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -219,7 +219,7 @@ describe("KeyEditView", () => {
       <KeyEditView
         keyData={MOCK_KEY_DATA}
         onCancel={onCancelMock}
-        onSubmit={async () => { }}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -241,8 +241,8 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -259,8 +259,8 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -277,8 +277,8 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -295,8 +295,8 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -314,7 +314,7 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
+        onCancel={() => {}}
         onSubmit={onSubmitMock}
         accessToken={"test-token"}
         userID={"test-user"}
@@ -344,8 +344,8 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={keyDataWithManagementRoutes}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -367,8 +367,8 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={keyDataWithInfoRoutes}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={""}
         userID={""}
         userRole={""}
@@ -385,8 +385,8 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
-        onSubmit={async () => { }}
+        onCancel={() => {}}
+        onSubmit={async () => {}}
         accessToken={"test-token"}
         userID={""}
         userRole={""}
@@ -404,7 +404,7 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
+        onCancel={() => {}}
         onSubmit={onSubmitMock}
         accessToken={"test-token"}
         userID={"test-user"}
@@ -434,10 +434,14 @@ describe("KeyEditView", () => {
 
   it("should handle empty allowed routes string on submit", async () => {
     const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+    const keyDataWithRoutes = {
+      ...MOCK_KEY_DATA,
+      allowed_routes: ["llm_api_routes"],
+    };
     renderWithProviders(
       <KeyEditView
-        keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
+        keyData={keyDataWithRoutes}
+        onCancel={() => {}}
         onSubmit={onSubmitMock}
         accessToken={"test-token"}
         userID={"test-user"}
@@ -463,6 +467,101 @@ describe("KeyEditView", () => {
     });
   });
 
+  it("should omit allowed_routes from submit when value is unchanged", async () => {
+    const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+    const aiApisKeyData = {
+      ...MOCK_KEY_DATA,
+      allowed_routes: ["llm_api_routes"],
+    };
+    renderWithProviders(
+      <KeyEditView
+        keyData={aiApisKeyData}
+        onCancel={() => {}}
+        onSubmit={onSubmitMock}
+        accessToken={"test-token"}
+        userID={"test-user"}
+        userRole={"admin"}
+        premiumUser={false}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(screen.getByRole("button", { name: /save changes/i })).toBeInTheDocument();
+    });
+
+    const submitButton = screen.getByRole("button", { name: /save changes/i });
+    await userEvent.click(submitButton);
+
+    await waitFor(() => {
+      expect(onSubmitMock).toHaveBeenCalled();
+      const callArgs = onSubmitMock.mock.calls[0][0];
+      expect("allowed_routes" in callArgs).toBe(false);
+    });
+  });
+
+  it("should omit allowed_routes from submit when keyData.allowed_routes is null and form is untouched", async () => {
+    const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+    const keyDataNullRoutes = {
+      ...MOCK_KEY_DATA,
+      allowed_routes: null as unknown as string[],
+    };
+    renderWithProviders(
+      <KeyEditView
+        keyData={keyDataNullRoutes}
+        onCancel={() => {}}
+        onSubmit={onSubmitMock}
+        accessToken={"test-token"}
+        userID={"test-user"}
+        userRole={"admin"}
+        premiumUser={false}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(screen.getByRole("button", { name: /save changes/i })).toBeInTheDocument();
+    });
+
+    const submitButton = screen.getByRole("button", { name: /save changes/i });
+    await userEvent.click(submitButton);
+
+    await waitFor(() => {
+      expect(onSubmitMock).toHaveBeenCalled();
+      const callArgs = onSubmitMock.mock.calls[0][0];
+      expect("allowed_routes" in callArgs).toBe(false);
+    });
+  });
+
+  it("should omit allowed_routes from submit when server returned routes in a different order", async () => {
+    const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+    const keyDataReordered = {
+      ...MOCK_KEY_DATA,
+      allowed_routes: ["beta_routes", "alpha_routes"],
+    };
+    renderWithProviders(
+      <KeyEditView
+        keyData={keyDataReordered}
+        onCancel={() => {}}
+        onSubmit={onSubmitMock}
+        accessToken={"test-token"}
+        userID={"test-user"}
+        userRole={"admin"}
+        premiumUser={false}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(screen.getByRole("button", { name: /save changes/i })).toBeInTheDocument();
+    });
+
+    const submitButton = screen.getByRole("button", { name: /save changes/i });
+    await userEvent.click(submitButton);
+
+    await waitFor(() => {
+      expect(onSubmitMock).toHaveBeenCalled();
+      const callArgs = onSubmitMock.mock.calls[0][0];
+      expect("allowed_routes" in callArgs).toBe(false);
+    });
+  });
 
   it("should pass access_group_ids to onSubmit when saving key with access groups", async () => {
     const onSubmitMock = vi.fn().mockResolvedValue(undefined);
@@ -554,7 +653,7 @@ describe("KeyEditView", () => {
     renderWithProviders(
       <KeyEditView
         keyData={MOCK_KEY_DATA}
-        onCancel={() => { }}
+        onCancel={() => {}}
         onSubmit={onSubmitMock}
         accessToken={"test-token"}
         userID={"test-user"}
@@ -576,10 +675,13 @@ describe("KeyEditView", () => {
     });
 
     // Wait for the cancel button to actually be disabled (state update may take a moment)
-    await waitFor(() => {
-      const cancelButton = screen.getByRole("button", { name: /cancel/i });
-      expect(cancelButton).toBeDisabled();
-    }, { timeout: 3000 });
+    await waitFor(
+      () => {
+        const cancelButton = screen.getByRole("button", { name: /cancel/i });
+        expect(cancelButton).toBeDisabled();
+      },
+      { timeout: 3000 },
+    );
 
     // Clean up: resolve the promise to allow the form to complete
     if (resolveSubmit) {
diff --git a/ui/litellm-dashboard/src/components/templates/key_edit_view.tsx b/ui/litellm-dashboard/src/components/templates/key_edit_view.tsx
index 9b38d930a50..d5e410029a7 100644
--- a/ui/litellm-dashboard/src/components/templates/key_edit_view.tsx
+++ b/ui/litellm-dashboard/src/components/templates/key_edit_view.tsx
@@ -78,7 +78,6 @@ const getKeyTypeFromRoutes = (allowedRoutes: string[] | null | undefined): strin
   return "default";
 };
 
-
 export function KeyEditView({
   keyData,
   onCancel,
@@ -106,7 +105,7 @@ export function KeyEditView({
   const [neverExpire, setNeverExpire] = useState<boolean>(!keyData.expires);
   const [isKeySaving, setIsKeySaving] = useState(false);
   const [budgetLimits, setBudgetLimits] = useState<BudgetWindowEntry[]>(
-    Array.isArray(keyData.budget_limits) ? keyData.budget_limits : []
+    Array.isArray(keyData.budget_limits) ? keyData.budget_limits : [],
   );
   const { data: organizations, isLoading: isOrganizationsLoading } = useOrganizations();
   const { data: projects } = useProjects();
@@ -116,9 +115,7 @@ export function KeyEditView({
   const projectDisplay = (() => {
     if (!keyData.project_id) return null;
     const project = projects?.find((p) => p.project_id === keyData.project_id);
-    return project?.project_alias
-      ? `${project.project_alias} (${keyData.project_id})`
-      : keyData.project_id;
+    return project?.project_alias ? `${project.project_alias} (${keyData.project_id})` : keyData.project_id;
   })();
 
   useEffect(() => {
@@ -198,9 +195,10 @@ export function KeyEditView({
     access_group_ids: keyData.access_group_ids || [],
     auto_rotate: keyData.auto_rotate || false,
     ...(keyData.rotation_interval && { rotation_interval: keyData.rotation_interval }),
-    allowed_routes: Array.isArray(keyData.allowed_routes) && keyData.allowed_routes.length > 0
-      ? keyData.allowed_routes.join(", ")
-      : "",
+    allowed_routes:
+      Array.isArray(keyData.allowed_routes) && keyData.allowed_routes.length > 0
+        ? keyData.allowed_routes.join(", ")
+        : "",
   };
 
   useEffect(() => {
@@ -226,9 +224,10 @@ export function KeyEditView({
       access_group_ids: keyData.access_group_ids || [],
       auto_rotate: keyData.auto_rotate || false,
       ...(keyData.rotation_interval && { rotation_interval: keyData.rotation_interval }),
-      allowed_routes: Array.isArray(keyData.allowed_routes) && keyData.allowed_routes.length > 0
-        ? keyData.allowed_routes.join(", ")
-        : "",
+      allowed_routes:
+        Array.isArray(keyData.allowed_routes) && keyData.allowed_routes.length > 0
+          ? keyData.allowed_routes.join(", ")
+          : "",
     });
   }, [keyData, form]);
 
@@ -275,12 +274,25 @@ export function KeyEditView({
       }
       // If it's already an array (shouldn't happen, but handle it), keep as is
 
+      // Backend rejects non-empty allowed_routes from non-admins, so re-sending
+      // an unchanged value 403s a team admin. Set compare tolerates reorder.
+      const originalRoutesSet = new Set<string>(Array.isArray(keyData.allowed_routes) ? keyData.allowed_routes : []);
+      const submittedRoutesSet = new Set<string>(Array.isArray(values.allowed_routes) ? values.allowed_routes : []);
+      const allowedRoutesUnchanged =
+        originalRoutesSet.size === submittedRoutesSet.size &&
+        [...submittedRoutesSet].every((r) => originalRoutesSet.has(r));
+      if (allowedRoutesUnchanged) {
+        delete values.allowed_routes;
+      }
+
       if (neverExpire) {
         values.duration = null;
       }
 
       // Include multi-window budget limits (filter out incomplete entries)
-      const validWindows = budgetLimits.filter((w) => w.budget_duration && w.max_budget !== null && w.max_budget !== undefined);
+      const validWindows = budgetLimits.filter(
+        (w) => w.budget_duration && w.max_budget !== null && w.max_budget !== undefined,
+      );
       values.budget_limits = validWindows.length > 0 ? validWindows : undefined;
 
       await onSubmit(values);
@@ -305,9 +317,13 @@ export function KeyEditView({
           {({ getFieldValue, setFieldValue }) => {
             const allowedRoutesValue = getFieldValue("allowed_routes") || "";
             // Convert string to array for checking
-            const allowedRoutes = typeof allowedRoutesValue === "string" && allowedRoutesValue.trim() !== ""
-              ? allowedRoutesValue.split(",").map((r: string) => r.trim()).filter((r: string) => r.length > 0)
-              : [];
+            const allowedRoutes =
+              typeof allowedRoutesValue === "string" && allowedRoutesValue.trim() !== ""
+                ? allowedRoutesValue
+                    .split(",")
+                    .map((r: string) => r.trim())
+                    .filter((r: string) => r.length > 0)
+                : [];
             const isDisabled = allowedRoutes.includes("management_routes") || allowedRoutes.includes("info_routes");
             const models = getFieldValue("models") || [];
 
@@ -348,9 +364,13 @@ export function KeyEditView({
           {({ getFieldValue, setFieldValue }) => {
             const allowedRoutesValue = getFieldValue("allowed_routes") || "";
             // Convert string to array for getKeyTypeFromRoutes
-            const allowedRoutes = typeof allowedRoutesValue === "string" && allowedRoutesValue.trim() !== ""
-              ? allowedRoutesValue.split(",").map((r: string) => r.trim()).filter((r: string) => r.length > 0)
-              : [];
+            const allowedRoutes =
+              typeof allowedRoutesValue === "string" && allowedRoutesValue.trim() !== ""
+                ? allowedRoutesValue
+                    .split(",")
+                    .map((r: string) => r.trim())
+                    .filter((r: string) => r.length > 0)
+                : [];
             const keyTypeValue = getKeyTypeFromRoutes(allowedRoutes);
 
             return (
@@ -415,9 +435,7 @@ export function KeyEditView({
         }
         name="allowed_routes"
       >
-        <Input
-          placeholder="Enter allowed routes (comma-separated). Special values: llm_api_routes, management_routes. Examples: llm_api_routes, /chat/completions, /keys/*. Leave empty to allow all routes"
-        />
+        <Input placeholder="Enter allowed routes (comma-separated). Special values: llm_api_routes, management_routes. Examples: llm_api_routes, /chat/completions, /keys/*. Leave empty to allow all routes" />
       </Form.Item>
 
       <Form.Item label="Max Budget (USD)" name="max_budget">
@@ -442,10 +460,7 @@ export function KeyEditView({
           </span>
         }
       >
-        <BudgetWindowsEditor
-          value={budgetLimits}
-          onChange={setBudgetLimits}
-        />
+        <BudgetWindowsEditor value={budgetLimits} onChange={setBudgetLimits} />
       </Form.Item>
 
       <Form.Item label="TPM Limit" name="tpm_limit">
@@ -579,7 +594,7 @@ export function KeyEditView({
               !premiumUser
                 ? "Premium feature - Upgrade to set allowed pass through routes by key"
                 : Array.isArray(keyData.metadata?.allowed_passthrough_routes) &&
-                  keyData.metadata.allowed_passthrough_routes.length > 0
+                    keyData.metadata.allowed_passthrough_routes.length > 0
                   ? `Current: ${keyData.metadata.allowed_passthrough_routes.join(", ")}`
                   : "Select or enter allowed pass through routes"
             }
@@ -690,14 +705,13 @@ export function KeyEditView({
             return team.team_alias?.toLowerCase().includes(input.toLowerCase()) ?? false;
           }}
         >
-          {(selectedOrganizationId
-            ? teams?.filter((t) => t.organization_id === selectedOrganizationId)
-            : teams
-          )?.map((team) => (
-            <Select.Option key={team.team_id} value={team.team_id}>
-              {`${team.team_alias} (${team.team_id})`}
-            </Select.Option>
-          ))}
+          {(selectedOrganizationId ? teams?.filter((t) => t.organization_id === selectedOrganizationId) : teams)?.map(
+            (team) => (
+              <Select.Option key={team.team_id} value={team.team_id}>
+                {`${team.team_alias} (${team.team_id})`}
+              </Select.Option>
+            ),
+          )}
         </Select>
       </Form.Item>
       {enableProjectsUI && hasProject && (

From 99218c6fa0326deb0ff7c1a8ee84f00cd693c7c0 Mon Sep 17 00:00:00 2001
From: Sameer Kankute <sameer@berri.ai>
Date: Mon, 11 May 2026 09:49:47 +0530
Subject: [PATCH 32/33] Fix deprecated model test

---
 tests/llm_translation/test_openrouter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/llm_translation/test_openrouter.py b/tests/llm_translation/test_openrouter.py
index 631b0770e3d..8fbb8803d11 100644
--- a/tests/llm_translation/test_openrouter.py
+++ b/tests/llm_translation/test_openrouter.py
@@ -11,7 +11,7 @@ import litellm
 def test_completion_openrouter_reasoning_content():
     litellm._turn_on_debug()
     resp = litellm.completion(
-        model="openrouter/anthropic/claude-3.7-sonnet",
+        model="openrouter/anthropic/claude-sonnet-4",
         messages=[{"role": "user", "content": "Hello world"}],
         reasoning={"effort": "high"},
     )

From 055bdc35077c05314680c7c4444b8e6666852940 Mon Sep 17 00:00:00 2001
From: Sameer Kankute <sameer@berri.ai>
Date: Mon, 11 May 2026 11:35:56 +0530
Subject: [PATCH 33/33] fix(auth): harden JWT routing wildcard iss and merge
 list team_id claims

Reject fnmatch wildcards on non-scope claims when the claim string contains
whitespace so malformed iss values cannot match patterns like trusted.*.

Merge every entry when team_id_jwt_field resolves to a list instead of
keeping only the first element.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 litellm/proxy/auth/handle_jwt.py              |  15 ++-
 litellm/proxy/auth/user_api_key_auth.py       |   5 +
 .../proxy/auth/test_handle_jwt.py             |   5 +
 .../proxy/auth/test_user_api_key_auth.py      | 100 ++++++++++--------
 4 files changed, 77 insertions(+), 48 deletions(-)

diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py
index a270031c33c..5b116c142b2 100644
--- a/litellm/proxy/auth/handle_jwt.py
+++ b/litellm/proxy/auth/handle_jwt.py
@@ -227,8 +227,8 @@ class JWTHandler:
     def get_all_jwt_team_ids(self, token: dict) -> List[str]:
         """
         Return team IDs from both the plural ``team_ids_jwt_field`` and the
-        singular ``team_id_jwt_field`` claim, as a deduplicated list preserving
-        plural-first order.
+        singular ``team_id_jwt_field`` claim (string or list of strings), as a
+        deduplicated list preserving plural-first order.
 
         Membership-reconciliation paths (SSO callback, JWT-bearer sync) need
         to consider both claim shapes. Reading only the plural field — as
@@ -249,9 +249,14 @@ class JWTHandler:
                 default=None,
             )
             if isinstance(singular, list):
-                singular = singular[0] if singular else None
-            if singular and singular not in team_ids:
-                team_ids.append(singular)
+                for item in singular:
+                    if item is None:
+                        continue
+                    sid = str(item)
+                    if sid and sid not in team_ids:
+                        team_ids.append(sid)
+            elif singular and str(singular) not in team_ids:
+                team_ids.append(str(singular))
         return team_ids
 
     def get_end_user_id(
diff --git a/litellm/proxy/auth/user_api_key_auth.py b/litellm/proxy/auth/user_api_key_auth.py
index 2f61a40bc9a..213c68f1db2 100644
--- a/litellm/proxy/auth/user_api_key_auth.py
+++ b/litellm/proxy/auth/user_api_key_auth.py
@@ -219,6 +219,11 @@ def _routing_selector_matches_claim(
     def _selector_matches_claim(selector: str, claim: str) -> bool:
         # NOTE: wildcard matching is case-sensitive (fnmatch.fnmatchcase).
         if "*" in selector or "?" in selector:
+            # Without scope splitting, do not let `*` span whitespace: a malformed
+            # iss like "trusted.example.com evil.com" must not match "trusted.*".
+            # Scope uses split_space_delimited so each claim token is checked separately.
+            if not split_space_delimited and any(ch.isspace() for ch in claim):
+                return False
             return fnmatch.fnmatchcase(claim, selector)
         return selector == claim
 
diff --git a/tests/test_litellm/proxy/auth/test_handle_jwt.py b/tests/test_litellm/proxy/auth/test_handle_jwt.py
index c09c303deee..90c5d4f4fc5 100644
--- a/tests/test_litellm/proxy/auth/test_handle_jwt.py
+++ b/tests/test_litellm/proxy/auth/test_handle_jwt.py
@@ -524,6 +524,11 @@ def test_get_all_jwt_team_ids_unions_singular_and_plural():
         "b",
     ]
 
+    # singular field as multi-element list (some IdPs) — merge all, preserve plural-first order
+    assert jwt_handler.get_all_jwt_team_ids(
+        {"team_id": ["primary", "secondary"], "teams": ["a"]}
+    ) == ["a", "primary", "secondary"]
+
     # neither populated
     assert jwt_handler.get_all_jwt_team_ids({}) == []
 
diff --git a/tests/test_litellm/proxy/auth/test_user_api_key_auth.py b/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
index 4b0f6c0ea2f..a6483403c27 100644
--- a/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
+++ b/tests/test_litellm/proxy/auth/test_user_api_key_auth.py
@@ -587,6 +587,14 @@ def _assert_get_api_key_with_custom_litellm_key_header(
             False,
             False,
         ),
+        # Wildcard iss must not match space-containing claim strings (fnmatch * spans spaces)
+        (
+            "trusted.*",
+            "trusted.example.com attacker.example.com",
+            False,
+            False,
+        ),
+        ("trusted.*", "trusted.example.com", True, False),
         (
             ["issuer-a.example.com", "issuer-b.example.com"],
             "issuer-b.example.com",
@@ -667,7 +675,10 @@ def test_routing_selector_matches_claim_parametrized(
                 aud=["api://litellm", "api://fallback"],
                 path="oauth2",
             ),
-            {"iss": "oauth-issuer.example.com", "aud": ["api://other", "api://litellm"]},
+            {
+                "iss": "oauth-issuer.example.com",
+                "aud": ["api://other", "api://litellm"],
+            },
             True,
         ),
         # All provided selectors are AND-ed.
@@ -1738,20 +1749,21 @@ class TestJWTOAuth2Coexistence:
         mock_request.headers = {"authorization": f"Bearer {jwt_token}"}
         mock_request.query_params = {}
 
-        with patch(
-            "litellm.proxy.proxy_server.general_settings", general_settings
-        ), patch("litellm.proxy.proxy_server.premium_user", True), patch(
-            "litellm.proxy.proxy_server.master_key", "sk-master"
-        ), patch(
-            "litellm.proxy.proxy_server.prisma_client", None
-        ), patch(
-            "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
-            new_callable=AsyncMock,
-            return_value=mock_oauth2_response,
-        ) as mock_oauth2, patch(
-            "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
-            new_callable=AsyncMock,
-        ) as mock_jwt_auth:
+        with (
+            patch("litellm.proxy.proxy_server.general_settings", general_settings),
+            patch("litellm.proxy.proxy_server.premium_user", True),
+            patch("litellm.proxy.proxy_server.master_key", "sk-master"),
+            patch("litellm.proxy.proxy_server.prisma_client", None),
+            patch(
+                "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
+                new_callable=AsyncMock,
+                return_value=mock_oauth2_response,
+            ) as mock_oauth2,
+            patch(
+                "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
+                new_callable=AsyncMock,
+            ) as mock_jwt_auth,
+        ):
             litellm.proxy.proxy_server.jwt_handler.update_environment(
                 prisma_client=None,
                 user_api_key_cache=DualCache(),
@@ -1809,20 +1821,21 @@ class TestJWTOAuth2Coexistence:
         mock_request.headers = {"authorization": f"Bearer {jwt_token}"}
         mock_request.query_params = {}
 
-        with patch(
-            "litellm.proxy.proxy_server.general_settings", general_settings
-        ), patch("litellm.proxy.proxy_server.premium_user", True), patch(
-            "litellm.proxy.proxy_server.master_key", "sk-master"
-        ), patch(
-            "litellm.proxy.proxy_server.prisma_client", None
-        ), patch(
-            "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
-            new_callable=AsyncMock,
-        ) as mock_oauth2, patch(
-            "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
-            new_callable=AsyncMock,
-            return_value=mock_jwt_result,
-        ) as mock_jwt_auth:
+        with (
+            patch("litellm.proxy.proxy_server.general_settings", general_settings),
+            patch("litellm.proxy.proxy_server.premium_user", True),
+            patch("litellm.proxy.proxy_server.master_key", "sk-master"),
+            patch("litellm.proxy.proxy_server.prisma_client", None),
+            patch(
+                "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
+                new_callable=AsyncMock,
+            ) as mock_oauth2,
+            patch(
+                "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
+                new_callable=AsyncMock,
+                return_value=mock_jwt_result,
+            ) as mock_jwt_auth,
+        ):
             litellm.proxy.proxy_server.jwt_handler.update_environment(
                 prisma_client=None,
                 user_api_key_cache=DualCache(),
@@ -1873,20 +1886,21 @@ class TestJWTOAuth2Coexistence:
         mock_request.headers = {"authorization": f"Bearer {jwt_token}"}
         mock_request.query_params = {}
 
-        with patch(
-            "litellm.proxy.proxy_server.general_settings", general_settings
-        ), patch("litellm.proxy.proxy_server.premium_user", True), patch(
-            "litellm.proxy.proxy_server.master_key", "sk-master"
-        ), patch(
-            "litellm.proxy.proxy_server.prisma_client", None
-        ), patch(
-            "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
-            new_callable=AsyncMock,
-            return_value=mock_oauth2_response,
-        ) as mock_oauth2, patch(
-            "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
-            new_callable=AsyncMock,
-        ) as mock_jwt_auth:
+        with (
+            patch("litellm.proxy.proxy_server.general_settings", general_settings),
+            patch("litellm.proxy.proxy_server.premium_user", True),
+            patch("litellm.proxy.proxy_server.master_key", "sk-master"),
+            patch("litellm.proxy.proxy_server.prisma_client", None),
+            patch(
+                "litellm.proxy.auth.user_api_key_auth.Oauth2Handler.check_oauth2_token",
+                new_callable=AsyncMock,
+                return_value=mock_oauth2_response,
+            ) as mock_oauth2,
+            patch(
+                "litellm.proxy.auth.user_api_key_auth.JWTAuthManager.auth_builder",
+                new_callable=AsyncMock,
+            ) as mock_jwt_auth,
+        ):
             litellm.proxy.proxy_server.jwt_handler.update_environment(
                 prisma_client=None,
                 user_api_key_cache=DualCache(),